I have an ActiveX control and it starts a process. Normally, the process should be started in medium IL, but sometimes it's in low IL as IE itself, especially with enterprise domain users. Does anyone here has such experience? Thanks in advance. -Sambigblueapple

Hi Sam , what the IL stands for? Did you mean IE Security Level? Please give me more information about it. Regards, Leo HuangPlease remember to click Mark as Answer on the post that helps you, and to click Unmark as Answer if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread.

Hello Leo, IL stands for integrity level. By default, IE launches a 3rd party application in medium integrity level. Somehow, on some systems, they are started in low integrity level. I wonder which setting could cause this. Thanks, -Sambigblueapple

Integrity levels are defined by the Protected Mode settings, which are themselves defined in Group Policy settings & registry values. Those are the locations I would check on both systems to see why one is launching the application in a different integrity level than the other system. One could have protected mode disabled for instance. Additionally Protected mode is turned on by default in the Internet, Intranet, and Restricted sites zones and an icon appears on the status bar to let you know that it's running. Thus, the zone security settings in the location the 3rd part application is launched from matters, and this is also something that should be checked. http://msdn.microsoft.com/en-us/library/bb250462%28VS.85%29.aspx#upm_cfgpm http://technet.microsoft.com/en-us/library/dd638378%28WS.10%29.aspx

I have defined ElevationPolicy for the application as medium in the registry, but still got process in low level integrity. Thanks, -Sambigblueapple

Earlier you mentioned: "the process should be started in medium IL, but sometimes it's in low IL as IE itself, especially with enterprise domain users." With Domain Group Policies overiding all Local Policies, have you verified at the domain level that you don't have domain policies resulting in this difference?

I suspect so too. I check the keys under Low Rights and it's OK, so I don't know what else policies could affect integrity level. -Sam bigblueapple