Admin-Approved Binary Behavior Setting Fails

[Guest]

I'm experimenting with Binary Behaviors and their security settings. For the
Internet Zone (3), I restricted them to 'Administrator-Approved' and entered
a list of 16 default behaviors in the Registry's AllowedBehaviors key,
enabling all. A test of behavior #default#saveFavorite showed that when
enabled (1), it 'persisted' data in the saved page, as expected.

Well, I then disabled #default#saveFavorite (0), and yet it still persisted
data. It continues to do this even if I disable all the #defaults (but
retain the Admin-approved setting). The 'Userdata Persistence' setting does
not influence this (nor, evidently, should it; its Registry setting is not
tested). All the tests that I have done have been on freshly-launched IE
windows with the cache erased. Registry monitoring verifies that the
settings are checked as expected, and the list of behaviors is indeed
enumerated. The test page used is:

http://msdn.microsoft.com/workshop/samples/author/persistence/saveFavorite_1.htm

The test data entered in that page's text box is "SaveFavorite DISABLED w
UserdataPersistence DISABLED". Yet that string is displayed when I bring up
the page from my Favorites menu. If I edit the Shortcut file, I find the
string:

<ROOTSTUB><oPersistText sPersistText="SaveFavorite DISABLED w
UserdataPersistence DISABLED" __NEW_TAG_OUTER="....

in the file, just as if I had enabled persistence.

What am I doing incorrectly?

Note that if I disable Binary Behaviors in IE's Internet Settings, then
saveFavorite does not persist data (at least THAT works).

 

[Guest]

In order to clarify the previous post, I have run more tests, this time using
VML since the saveFavorite test is a bit cumbersome. Binary and Script
Behaviors are set to 'Administrator-Approved'. Registry key:

HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet
Settings\AllowedBehaviors

will have the #default#VML key variable as shown below. The test page is
the 'Multiple Shape Demo' located at:

http://msdn.microsoft.com/library/default.asp?url=/workshop/author/vml/shape/examples/shapedemo1.asp

I can hit the START button on that page and get the following results:

#default#VML = Not in Registry: Page does not run. This is the expected
result.
#default#VML = 1 (enabled): Page runs. This is the expected result.
#default#VML = 0 (disabled): PAGE RUNS ANYWAY.

The value of the DWORD does not matter; only its EXISTENCE is required to
enable a behavior. Is this what is intended by Microsoft?

macroman
XP/SP2; IE6/SP2, fully-patched