Network Protocol Lockdown

Sometimes you might want to apply different security settings to specific protocols within a zone. For example, you might want to configure Internet Explorer to lock down HTML content hosted on the Shell: protocol if it is in the Internet zone. Because the Shell: protocol's most common use is for local content and not Internet content, this mitigation can reduce the attack surface of the browser against possible vulnerabilities in protocols less commonly used than HTTP.

By default, Network Protocol Lockdown is not enabled, and this setting is sufficient for most environments. If you choose to create a highly restrictive desktop environment, you might want to use Network Protocol Lockdown to mitigate security risks. Configuring Network Protocol Lockdown is a two-phase process, as follows:

• Configure the protocols that will be locked down for each zone Enable the Group Policy setting for the appropriate zone and specify the protocols that you want to lock down. The Group Policy settings are located in both User Configuration and Computer Configuration under Administrative Templates\Windows Components \Internet Explorer\Security Features\Network Protocol Lockdown\Restricted Protocols Per Security Zone.
• Configure the security settings for the locked-down zones Enable the Group Policy setting for the zone and specify a restrictive template or configure individual security settings. The Group Policy settings are located in both User Configuration and Computer Configuration under Administrative Templates\Windows Components \Internet Explorer\Security Page\.