Can you comment on the risk involved with enabling the 'Initialize and script activeX controls not marked as safe' only in the local computer zone? We have an externally developed application that relies heavily on HTML forms and whenever we submit information through the application we recieve the warning asking if we want to allow interaction with other parts of the page. Best I can figure out, the HTML form is calling a VBS file to write a file to the C: and send out for processing. The vendor/developer will not assist with resolving the issue. Enabling the previously mentioned policy appears to be the only fix so far. [Aaron Margosis] Scripts and ActiveX controls are blocked by default in the Local Computer zone until the user clicks through the 'allow blocked content' prompt. This is part of Local Machine Zone Lockdown (LMZL) which I described briefly (other references linked from that page too).