Skip to main content

Internet Explorer 9 Blocker Toolkit: Frequently Asked Questions

Get answers to commonly asked questions about the Internet Explorer 9 Blocker Toolkit.

On This Page

Automatic Updates Delivery Process

Q. Which users will receive Internet Explorer 9 as an important update?
A. Users of Windows 7, Windows Server 2008 R2, Windows Vista and Windows Server 2008 will receive Internet Explorer 9 as an important update if they have Automatic Updates enabled, or if they perform a manual scan for updates on Windows Update.

note icon

Note:

  • Internet Explorer 9 will not install automatically – the Automatic Updates delivery process will include a welcome screen that offers users choices of Install, Don’t Install, and Ask Me Later prior to installation.
  • The notification and installation process will not start unless and until a user who is a local administrator logs on to the machine. Users who are not local administrators will not be prompted to install the update and will thus continue using Internet Explorer 7 or 8.
  • Organizations do not need to deploy the Blocker Toolkit in environments managed with an update management solution such as Windows Server Update Services or Systems Management Server 2003. Organizations can use those products to fully manage deployment of updates released through Windows Update and Microsoft Update, including Internet Explorer 9, within their environment.

For more details on how Internet Explorer 9 will be distributed via Automatic Updates and information on other options for blocking deployment within organizations, please review Internet Explorer 9 Delivery through Automatic Updates.

Q. When will the Blocker Toolkit be available?
A. The Blocker Toolkit is available immediately in the Microsoft Download Center. Microsoft encourages IT administrators who want full control over the deployment of updates to their systems to use Windows Server Update Services (WSUS), a free tool for users of Windows Server, or the more advanced configuration management tools System Center Configuration Manager (SCCM) or Systems Management Server 2003 (SMS).

Q. How long will the blocker mechanism work?
A. Once the blocking registry key value is set to its blocked value, automatic delivery of the update will be deactivated permanently as long as the registry key value is not removed or changed.

Q. If I need to disable delivery of Internet Explorer 9, why should I use the toolkit provided by Microsoft? Why should I not just disable Automatic Updates entirely?
A. Microsoft strongly urges customers not to disable Automatic Updates because it provides the ongoing delivery of critical security and reliability updates to all enabled systems, and disabling Automatic Updates can potentially leave these systems more vulnerable. Microsoft encourages IT administrators who want full control over the deployment of updates to their systems to use Windows Server Update Services (WSUS), a free tool for users of Windows Server, or the more advanced configuration management tools System Center Configuration Manager (SCCM) or Systems Management Server 2003 (SMS). Microsoft has specifically created this Blocker Toolkit to safely disable and re-enable delivery of Internet Explorer 9 to systems in organizations that cannot use WSUS, SCCM, SMS, or another update-management solution.

Q. Why not block URL access to Windows Update or Microsoft Update?
A. This is not recommended because it would stop delivery of all critical security and reliability updates to the organization for all supported versions of the Windows desktop and server operating systems, which would leave all systems more vulnerable.

How the Blocker Toolkit Works

Q. What testing should customers do to validate the Internet Explorer 9 Blocker Toolkit Microsoft is making available before using it?
A. Because the Blocker Toolkit being provided by Microsoft relies on a new registry key that is used only for the purpose of disabling and re-enabling delivery of Internet Explorer 9, there should be no additional impact or side effect on the system. No additional testing should be necessary to validate the Toolkit.

Q. What registry key is being used to disable delivery of Internet Explorer 9?
A. HKLM\SOFTWARE\Microsoft\Internet Explorer\Setup\9.0

Q. What is the key value name and what are the value options?
A. The key value name is "DoNotAllowIE90". If the value is '1', automatic delivery of Internet Explorer 9 through Automatic Updates and the Windows Update/Microsoft Update site "Express" install option is disabled. If the value is not '1' or if the key doesn't exist, the system will be offered Internet Explorer 9 by Automatic Updates or if a user performs a manual update scan for important updates via the Windows Update/Microsoft Update sites.

Q. Will the Blocker Toolkit prevent users from installing Internet Explorer 9 manually on their computers?
A. No. The Blocker Toolkit will prevent covered computers from being offered Internet Explorer 9 as an important update automatically through Automatic Updates. Internet Explorer 9 will still appear as an optional update that users can select via Windows Update, and the blocker will not prevent users from downloading Internet Explorer 9 from the Microsoft Download Center or installing it from external media.

Q. Will the Blocker Toolkit prevent users from being automatically upgraded to Internet Explorer 9?
A. Yes. For enterprise customers who are using the Blocker Toolkit to prevent installation of Internet Explorer 9 through Automatic Updates, automatic upgrades from Internet Explorer 7 or Internet Explorer 8 to Internet Explorer 9 will also be blocked.

Q. How does the provided script work?
A. The script accepts one of two command line options (block and unblock) and creates or removes the registry key that controls whether Internet Explorer 9 is offered automatically to the system (via Automatic Updates scans).

Q. What is the ADM template used for?
A. The Administrative Template (.adm file) allows administrators to import the new Group Policy settings to block or unblock automatic delivery of Internet Explorer 9 into their Group Policy environment, and to use Group Policy to centrally execute the action across systems in their environment.

Q. Will the tool be localized?
A. The tool will not be localized. It will only be released in EN, but will work without modification on any language edition of the supported operating systems.

Blocker Toolkit and Other Update Services

Q. Will this Internet Explorer 9 blocking mechanism also block delivery of Internet Explorer 9 through Software Update Services (SUS), Windows Server Update Service (WSUS), or Systems Management Server (SMS)?
A. No, this mechanism only blocks automatic delivery of Internet Explorer 9 in environments that do not use SUS, WSUS, or SMS. Internet Explorer 9 can still be deployed using SUS, WSUS, SMS, and other methods even if the blocking mechanism is activated.

If your organization uses WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your organization. This scenario is discussed in detail in the Knowledge Base article located here.

Q. If I have Windows Server Update Service (WSUS) configured to 'auto-approve' Update Rollup packages (this is not the default configuration), how can I stop Internet Explorer 9 from automatically installing throughout my organization?
A. You will need to take action if:

  • You use WSUS to manage updates in your organization.
  • You have Windows Vista Service Pack 2 (SP2)-based computers, Windows 7-based computers, Windows Server 2008 Service Pack 2 (SP2)-based computers, or Windows Server 2008 R2-based computers that have Internet Explorer 7 or Internet Explorer 8 installed.
  • You do not want to upgrade Internet Explorer 7 or Internet Explorer 8 machines to Windows Internet Explorer 9 at this time.
  • You have configured WSUS to auto-approve Update Rollups for installation.

If these scenarios apply to your organization, see Internet Explorer 9 Delivery through Automatic Updates for more information on how to prevent automatic installation.