windows 以编程方式更改 Internet Explorer 设置？

Change Internet Explorer settings programmatically?

提问by kakopappa

Any idea how do I do the following using C#?

知道如何使用 C# 执行以下操作吗？

1. Going to Tools -> Internet Options -> Security
2. Select the Securitytab
3. Click the Custom Levelbutton
4. In the Miscellaneoussection change Display mixed contentto Enable

1. 即将 Tools -> Internet Options -> Security
2. 选择Security选项卡
3. 点击Custom Level按钮
4. 在该Miscellaneous部分更改Display mixed content为Enable

回答by EricLaw

The "cheat" way to do this is to change the value

这样做的“作弊”方法是更改​​值

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1609 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1609 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1609 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1609 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1609

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\0\1609 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\1609 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones \2\1609 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1609 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\1609

Where 0-4 are Zone identifiers and the value is 0 to Allow, 1 to Prompt, and 3 to Block. Keep in mind that if your code does this on anyone's machine but your own, you're likely to find your code blocked as malware.

其中 0-4 是区域标识符，值为 0 表示允许，1 表示提示，3 表示阻止。请记住，如果您的代码在除您自己之外的任何人的机器上执行此操作，您可能会发现您的代码被阻止为恶意软件。

The "proper" way to do this is to use the APIs to create an IInternetZoneManager and call SetZoneActionPolicyto adjust the settings for URLACTION_HTML_MIXED_CONTENT in the zones you want to adjust.

执行此操作的“正确”方法是使用 API 创建 IInternetZoneManager 并调用SetZoneActionPolicy来调整要调整的区域中 URLACTION_HTML_MIXED_CONTENT 的设置。

回答by Cody Gray

You aren't supposed to do this "programmatically". That's why there isn't an API for it. Only the user can change their security settings, and they do it using the built-in interface that you've already discovered.

您不应该“以编程方式”执行此操作。这就是为什么没有它的 API 的原因。只有用户可以更改他们的安全设置，并且他们使用您已经发现的内置界面来完成。

The poor IE team has been working overtime trying to tighten up the security of their browser. They're not going to throw in something like this that would nullify all of their efforts in a matter of seconds.
Recall that even once this option is selected, there's a confirmation dialog presented. How do you propose to "click" that programmatically? (Hmm, on second thought, don't tell me. That's probably the next question you'll be asking.)

可怜的 IE 团队一直在加班加点试图加强他们浏览器的安全性。他们不会投入这种会在几秒钟内使他们的所有努力无效的东西。
回想一下，即使选择了此选项，也会出现一个确认对话框。你如何建议以编程方式“点击”？（嗯，再想一想，不要告诉我。这可能是你要问的下一个问题。）

Give up on trying to do this programmatically, and ask the user to do it themselves. Provide a complete help file or other documentation that explains why you're requesting that they make this change, what features will be unavailable if they do not choose to make this change, and what the possible security risks of making such a change are. And, of course, specific instructions on how the change is made.

放弃尝试以编程方式执行此操作，并要求用户自己执行此操作。提供完整的帮助文件或其他文档，说明您要求他们进行此更改的原因、如果他们不选择进行此更改将无法使用哪些功能，以及进行此类更改可能存在的安全风险是什么。当然，还有关于如何进行更改的具体说明。

Or, better yet, redesign your app so that it doesn't require a system-widemodification of IE's security settings. It's hard to imagine a legitimate case for this. A better solution might be asking the user to add your site to their "trusted sites". Remember that local pages have different security settings than remote pages by default.

或者，更好的是，重新设计您的应用程序，使其不需要在系统范围内修改 IE 的安全设置。很难想象这是一个合法的案例。更好的解决方案可能是要求用户将您的站点添加到他们的“受信任站点”。请记住，默认情况下，本地页面与远程页面具有不同的安全设置。

回答by jhnlmn

Also do not forget Group Policies. Most (if not all) IE settings may also be specified in Group Policies. According to Local group policy setting for IE security page vs Internet options security pagethe Group Policy settings override user-defined settings. So, on my home PC (works without domain controller) I have a choice to define IE settings either via Local Group Policy Editor or via Internet Options. For example, if I run gpedit.msc to open Local Group Policy Editor, select Computer Configuration\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone change "Display mixed content" setting to "Enabled", then select "Enable" in drop down box, click Apply, then open Security Settings for Internet Zone in IE - I will see that "Display mixed content" changed to Enable and the selection is disabled because it is overriden by Policy. For the entire list of supported policies download WindowsServer2012andWindows8GroupPolicySettings.xlsx from http://www.microsoft.com/en-us/download/details.aspx?id=25250

也不要忘记组策略。大多数（如果不是全部）IE 设置也可以在组策略中指定。根据IE 安全页面与 Internet 选项安全页面的本地组策略设置组策略设置覆盖用户定义的设置。因此，在我的家用 PC（无需域控制器即可工作）上，我可以选择通过本地组策略编辑器或 Internet 选项来定义 IE 设置。例如，如果我运行 gpedit.msc 打开本地组策略编辑器，选择计算机配置\Windows 组件\Internet Explorer\Internet 控制面板\安全页面\Internet 区域将“显示混合内容”设置更改为“已启用”，然后选择“在下拉框中启用”，单击应用，然后在 IE 中打开 Internet 区域的安全设置 - 我将看到“显示混合内容”更改为启用，并且该选择被禁用，因为它被策略覆盖。有关受支持策略的完整列表，请从以下位置下载 WindowsServer2012 和 Windows8GroupPolicySettings.xlsx http://www.microsoft.com/en-us/download/details.aspx?id=25250

Now back to the question how to change settings programmatically. EricLaw correctly suggested using SetZoneActionPolicy from IInternetZoneManager. But it is hard to find samples for calling it from C#. I ended up copying http://www.pinvoke.net/default.aspx/Interfaces.IInternetZoneManagerinto my code and then doing:

现在回到如何以编程方式更改设置的问题。EricLaw 正确地建议使用 IInternetZoneManager 中的 SetZoneActionPolicy。但是很难找到从 C# 调用它的示例。我最终将http://www.pinvoke.net/default.aspx/Interfaces.IInternetZoneManager复制 到我的代码中，然后执行以下操作：

//This will disable "Download signed ActiveX" (IE setting # 0x1001) for Internet Zone (zone #3)
IInternetZoneManager izm = Activator.CreateInstance(Type.GetTypeFromCLSID(new Guid("7b8a2d95-0ac9-11d1-896c-00c04Fb6bfc4"))) as IInternetZoneManager;
IntPtr pPolicy = Marshal.AllocHGlobal(4);
Marshal.Copy(new int[] { 3 }, 0, pPolicy, 1);//3 means "Disable"
int result = izm.SetZoneActionPolicy((uint)UrlZone.Internet, (uint)0x1001, pPolicy, 4, (uint)UrlZoneReg.CurrentUserKey);
Marshal.ReleaseComObject(izm);
Marshal.FreeHGlobal(pPolicy);

I also tried changing group policy programmatically. I used library from https://bitbucket.org/MartinEden/local-policyand then:

我还尝试以编程方式更改组策略。我使用了https://bitbucket.org/MartinEden/local-policy 中的库 ，然后：

//This will disable "Download signed ActiveX controls" computer policy for Internet Zone (zone #3)
const string keyPath = @"SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones";
var gpo = new LocalPolicy.ComputerGroupPolicyObject();
using (var machine = gpo.GetRootRegistryKey(LocalPolicy.GroupPolicySection.Machine))
{
    using (var terminalServicesKey = machine.CreateSubKey(keyPath))
    {
        terminalServicesKey.SetValue("1001", 3, Microsoft.Win32.RegistryValueKind.DWord);
    }
}
gpo.Save();

After successfully testing the code above on Win7 SP1 with IE 11 I decided to go back to the original suggestion from EricLaw: modify HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\*\1001 directly because this is what Microsoft is recommending. See, for example How to strengthen the security settings for the Local Machine zone in Internet Exploreror Enhanced Browsing Security

在使用 IE 11 在 Win7 SP1 上成功测试上面的代码后，我决定回到 EricLaw 的原始建议：直接修改 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\*\1001 因为这就是 Microsoft推荐。例如，请参阅如何在 Internet Explorer或增强的浏览安全性中加强本地计算机区域的安全设置

回答by Ankur

I am not sure but I think you can find all these settings in "registry". You need to find out the appropriate key. And to change those values you need to have proper rights. Registry can be accessed from .net code

我不确定，但我认为您可以在“注册表”中找到所有这些设置。您需要找出合适的密钥。要更改这些值，您需要拥有适当的权利。注册表可以从 .net 代码访问