After you install security update 896358 or security update 890175, you may experience one or more of the following symptoms:

•	Certain kinds of Web-based programs may not work correctly. For example, a table of contents in HTML Help may no longer work.
•	Certain HTML Help features may not work when you open a .chm file from a remote location. For example, the Related Topics feature may not work.

Note This article contains information that is supplemental to the following Microsoft Knowledge Base articles:

Back to the top

This problem occurs because security update 896358 and 890175 prevent HTML content that is outside the Local Machine zone from creating an instance of the HTML Help ActiveX control (HHCTRL). This change was introduced to reduce security vulnerabilities in HTML Help.

Back to the top

Warning The symptoms are an expected and intended effect of installing the security updates. This section provides examples for administrators who must re-enable the HTML Help ActiveX control for business-critical programs. The workarounds may make the computer more vulnerable to the threats the security updates address. The safest course is not to use the registry workarounds. If you must use workarounds, set the registry values to be as restrictive as possible.

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:

The first of the following examples is the most restrictive example. The next examples are successively less restrictive.

Back to the top

Example 1: Use the UrlAllowList entry to enable specific URLs

Warning Include only URLs for sites that you trust.

The .reg file in this example re-enables hosting of the HTML Help ActiveX control in the following remote content:

•	Any .chm files that are in the \\productmanuals\helpfiles folder
•	A Web application that located at http://www.wingtiptoys.com/help.

Paste the following text in a text editor such as Notepad. Then, save the file by using the .reg file name extension.

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp] 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
"UrlAllowList"="\\\\productmanuals\\helpfiles;http://www.wingtiptoys.com/help/"

You cannot use wildcard characters in the URL string of any site that is added to the UrlAllowList registry key. For example, you cannot use the following URL string: However, you can use the following URL string: This string lets the following sites host the HTML Help ActiveX control:

•	http://help.wingtiptoys.com/research
•	http://help.wingtiptoys.com/sales

Back to the top

Example 2: Use the MaxAllowedZone entry to enable a security zone

Warning The MaxAllowedZone entry enables all sites in a particular zone. Using the UrlAllowList entry may be safer. If you must use the MaxAllowedZone entry, set the value no higher than is required. If you set the MaxAllowedZone value to 3 or higher, you expose systems to attack from the Internet.

Note By default, the value for the MaxAllowedZone entry is set to zero. The following table summarizes how different entries are interpreted by the value for the MaxAllowedZone entry.

MaxAllowedZone	Local Machine zone	Local intranet zone	Trusted sites zone	Internet zone	Restricted sites zone
0	Allowed	Blocked	Blocked	Blocked	Blocked
1	Allowed	Allowed	Blocked	Blocked	Blocked
2	Allowed	Allowed	Allowed	Blocked	Blocked
3	Allowed	Allowed	Allowed	Allowed	Blocked
4	Allowed	Allowed	Allowed	Allowed	Allowed

Paste the following text in a text editor such as Notepad. Then, save the file by using the .reg file name extension. This .reg file lets all content in the Intranet zone host the HTML Help ActiveX control.

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
"MaxAllowedZone"=dword:00000001

Back to the top

Example 3: Use the UrlAllowList entry and the MaxAllowedZone entry

Warning The MaxAllowedZone entry enables all sites in a particular zone. Using the UrlAllowList entry may be safer. If you must use the MaxAllowedZone entry, set the value no higher than is required. If you set the MaxAllowedZone value to 3 or higher, you expose systems to attack from the Internet.

Paste the following text in a text editor such as Notepad. Then, save the file by using the .reg file name extension. The following .reg file lets all content in the Intranet zone host the HTML Help ActiveX control. This .reg file also lets two Internet sites host the control.

REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp] 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
"MaxAllowedZone"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
"UrlAllowList"="http://www.wingtiptoys.com/;http://www.contoso.com/"

Back to the top

Deploying the registry keys across a domain

We recommend that you use Group Policy to deploy the settings that are mentioned in the examples in this article as startup scripts. You can also deploy these settings as logon scripts. However, this method is less desirable because of permissions constraints.

The following steps are an example of how to deploy the settings in Example 1 as a Group Policy startup script.

1.	Paste the following text into a text editor such as Notepad: REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions] "UrlAllowList"="http://myintranetapplication/help/helpfiles;http://www.wingtiptoys.com/help/helpdocuments"
2.	Save the file as a .reg file. Name the file AllowTrustedSites.reg.
3.	Paste the following text into a text editor such as Notepad: REGEDIT.EXE /S AllowTrustedSites.reg
4.	Save the file as a batch file. Name the file AllowTrustedSites.bat.
5.	Import the batch file into the Group Policy object (GPO). To do this, follow these steps: a. Paste the batch file that you created in step 4 and the .reg file that you created in step 2 to the \\DomainName\SysVol\DomainName\Policies\GUID of the selected GPO\Machine\Scripts\Startup folder. b. On the computer on which you want to run the Group Policy object, click Start, click Run, type dsa.msc, and then click OK. c. Right-click your domain, and then click Properties. d. Click Group Policy, and then click New. e. Type the name that you want to use for this policy, and then press ENTER. f. Click Edit. g. Expand Computer Configuration, expand Windows Settings, and then click Scripts (Startup/Shutdown). h. In the right panel, double-click Startup, and then click Add. i. Locate and then click the batch file that you created in step 4. j. Click Add. k. Click OK, click Yes, and then click OK two times.

Back to the top

If you download an HTML Help .chm file and either open it directly or save it locally and then open it, you may experience one or more of the following symptoms:

•	Certain kinds of Web-based programs may not work correctly. For example, a table of contents in HTML Help may no longer work.
•	Certain HTML Help features may not work when you open a .chm file from a remote location. For example, the Related Topics feature may not work.

For more informationhow to resolve this issue, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Overview and examples for system administrators

For more information about security update 896358 and how you can re-enable Web applications that are affected by this update, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Internet Explorer security zones

For more information about how to use security zones in Internet Explorer, click the following article number to view the article in the Microsoft Knowledge Base:

Back to the top

Group Policy

For more information about Group Policy, visit the following Microsoft Web sites:

•	Group Policy collection http://technet2.microsoft.com/WindowsServer/en/library/6d7cb788-b31d-4d17-9f1e-b5ddaa6deecd1033.mspx?mfr=true (http://technet2.microsoft.com/WindowsServer/en/library/6d7cb788-b31d-4d17-9f1e-b5ddaa6deecd1033.mspx?mfr=true)
•	What is Group Policy Object Editor? http://technet2.microsoft.com/WindowsServer/en/library/47ba1311-6cca-414f-98c9-2d7f99fca8a31033.mspx?mfr=true (http://technet2.microsoft.com/WindowsServer/en/library/47ba1311-6cca-414f-98c9-2d7f99fca8a31033.mspx?mfr=true)
•	Core Group Policy tools and settings http://technet2.microsoft.com/WindowsServer/en/library/e926577a-5619-4912-b5d9-e73d4bdc94911033.mspx?mfr=true (http://technet2.microsoft.com/WindowsServer/en/library/e926577a-5619-4912-b5d9-e73d4bdc94911033.mspx?mfr=true)

Back to the top

Technical support for x64-based versions of Microsoft Windows

On computers that are running x64-based versions of Microsoft Windows, you may have to adapt the instructions in the "Resolution" section about how to modify the registry. For example, you might have to modify a different part of the registry, depending on whether you want to modify the 32-bit or the 64-bit functionality. For more information, click the following article number to view the article in the Microsoft Knowledge Base: If your hardware came with an x64-based version of Microsoft Windows already installed, your hardware manufacturer provides technical support and assistance for the x64-based version. In this case, your hardware manufacturer provides support because an x64-based version was included with your hardware. Your hardware manufacturer might have customized the x64-based version installation by using unique components. Unique components might include specific device drivers or might include optional settings to maximize the performance of the hardware. Microsoft will provide reasonable-effort assistance if you need technical help with an x64-based version. However, you might have to contact your manufacturer directly. Your manufacturer is best qualified to support the software that your manufacturer installed on the hardware. If you purchased an x64-based version such as an x64-based version of Microsoft Windows Server 2003 separately, contact Microsoft for technical support.

For product information about Microsoft Windows XP Professional x64 Edition, visit the following Microsoft Web site: For product information about x64-based versions of Microsoft Windows Server 2003, visit the following Microsoft Web site:

Back to the top