Disable IE7 Protected Mode on Windows Server 2008
These steps will remove IE Hardening (IE Protected Mode) for members of the Administrators and Users group. Only disable IE Protected Mode after serious consideration of the consequences – especially on a Server.
All these steps require Administrator privilege.
1. Set the following registry values:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}]
“IsInstalled”=dword:0000000
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}]
“IsInstalled”=dword:0000000
2. Run the following command lines: (from an elevated command line window.)
Rundll32 iesetup.dll, IEHardenLMSettings
Rundll32 iesetup.dll, IEHardenUser
Rundll32 iesetup.dll, IEHardenAdmin
3. Delete these registry keys: (must be done after the commands in step 2)
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}]
[-HKEY_CURRENT_USER\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}]
Note the minus at the start of the key path is the format for a .reg file to delete a key.
Completing these steps will modify the default home page and add a registry value to show a warning page on first run.
Optional: Disable the warning page on first run.
Delete the following registry value:
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
“First Home Page”=- Re-enable IE7 protected mode by reversing the process in steps 1 and 3, step 2 remains unchanged.
Posts
Email
me
May 13th, 2008 at 3:28 pm
Why these unecessary edits to the registry to disable protected mode?
Just turn off the IE Enhanced Security Configuration (ESC) in Server Manager and then uncheck the Enable Protected Mode box in IE7.
There is no need to edit registry values to do this.
July 24th, 2008 at 12:26 pm
Paul is right.
1. Server Manager
2. Security Information section, right hand side
3. Configure IE ESC
August 6th, 2008 at 1:23 am
Thx, Server Manager is the manual way, but you need these regkey for automating.
breat stuff
September 25th, 2008 at 6:19 pm
Thanks been looking for a command line method of acheiveing this for our scripted Windows 2008 builds…this used to be scriptable in Windows 2003 witt sysocmgr.exe and an unattend file…not sure what Microsoft did in Windows 2008!
October 23rd, 2008 at 6:07 pm
Hi-
I’m having trouble with Step 1.
C:\Users\Administrator>REG ADD HKLM\SOFTWARE\Microsoft\Active Setup\Installed Co
mponents\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073} /v IsInstalled /t REG_DWORD /d 0
000000
ERROR: Invalid syntax.
Type “REG ADD /?” for usage.
C:\Users\Administrator>
I get the same message even if I query if I go deeper than Active Setup in the tree.
What am I doing wrong?
Thanks,
John
October 30th, 2008 at 9:04 am
I guess from the command line if you wanted to script this it’s usefull but, doing this from the GUI is simple in Server Manager:
http://www.groovypost.com/howto/microsoft/ie/disable-ie-enhanced-security-configuration-in-windows-server-2008/#comment-2297
Or did I miss something?
December 18th, 2008 at 11:13 am
Awesome! Thanks very much for the great information, did exactly what I needed. TIP: when using REG ADD and REG DELETE put the registry location in “” (double quotes).
May 24th, 2009 at 5:29 pm
Thanks, I needed this cause the Option in serrver depsite being Off already was set to ON by an internet explorer 8 install
I set it too on and set it back off didnt work
Reg hacking I go
July 13th, 2009 at 3:47 pm
The problem is, when you turn it off using server manager, it isn’t turned off. My users are still prompted with popups saying that their busineses web access was blocked by IE ESC, though the server admin interface states that it is turned off. This must be a bug.
July 14th, 2009 at 10:32 am
Even after running all of these registry edits manually and rebooting, IE ESC is still enabled for local users. I ran it as Administrator and it disabled IE ESC for that Administrator. Logged in as the user, it is still enabled. Made the local user an administator, still enabled. Will try to reinstall IE.
September 3rd, 2009 at 8:31 pm
did you manage to fix the issue by reinstalling ie8? were experiencing the same issue!
September 11th, 2009 at 7:47 am
I’ve learned from my experience that if a tweak doesn’t work in one version of an application upgrading that application rarely fixes it. However, upgrading to IE8 wouldn’t hurt, and it might fix it although I wouldn’t count on itt
November 4th, 2009 at 4:51 pm
Used Windows GUI (didn’t work), used registry changes, didn’t work anyone have other ideas?? Oh, tried a Group Policy still doesn’t take.
March 25th, 2010 at 2:42 am
The author is doing it all wrong, which is why people are not having great success with it. First of all, there is no need to “rundll” settings for iesetup.dll, as it is totally unnecessary. Oh, and the reason why people want to use the Registry for this is so they automate configuration settings for efficiency and accuracy. Secondly, there are keys that he has correct in changing, but he is missing entries that need to be completely removed in order for it to work. In my function below, I turn off IE ESC ONLY for Administrators (since only Admins would use the web browser from a Win2K8 server, in my environment). IF you want to turn it off for “Users” as well, then you need to set the “IsInstalled” value to “0″ as well.
Administrators: “{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}”
Users: “{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}”
Function TurnOffIE_ESC_ForAdmins
const HKEY_CURRENT_USER = &H80000001
const HKEY_LOCAL_MACHINE = &H80000002
strComputer = “.”
Set SysReg = GetObject(“winmgmts:{impersonationLevel=impersonate}!\\” & _
strComputer & “\root\default:StdRegProv”)
strKeyPath = “Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap”
strValueName = “AutoDetect”
SysReg.DeleteValue HKEY_CURRENT_USER,strKeyPath,strValueName
strValueName = “IEHarden”
SysReg.DeleteValue HKEY_CURRENT_USER,strKeyPath,strValueName
strValueName = “UNCAsIntranet”
SysReg.DeleteValue HKEY_CURRENT_USER,strKeyPath,strValueName
strKeyPath = “Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap”
strValueName = “AutoDetect”
SysReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName
strValueName = “IEHarden”
SysReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName
strValueName = “UNCAsIntranet”
SysReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName
strKeyPath = “SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap”
strValueName = “AutoDetect”
SysReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName
strValueName = “IEHarden”
SysReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName
strValueName = “UNCAsIntranet”
SysReg.DeleteValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName
strKeyPath = “SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}”
strValueName = “IsInstalled”
dwValue = 0
SysReg.SetDWORDValue HKEY_LOCAL_MACHINE,strKeyPath,strValueName,dwValue
End Function
April 11th, 2010 at 9:06 pm
Thakns PAul E – although would you mind explaining what to do with the above? Is is a script? Copy and past to a txt file wiht a reg extension of .vb?
April 11th, 2010 at 10:49 pm
[...] found an unattended method and created a batch file: :: Backup registry keys REG EXPORT [...]
July 11th, 2011 at 11:55 am
KISS.
The whole thing about registry changes is OVERKILL.
I quote Paul J above:
“Just turn off the IE Enhanced Security Configuration (ESC) in Server Manager and then uncheck the Enable Protected Mode box in IE7.”
It woreks.
July 26th, 2011 at 7:26 am
While there is the agreements of keeping things simple, just because you don’t understand what he is setting in the registry doesn’t mean it isn’t simple.
The point to scripting is that it allows for automation AND THE SAME SETIING APPLIED EVERY TIME. Anytime you perform a step manually, there is a chance for it to be missed or misapplied. Maybe you get a call during your server build, maybe even have outage that pulls you away. We have all been there and coming back and picking up where you left off can be troublesome. I go into organizations all the time that do manual build steps and their systems are nowhere near being uniform.
Manual is fine when you only have minimal systems to manage, but that effort is not scalable or supportable. Thanks for the people looking at assisting others to make things uniform.
As for the admin having issues running REG, don’t forget that if you are using a console tool, that any data value that contains spaces should have quotes around it. I suspect that is why your reg add isn’t working.