Windows 7 / Getting Started

---

How Protected Mode Improves Security

When Internet Explorer runs in Protected Mode, Mandatory Integrity Control (MIC), a Windows Vista and later operating systems feature, forces Internet Explorer to be a low-integrity process. MIC does not allow low-integrity processes to gain write access to high-integrity-level objects, such as files and registry keys, in a user's profile or system locations. Low-integrity processes can write only to folders, files, and registry keys that have been assigned a low-integrity MIC access control entry (ACE) known as a mandatory label. Table below describes the different integrity levels.

Mandatory Integrity Control Levels

Integrity Access Level	System Privileges
High	Administrative. Processes can install files to the Program Files folder and write to sensitive registry areas, such as HKEY_LOCAL_MACHINE.
Medium	User. Processes can create and modify files in the user's Documents folder and write to user-specific areas of the registry, such as HKEY_CURRENT_USER. Most files and folders on a computer have a medium-integrity level because any object without a mandatory label has an implied default integrity level of Medium.
Low	Untrusted. Processes can write only to low-integrity locations, such as the Temporary Internet Files\Low folder or the HKEY_CURRENT_USER \Software\Microsoft\Internet Explorer\LowRegistry key.

As a result of being a low-integrity process, Internet Explorer and its extensions run in Protected Mode, which can write only to low-integrity locations, such as the new low-integrity temporary Internet files folder, the History folder, the Cookies folder, the Favorites folder, and the Windows temporary file folders. By preventing unauthorized access to sensitive areas of a user's system, Protected Mode limits the amount of damage that a compromised Internet Explorer process can cause. An attacker cannot, for example, silently install a keystroke logger to the user's startup folder.

Furthermore, the Protected Mode process runs with a low desktop integrity level. Because of User Interface Privilege Isolation (UIPI), a compromised process cannot manipulate applications on the desktop through window messages, thus helping to reduce the risk of shatter attacks.

Shatter attacks compromise processes with elevated privileges by using window messages.

If a Web page or add-on does require more privileges than provided by Protected Mode or the compatibility layer, it will prompt the user to grant those privileges using User Account Control (UAC). This can occur, for example, if the user needs to install an add-on that requires elevated rights. Most add-ons can run within Protected Mode, however, and loading them will not prompt the user.

Because Protected Mode also protects extensions, vulnerabilities in extensions, such as buffer overflows, cannot be exploited to access any part of the file system or other operating system object to which Protected Mode does not normally have access. Therefore, the damage that a successful exploit can cause is very limited.

Defense-in-Depth

Protected Mode is not the first line of defense against malware; it's a form of defense-in-depth. Protected Mode offers protection in the event that a malicious Web page successfully bypasses the other security measures of Internet Explorer. In the case of a successful exploit, Protected Mode restricts the processes' privileges to limit the damage that malware can do. In other words, even if your browser gets hacked, Protected Mode might still keep your computer safe.