Policy

Admin-approved behaviors

Microsoft Windows

Back to Binary Behavior Security RestrictionBack to main
Admin-approved behaviors
Jump to overview

Policy overview

Key metadata and intent for this policy.

Category
Windows Components > Internet Explorer > Security Features > Binary Behavior Security Restriction
Supported on
At least Internet Explorer 6.0 in Windows XP with Service Pack 2 or Windows Server 2003 with Service Pack 1

Supported OS tags: Windows10, Windows10RT, Windows11, Windows7, Windows8, Windows81, WindowsRT, WindowsRT81, WindowsServer2003, WindowsServer2008, WindowsServer2012, WindowsServer2012R2, WindowsServer2016, WindowsVista, WindowsXP

For each zone, the Binary and Scripted Behavior security restrictions may be configured to allow only a list of admin-approved behaviors. This list may be configured here, and applies to all processes which have opted in to the behavior, and to all zones. (Behaviors are components that encapsulate specific functionality or behavior on a page.) If you enable this policy setting, this sets the list of behaviors permitted in each zone for which Script and Binary Behaviors is set to 'admin-approved'. Behaviors must be entered in #package#behavior notation, e.g., #default#vml. If you disable this policy setting, no behaviors will be allowed in zones set to 'admin-approved', just as if those zones were set to 'disable'. If you do not configure this policy setting, only VML will be allowed in zones set to 'admin-approved'. Note. If this policy is set in both Computer Configuration and User Configuration, both lists of behaviors will be allowed as appropriate.

Internal name
IESF_Policy_BinaryBehaviorAdminAllow
Policy ID
3e458370e5fc
Elements
1

Registry values

How enabled and disabled states update the registry.

ScopeRegistry locationTypeEnabled valueDisabled valueCopy
Path
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Value name
ListBox_Support_AllowedBehaviors
REG_DWORD
HKLM
1
HKCU
1
HKLM
0
HKCU
0
Registry location
Type REG_DWORD · Both
Path
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
Value name
ListBox_Support_AllowedBehaviors
Hive
HKLM
Enabled value
1
Disabled value
0
Hive
HKCU
Enabled value
1
Disabled value
0

Policy elements

Inputs and configuration options exposed by this policy.

ScopeElementTypeRegistry mappingConstraints & behaviorCopy
Enter the allowed behaviors here.
ID IESF_BinaryBehaviorAdminAllow
list
Path
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedBehaviors
Value name
ListBox_Support_AllowedBehaviors
Type
REG_MULTI_SZ
List: additive
Enter the allowed behaviors here.
Both · Type list
Registry mapping
Path
Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\AllowedBehaviors
Value name
ListBox_Support_AllowedBehaviors
Type
REG_MULTI_SZ
Details
List: additive