Q. How can I open a Web site or HTML Help file outside the Local Machine zone when HHCTRL (HTML Help ActiveX control) is blocked?

If you installed security updates MS05-026 (896358) or MS05-001 (890175), creating an instance of HHCTRL outside the Local Machine zone is blocked by default.

The above security updates introduced the UrlAllowList Value Name, a REG_SZ data type, and the MaxAllowedZone Value Name, a REG_DWORD data type, at HKEY_LOCAL_MACHINESOFTWAREMicrosoftHTMLHelp1.xHHRestrictions, to enable exceptions to the blocking that was introduced to reduce security vulnerabilities in HTML Help.

To use the UrlAllowList Value Name, simply include the fully qualified file names and site URLs, separated by semi-colons (;). If you wanted to allow Web site http://www.JSIINC.com/help and .chm files at \JSI001helpfiles, you would open a CMD.EXE window and type:

REG ADD "HKLMSOFTWAREMicrosoftHTMLHelp1.xHHRestrictions" /V UrlAllowList /T REG_SZ /F /D "\JSI001helpfiles;http://www.JSIINC.com/help/"

If you wanted to allow all the Web sites in the Local intranet zone (and the Local Machine zone), you would set MaxAllowedZone to 1:

REG ADD "HKLMSOFTWAREMicrosoftHTMLHelp1.xHHRestrictions" /V MaxAllowedZone / T REG_DWORD /F /D 1

NOTE: Both UrlAllowList and MaxAllowedZone can be used together.

The MaxAllowedZone Value Name can have the following data values and meanings: