IE 7 Protected Mode Oddities

November 18, 2006 @ 2:42 am- from Maui, Hawaii

Hmmm… so I’m trying to be a good citizen and at least giving more locked down security settings a run in Vista and especially in Internat Explorer 7. However, I’m not quite sure I get the way protected mode is supposed to work in IE 7.

IE 7 has something called protected mode which is supposed to a be low rights process that hosts the IE browser. From there in theory at least it should be very difficult to hack into the system running IE. Ok, fine.

But check out this screen shot:

According to the security settings I have protected mode on, but according to the toolbar it’s off. Well which is it? <s>

I suspect the toolbar is correct, but I don’t really see how I can really test and know what mode I’m dealing with.

As always I’ve gone through the myriad of IE security settings and have enabled some of the default disabled settings like support for (prompted) cross domain access, and removing prompts for a few options like cut and paste etc…

Anybody have any idea what’s going on here? Similar issues on XP with IE 7?

Posted in Vista

Feedback for this Weblog Entry

re: IE 7 Protected Mode Oddities
by Rik Hemsley November 18, 2006 @ 4:20 am

There doesn't seem to be a 'protected mode' in IE7 on XP. Either that or I just can't see it.

re: IE 7 Protected Mode Oddities
by Bob Archer November 18, 2006 @ 5:49 am

Rik, you are correct, protected mode IE7 is a Vista only feature.

BOb

re: IE 7 Protected Mode Oddities
by Michael Flanakin November 19, 2006 @ 7:55 am

I don't have my XP machine in front of me right now, but I'm almost positive all versions of IE7 support the protected mode. Check your trusted sites. From what I remember, this is the main differentiator.

re: IE 7 Protected Mode Oddities
by Aaron November 19, 2006 @ 1:48 pm

I just ran into this wonderful setting at work. Its a new feature just in VISTA. It was enabled by default in RC2 I'll check int Monday when we install then RTM. Only trusted sites have it off which may be why your status bar indicated it was disabled. Oh the joy of making ActiveX work on Vista!!

re: IE 7 Protected Mode Oddities
by Rick Strahl November 21, 2006 @ 12:22 am

Aaron, in my case it's showing protected mode off on all sites. I can't get it to run Protected Mode on anything even though the flag is set...

re: IE 7 Protected Mode Oddities
by Uzi November 23, 2006 @ 12:29 pm

Make sure you have "UAC" enabled or this feature won't work.

re: IE 7 Protected Mode Oddities
by Rick Strahl November 23, 2006 @ 12:43 pm

He he... that would explain it.

Sorry, no can do...

re: IE 7 Protected Mode Oddities
by Pete December 01, 2006 @ 6:44 pm

Yah, I can confirm that it always says Off despite the IE7 option setting when UAC is off... which is the STUPIDIST thing in the world, since UAC is so bloody annoying prompting you to confirm even when you run the simplest of Windows tools (like just opening the Control Panel!) You would think that you could turn UAC on/off on a per user account basis -- so that the Admin account wouldn't get the prompts but a user acct would - but no...

Seems like Msft has "solved" the security issue by delegating every single security decision to the user - the majority of which won't know the difference between a real security threat and a non-event, and so will either be too scared to let anything happen or simply click 'Yes' to everything while getting annoyed by the constant nagging.

Anybody else think the whole UAC thing is as brain dead as me?

re: IE 7 Protected Mode Oddities
by Robert December 10, 2006 @ 8:50 am

By default Protect Mode on Vista (no XP) is off for the following cases,

1. High IE. (Launched by some setup apps or right click run as admin or launched by some other high app or by built-in admin.)
2. Local zone.
3. Trusted zone.
4. LUA is off.

re: IE 7 Protected Mode Oddities
by MarcJ March 29, 2007 @ 7:42 am

I'm sure this is old news but in case anyone else finds this using a search like I did, Protected Mode is always OFF when you are using the built-in Administrator account.

re: IE 7 Protected Mode Oddities
by Rick Strahl March 29, 2007 @ 12:52 pm

Marc, it appears Protected Mode is always off when you run as a 'real' Admin account. So pretty much with UAC off, Protected Mode doesn't work at all...

re: IE 7 Protected Mode Oddities
by rick December 10, 2007 @ 3:10 am

My god...that UAC is the most ANNOYING function on this entire earth. sheeesh.
ok..just wanted to get that off my chest. oh..and thanks for all the info here. Now I know the deal with my protection mode always being off. ciao

re: IE 7 Protected Mode Oddities
by John January 04, 2008 @ 7:47 pm

Looking for the same answers and found them at http://www.mydigitallife.info/2007/05/26/ways-to-turn-off-and-disable-vista-ie-7-protected-mode/

Lots of good info if you can ignore the annoying, flashing, ad beside the info.

re: IE 7 Protected Mode Oddities
by Jamie Keeling January 17, 2008 @ 9:36 am

I had the same trouble, im running Vista Premium on both of my machines (Desktop and laptop) and the Desktop computer has UAC turned on (Otherwise Windows Live OneCare moans at me) and it's turned off on my laptop (Also running OneCare, yet it doesnt seem to mind, strange.)

After enabling UAC on my laptop and rebooting, lo and behold Internet Protected Mode switch to On.