Internet Explorer on Server 2022¶
Windows 11 no longer has Internet Explorer as a browser. Server 2022 still does, and a server is the last place anyone should be browsing from. Two settings matter.
Enhanced Security Configuration¶
IE ESC puts every website in the Restricted zone by default: no scripts, no downloads, no ActiveX. It makes IE nearly unusable, which is the point on a server.
Server Manager → Local Server → find IE Enhanced Security Configuration in the properties panel → click the link → set On for both Administrators and Users.
Verify:
reg query "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" /v IsInstalled
reg query "HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}" /v IsInstalled
Both 1 (the first is Administrators, the second Users). The ZoneMap key HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IEHarden also reads 1.
SmartScreen¶
gpedit.msc → Computer Configuration → Administrative Templates → Windows Components → Internet Explorer → Prevent managing SmartScreen Filter: Enabled, On. This turns the filter on and stops users turning it off.
Registry: HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer\PhishingFilter\EnabledV9 = 1.
On Windows 11¶
If C:\Program Files\Internet Explorer\iexplore.exe exists and runs on a Windows 11 image, remove the feature:
Disable-WindowsOptionalFeature -Online -FeatureName Internet-Explorer-Optional-amd64 -NoRestart
Or optionalfeatures → untick Internet Explorer 11.
Try it¶
- Check whether IE is installed as a feature and remove it if the README doesn't need it.
- Set the IE zone values and find them in Internet Options.
Build it¶
Add the IE removal and the zone reg add lines to your browsers script with a comment on when to skip them.