Internet Features

For the release of Windows XP SP2 and Windows Server 2003 SP1, Microsoft seems to have got very conscious of a need to be seen to do more about security for web browsing. The URLMON.DLL in these service-pack releases introduces a scheme of named security features. Each is a defence of some sort, such that the cautious configuration is to enable the feature. Features may be configured differently for different processes. Provision also exists by which a feature that is enabled in general for some process is disabled for the process’s work with a trusted URL.

These features are made programmatically accessible through functions exported from URLMON, the archetypes being CoInternetIsFeatureEnabled and CoInternetSetFeatureEnabled. They are all documented, and some even have user-interface support.

The following are the features that are supported as of version 7.00 (for Windows Vista).

Registry Settings

The initial state for each feature is loaded from the registry. As with several other collections of registry settings for Internet Explorer, the feature controls may appear in any of several branches. In order of decreasing precedence, these are:

• HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
• HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Main\FeatureControl
• HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\FeatureControl
• HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main\FeatureControl

except that the branches in HKEY_CURRENT_USER are ignored if the following evaluates to 1:

The merit of allowing each setting at the same place with respect to multiple branches is the usual one of establishing policies versus preferences, machine-wide or per user.

Each feature is its own subkey of the FeatureControl key. The (case-insensitive) values in the feature’s key each name a process. A special value * catches processes that aren’t named explicitly. A feature is evaluated for a process by iterating through the applicable branches in order of decreasing precedence and accepting the first value that applies to that process. It does not matter which branch the value comes from. Each feature has a default for when no applicable value is found in any branch.

Among the filename values for any feature control, iexplore.exe stands also for any process whose filename is “ieuser.exe”, with the side-effect that values named ieuser.exe are ignored.

Note, by the way, that the pattern of these registry settings is not exclusive to the features that are exposed through exported URLMON functions. There are very many internal features. For a list, see Feature Control in Internet Explorer.

Defaults

Each feature has two types of default.

The Internet Explorer default applies when the feature is requested for a process named EXPLORER.EXE, IEUSER.EXE or IEXPLORE.EXE. The Internet Explorer default has all features enabled except:

• FEATURE_PROTOCOL_LOCKDOWN;
• FEATURE_DISABLE_NAVIGATION_SOUNDS.

For other processes, all features are disabled by default except:

• FEATURE_OBJECT_CACHING;
• FEATURE_BEHAVIORS;
• FEATURE_DISABLE_MK_PROTOCOL;
• FEATURE_GET_URL_DOM_FILEPATH_UNENCODED;
• FEATURE_DISABLE_LEGACY_COMPRESSION;
• FEATURE_XMLHTTP.

User-Interface Support

Some of the features have user-interface support as administrative policies through the Windows Vista version of the Group Policy Object Editor. The following table lists the folders among the Security Features in the Internet Explorer administrative template (displayed under Windows Components), and shows the feature that corresponds to each. Note that this support isn’t complete even for the original features and doesn’t extend to any of the features added for Windows Vista.

One feature is known to have user-interface support through Internet Properties in the Control Panel, in the Security group on the Advanced tab. The support is specific to “iexplore.exe” as the process. Checking “Allow active content to run in files on My Computer” disables FEATURE_LOCALMACHINE_LOCKDOWN.