Skip to main content

Internet Explorer 8 Blocker Toolkit: Frequently Asked Questions

Get answers to frequently asked questions about the Internet Explorer 9 Blocker Toolkit.

Q. Which users will receive Internet Explorer 8 as a high-priority update?
A. Users of Windows XP SP2 and Windows Server 2003 SP2 will be offered Internet Explorer 8 as a high-priority update if they have Automatic Updates enabled or if they perform a manual scan for updates using the "Express" install option on the Windows Update or Microsoft Update sites. Internet Explorer 8 will also be offered as a recommended update to any user who performs a manual update scan on the Windows Update and Microsoft Update sites using the "Custom" install option.

note iconNote:
Organizations do not need to deploy the Blocker Toolkit in environments managed with an update management solution such as Windows Server Update Services or Systems Management Server 2003. Organizations can use those products to fully manage deployment of updates released through Windows Update and Microsoft Update, including Internet Explorer 8, within their environment.

For more details on how Internet Explorer 8 will be distributed via Automatic Updates and information on other options for blocking deployment within organizations, please review the TechNet announcement at here.

Q. Which users will receive Internet Explorer 8 as an important update?
A. Users of Windows Vista and Windows Server 2008 will be offered Internet Explorer 8 as an important update if they have Automatic Updates enabled or if they perform a manual scan for updates using the "Express" install option on the Windows Update or Microsoft Update sites. Internet Explorer 8 will also be offered as a recommended update to any user who performs a manual update scan on the Windows Update and Microsoft Update sites by using the Custom install option.

note iconNote:
Organizations do not need to deploy the Blocker Toolkit in environments managed with an update management solution such as Windows Server Update Services or Systems Management Server 2003. Organizations can use those products to fully manage deployment of updates released through Windows Update and Microsoft Update, including Internet Explorer 8, within their environment.

For more details on how Internet Explorer 8 will be distributed via Automatic Updates and information on other options for blocking deployment within organizations, please review the TechNet announcement here.

Q. When will the Blocker Toolkit be available?
A. The Blocker Toolkit is available immediately in the Microsoft Download Center. Microsoft encourages IT administrators who want full control over the deployment of updates to their systems to use Windows Server Update Services (WSUS), a free tool for users of Windows Server, or the more advanced configuration management tools System Center Configuration Manager (SCCM) or Systems Management Server 2003 (SMS).

Q. How long will the blocker mechanism work?
A. Once the blocking registry key value is set to its blocked value, automatic delivery of the update will be deactivated permanently as long as the registry key value is not removed or changed.

Q. If I need to disable delivery of Internet Explorer 8, why should I use the toolkit provided by Microsoft? Why should I not just disable Automatic Updates entirely?
A. Microsoft strongly urges customers not to disable Automatic Updates because it provides the ongoing delivery of critical security and reliability updates to all enabled systems, and disabling Automatic Updates can potentially leave these systems more vulnerable. Microsoft encourages IT administrators who want full control over the deployment of updates to their systems to use Windows Server Update Services (WSUS), a free tool for users of Windows Server, or the more advanced configuration management tools System Center Configuration Manager (SCCM) or Systems Management Server 2003 (SMS). Microsoft has specifically created this Blocker Toolkit to safely disable and re-enable delivery of Internet Explorer 8 to systems in organizations that cannot use WSUS, SCCM, SMS, or another update-management solution.

Q. Why not block URL access to Windows Update or Microsoft Update?
A. This is not recommended because it would stop delivery of all critical security and reliability updates to the organization for all supported versions of the Windows desktop and server operating systems, which would leave all systems more vulnerable.

Q. What testing should customers do to validate the Internet Explorer 8 Blocker Toolkit Microsoft is making available before using it?
A. Because the Blocker Toolkit being provided by Microsoft relies on a new registry key that is used only for the purpose of disabling and re-enabling delivery of Internet Explorer 8, there should be no additional impact or side effect on the system. No additional testing should be necessary to validate the Toolkit.

Q. What registry key is being used to disable delivery of Internet Explorer 8?
A. HKLM\SOFTWARE\Microsoft\Internet Explorer\Setup\8.0

Q. What is the key value name and what are the value options?
A. The key value name is "DoNotAllowIE80".

If the value is '1', automatic delivery of Internet Explorer 8 through Automatic Updates and the Windows Update/Microsoft Update site "Express" install option is disabled. If the value is not '1' or if the key doesn't exist, the system will be offered Internet Explorer 8 by Automatic Updates or if a user performs a manual update scan for high-priority updates via the Windows Update/Microsoft Update sites.

Q. Will this Internet Explorer 8 blocking mechanism also block delivery of Internet Explorer 8 through Software Update Services (SUS), Windows Server Update Service (WSUS), or Systems Management Server (SMS)?
A. No, this mechanism only blocks automatic delivery of Internet Explorer 8 in environments that do not use SUS, WSUS, or SMS. Internet Explorer 8 can still be deployed using SUS, WSUS, SMS, and other methods even if the blocking mechanism is activated.

If your organization uses WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your organization. This scenario is discussed in detail in the Knowledge Base article located here.

Q. If I have Windows Server Update Service (WSUS) configured to 'auto-approve' Update Rollup packages (this is not the default configuration), how can I stop Internet Explorer 8 from automatically installing throughout my organization?
A. You will need to take action if:

  • You use WSUS to manage updates in your organization.
  • You have Windows XP Service Pack 2 (SP2)-based computers, Windows Vista-based computers, Windows Server 2003 Service Pack 2 (SPs)-based computers, or Windows 2008-based computers that have Internet Explorer 6 or Internet Explorer 7 installed.
  • You do not want to upgrade Internet Explorer 6 or Internet Explorer 7 machines to Windows Internet Explorer 8 at this time.
  • You have configured WSUS to auto-approve Update Rollups for installation.

The following steps will temporarily modify the auto-approval that you may have created to ensure that packages classified as Update Rollups are not automatically approved for installation. These steps are the steps for WSUS 3.0. For WSUS 2.0 please refer to the product documentation.

  1. Click Start, click Administrative Tools, and then click Microsoft Windows Server Update Services 3.0.
  2. Expand ComputerName, and then click Options.
  3. Click Automatic Approvals.
  4. Click the rule that automatically approves an update that is classified as Update Rollup, and then click Edit.
    note icon

    Note:
    The properties for this rule will resemble the following:

    • When an update is in Update Rollups
    • Approve the update for all computers
  5. Click the Update Rollups property under the Step 2: Edit the properties (click an underlined value) section.
  6. Clear the Update Rollup check box, and then click OK.
  7. Click OK to close the Automatic Approvals dialog box.
note iconNote:
If you do not see a rule that resembles step 4, you have not configured WSUS to automatically approve Update Rollups for installation. Therefore, no further action is required.

The steps above ensure Windows Internet Explorer 8 is not automatically approved for installation. After the Internet Explorer 8 package is available for download, you should manually synchronize the new package to your WSUS server so that when you re-enable auto-approval for Update Rollups it will not be installed. These steps are the steps for WSUS 3.0. For WSUS 2.0 please refer to the product documentation.

  1. Click Start, click Administrative Tools, and then click Microsoft Windows Server Update Services 3.0.
  2. Expand ComputerName, and then click Synchronizations.
  3. Click Synchronize Now.
  4. Expand ComputerName, expand Updates, and then click All Updates.
  5. Choose Unapproved in the Approval dropdown.
  6. Ensure that Windows Internet Explorer 8 is listed as an unapproved update.
    note iconNote:
    There may be multiple updates listed depending on the language and operating system updates you imported.

Optional
If the business needs of your organization require that Update Rollups packages are set to auto-approve, you can change your settings back to auto-approve in the Update Services Microsoft Management Console Snap-in. To do this, follow these steps:

  1. Click Start, click Administrative Tools, and then click Microsoft Windows Server Update Services 3.0.
  2. Expand ComputerName, and then click Options.
  3. Click Automatic Approvals.
  4. Click the rule that automatically approves updates of different classifications, and then click Edit.
  5. Click the Update Rollups property under the Step 2: Edit the properties (click an underlined value) section.
  6. Enable the Update Rollups check box, and then click OK.
  7. Click OK to close the Automatic Approvals dialog box.
note iconNote:
Because auto-approval rules are only evaluated when an update is first imported into WSUS turning this rule back on after the Windows Internet Explorer 8 update has been imported/synchronized to the server will not cause the auto-approval of this update.

Q. Will the Blocker Toolkit prevent users from installing Internet Explorer 8 manually on their computers?
A. No. The Blocker Toolkit will prevent covered computers from being offered Internet Explorer 8 as a high-priority update automatically through Automatic Updates or through the "Express" install option on the Windows Update/Microsoft Update sites. Internet Explorer 8 will still appear as an optional update that users can select through the "Custom" install option via the Windows Update/Microsoft Update site scans, and the blocker will not prevent users from downloading Internet Explorer 8 from the Microsoft Download Center or installing it from external media.

Q. Will the Blocker Toolkit prevent users from being automatically upgraded to a more recent version of Internet Explorer?
A. Yes. For enterprise customers who are using the Internet Explorer 8 Blocker Toolkit to prevent installation of Internet Explorer 8 through Automatic Updates, automatic upgrades from Microsoft Internet Explorer 6 or Windows Internet Explorer 7 to Internet Explorer 8 will also be blocked.

Q. How does the provided script work?
A. The script accepts one of two command line options (block and unblock) and creates or removes the registry key that controls whether Internet Explorer 8 is offered automatically to the system (via Automatic Updates or the “Express” install option for manual Windows Update/Microsoft Update site scans).

Q. What is the ADM template used for?
A. The Administrative Template (.adm file) allows administrators to import the new Group Policy settings to block or unblock automatic delivery of Internet Explorer 8 into their Group Policy environment, and to use Group Policy to centrally execute the action across systems in their environment.

Q. Will the tool be localized?
A. The tool will not be localized. It will only be released in EN, but will work without modification on any language edition of the supported operating systems.