Skip to main content
it helpdesk support

Stop Internet Explorer 11 from installing on Windows 7 and Server 2008 R2 and higher

Stop Internet Explorer 11 from installing on Windows 7 and Server 2008 R2 and higher

October 24, 2013

Endurance would always recommend all machines are patched and updated to the fullest as reasonably possible. There is, though, updates that need a little more scrutiny before being installed in your environment, Internet Explorer is one such update. Come October 18th 2013 Windows 8.1 will release and there is a very good assumption that an update will be available then or soon after for Internet Explorer 11. If you aren't controlling your Updates with WSUS or SCCM 2007/2012 (or other means) then there is a very good chance your users will receive this update.

Microsoft has been nice enough throughout the years to distribute a tool to block the automatic update installation of a new version of Internet Explorer and this year is no exception. The toolkit to disable IE11 from automatically updating works on x86 and x64 Windows 7 and above (Windows 8) as well as x64 Server 2008 R2 SP1 and above (Server 2012). You can download this toolkit at the link here:

When you run this on a computer you will notice it's a self-extracting executable and will unzip a CMD file to run the tool manually, an ADM template to import into the Group Policy Management Console, and a help file for more detailed information about each piece. The ADM template into Group Policy is the best method to ensure your computers receive this and once imported can be found as a Group Policy Preference under Computer Configuration / Administrative Templates / Classic Administrative Templates / Windows Components / Windows Update / Automatic Updates Blockers v3. This setting is only available as a Computer setting.

The CMD file has a switch for /B to block and /U to unblock. You can also run this script on remote computers by simply entering IE11_Blocker.cmd Computer1 /B to block IE11 from being updated on Computer1. This script updates the registry at this key HKLM\SOFTWARE\Microsoft\Internet Explorer\Setup\11.0 with the new DWORD DoNotAllow IE11 and a value of 1 to block or 0 to unblock.

Two important things need to be mentioned with this toolkit: 1. This will not prevent users from manually installing Internet Explorer 11, this tool only ensures that environments that don't use WSUS or SCCM 2007/2012 can have a way to ensure computers don't receive the update through Automatic Updates. 2. If you use WSUS or SCCM 2007/2012 and you run this tool you can still deploy Internet Explorer 11, this tool only stops the automatic update feature and does not prevent your update tools from deploying it.

If you have any questions about the Toolkit please leave a comment or browse the following links for additional details. Thanks.

IE11 Disable Automatic Delivery Toolkit :

IE11 Blocker Toolkit FAQ:

We'll take care of every detail.

Even if you don't know exactly what you need, our experts make it easy to talk about your project and work out the requirements. We'll quickly help frame it up and add some structure so it can be properly estimated and ultimately developed and delivered.