IE Security and Compatibility Zones in Regedit

This article outlines the exact Windows Registry locations used to configure Internet Explorer and legacy browser security zones, domain mappings, and compatibility view settings. Administrators and users can configure these keys under either the current user hive or the local machine hive to control trust levels, site assignments, and legacy rendering behaviors across the operating system.

1. Security Zone Settings and Policies

Internet Explorer categorizes URLs into five distinct security zones (numbered 0 through 4). The permissions, flags, and security rules for each zone are stored in the following registry paths:

• Current User (HKCU): HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones
• Local Machine (HKLM): HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones

Zone Identification Numbers:

• 0: My Computer (Local Machine Zone)
• 1: Local Intranet Zone
• 2: Trusted Sites Zone
• 3: Internet Zone
• 4: Restricted Sites Zone

Each numbered folder contains specific DWORD values that define what active content, scripts, authentication methods, and downloads are permitted within that zone.

2. Site-to-Zone Mappings (Domain Assignments)

To map specific websites and IP ranges to designated security zones, Windows uses the ZoneMap key.

Domain-Based Mappings

• User-Level: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
• System-Level: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains

Under the Domains key, subkeys represent domain names (e.g., example.com). Inside each domain key, protocol values (such as http, https, or * for all protocols) are set to a DWORD value corresponding to the zone number (e.g., 2 for Trusted Sites).

IP Range Mappings

• User-Level: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges
• System-Level: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Ranges

Specific IP ranges are configured by creating subkeys (e.g., Range1) containing a :Range string value for the subnet/IP and protocol DWORD values mapping to the zone ID.

3. Compatibility View and Legacy Browser Emulation

Settings that control document mode emulation, Compatibility View, and Enterprise Mode for legacy applications are stored in dedicated emulation registry paths.

User Compatibility View Settings

• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\BrowserEmulation\ClearableListData (Contains binary data managing user-added Compatibility View sites.)

Group Policy Compatibility View and Enterprise Mode

When configured via Group Policy, compatibility lists and document mode overrides reside under the policy keys:

• Enterprise Mode Site List (HKLM/HKCU): HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode Value: SiteList (String or Expandable String pointing to the XML site list file/URL)

• Policy-Enforced Compatibility View List: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation\PolicyList HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\BrowserEmulation\PolicyList

• Application Emulation Modes (Feature Control): HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION (Controls document modes for third-party applications hosting legacy WebBrowser controls.)

4. Machine-Wide Zone Lockout Policy

To force the system to ignore per-user zone settings and rely exclusively on machine-wide configurations, the following policy key is used:

• Path: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
• Value Name: Security_HKLM_only
• Type: REG_DWORD
• Data: 1 (Enables machine-wide settings only)