Windows XP SP2 introduced true policies for the configurable actions in the Internet Explorer Security tab settings. These policies are incorporated into Internet Explorer in Windows Server 2003 SP1. You can set these actions to allow less secure behavior within a security zone. In this release, these security settings are managed using the GPMC and, if set, can be changed only by a GPO or by an administrator.

Administrators can manage the new Feature Control policies by using GPOs. An updated Inetres.adm file contains the same list of URL Action settings as policies that are found in Internet Explorer as preferences. When Internet Explorer is installed, the default HKEY_CURRENT_USER preference settings for these URL Action settings are registered on the computer, as they were in previous versions.

Note

The administrator must use the GPMC snap-in to add URL Actions as policies. Group Policy administrators can uniformly configure the new Internet Explorer URL Action security setting policies for the computers and users that they manage. If the administrator chooses to set selected URL Actions and not all URL Actions, it is important to tell users which actions are controlled by policy because these actions will not respond to user preference settings.

By adding the new Internet Explorer URL Action security setting policies to Group Policy, administrators can manage these true policies to establish standard security settings for all the computers they configure. The administrator can control these settings in such a way that they cannot be changed except through Group Policy or by a user with administrator privileges, thus ensuring that users cannot set URL Action settings that override a Feature Control policy or preference setting.

Changes to Internet Explorer URL Action Security Settings

The following definitions apply to Internet Explorer settings for Windows Server 2003 with SP1:

• Security zones: Internet, Intranet, and Local Machine. There are also special zone settings: Locked-Down Local Machine Zone, Trusted Sites, and Restricted Sites.

• Templates: Standard settings for all URL Actions in a security zone. Templates can be applied in any zone, and settings provide a range of choices from low security to medium-low, medium, and up to high security for the zone.

• URL Actions: Security settings in the registry that identify the action to take for that feature in the security zone where the URL resides. URL Action settings include enable, disable, prompt, and others as appropriate.

• URL Action policies: You can add these policies individually by enabling the desired URL Action policy and then selecting the setting for the policy registry key value. They can also be set by zone template.

Internet Explorer looks for a policy in the following order:

• HKEY_LOCAL_MACHINE policy hive

• HKEY_CURRENT_USER policy hive

• HKEY_CURRENT_USER preference hive

• HKEY_LOCAL_MACHINE preference hive

If Internet Explorer finds a policy in the HKEY_LOCAL_MACHINE policy hive, it stops. If it does not find a policy in theHKEY_LOCAL_MACHINE policy hive, it looks in the HKEY_CURRENT_USER policy hive, and so on. The administrator can set a policy for one or more URL Actions in one or more zones and allow the user to manage preferences for URL Actions that do not require policy-level security management.

More Info

For details about using URL Action flags, see "URL Action Flags" on the MSDN Web site at http://go.microsoft.com/fwlink/?LinkId=32776.

Note

For descriptions of the URL policy settings, see "URL Action Flags" on the MSDN Web site at http://go.microsoft.com/fwlink/?LinkId=32777.