In addition to the Security Zone settings, applications that run in the Internet Zone should have an Integrity Level of "Low". This provides an additional level of hardening. For example, applications with Low integrity level cannot write to folder locations unless the folder locations also have the Low integrity level.
Low integrity level IE windows have write access only to the Temporary Internet Files\Low folder, History, Cookies, Favorites, and the HKEY_CURRENT_USER\Software\LowRegistry key. This prevents IE from writing anywhere else in the file system or registry - so no more silent installs of keystroke loggers into your Startup folder. And because the desktop runs at medium integrity, they can’t send messages to it - thwarting shatter-style attacks.
Process integrity levels may be viewed with Process Explorer.
Folder integrity levels can be viewed with ICACLS.exe. Integrity levels can also be specified on application binaries, although that may only be appropriate for kiosk scenarios.
Mandatory integrity control