Internet Explorer 10 Blocker Toolkit: Frequently Asked Questions
Get answers to commonly asked questions about the Microsoft Internet Explorer 10 Blocker Toolkit.
On This Page
Automatic Updates Delivery Process
Q. Which users will receive Internet Explorer 10 as an important update?
A. Users of Windows 7 Service Pack 1 (SP1), and 64-bit version of Windows Server 2008 R2 SP1 will receive Internet Explorer 10 as an important update if they have Automatic Updates enabled, or if they perform a manual scan for updates on Windows Update.
- Internet Explorer 10 will install automatically – the Automatic Updates delivery process will automatically download and install Internet Explorer 10 to users who have Automatic Updates enabled.
- Organizations do not need to deploy the Blocker Toolkit in environments managed with an update management solution such as Windows Server Update Services (WSUS) or Systems Management Server (SMS) 2003. Organizations can use those products to fully manage deployment of updates released through Windows Update and Microsoft Update, including Internet Explorer 10, within their environment.
For more details on how Internet Explorer 10 will be distributed through Automatic Updates and information on other options for blocking deployment within organizations, please review
Internet Explorer 10 Delivery Through Automatic Updates.
Q. When will the Blocker Toolkit be available?
A. The Blocker Toolkit is available immediately in the
Microsoft Download Center. Microsoft encourages IT administrators who want full control over the deployment of updates to their systems to use
WSUS, a free tool for users of Windows Server, or the more advanced configuration management tool,
System Center 2012 Configuration Manager.
Q. How long will the blocker mechanism work?
A. Once the blocking registry key value is set to its blocked value, automatic delivery of the update will be deactivated permanently, as long as the registry key value is not removed or changed.
Q. If I need to disable delivery of Internet Explorer 10, why should I use the toolkit provided by Microsoft? Why should I not just disable Automatic Updates entirely?
A. Microsoft strongly urges customers not to disable Automatic Updates because it provides the ongoing delivery of critical security and reliability updates to all enabled systems, and disabling Automatic Updates can potentially leave these systems more vulnerable. Microsoft encourages IT administrators who want full control over the deployment of updates to their systems to use WSUS, a free tool for users of Windows Server, or the more advanced configuration management tool, Configuration Manager. Microsoft has specifically created this Blocker Toolkit to safely disable and re-enable delivery of Internet Explorer 10 to systems in organizations that cannot use WSUS, Configuration Manager, SMS, or another update-management solution.
Q. Why not block URL access to Windows Update or Microsoft Update?
A. This is not recommended because it would stop delivery of all critical security and reliability updates to the organization for all supported versions of the Windows desktop and server operating systems, which would leave all systems more vulnerable.
How the Internet Explorer 10 Blocker Toolkit Works
Q. What testing should customers do to validate the Internet Explorer 10 Blocker Toolkit Microsoft is making available before using it?
A. Because the Blocker Toolkit being provided by Microsoft relies on a new registry key that is used only for the purpose of disabling and re-enabling delivery of Internet Explorer 10, there should be no additional impact or side effect on the system. No additional testing should be necessary to validate the Toolkit.
Q. What registry key is being used to disable delivery of Internet Explorer 10?
A. HKLM\SOFTWARE\Microsoft\Internet Explorer\Setup\10.0
Q. What is the key value name and what are the value options?
A. The key value name is "DoNotAllowIE10". If the value is '1', automatic delivery of Internet Explorer 10 through Automatic Updates and the Windows Update/Microsoft Update site "Express" install option is disabled. If the value is not '1' or if the key doesn't exist, the system will be offered Internet Explorer 10 by Automatic Updates or if a user performs a manual update scan for important updates via the Windows Update/Microsoft Update sites.
Q. Will the Blocker Toolkit prevent users from installing Internet Explorer 10 manually on their computers?
A. No. The Blocker Toolkit will prevent covered computers from being offered Internet Explorer 10 automatically through Automatic Updates. The blocker will not prevent users from downloading Internet Explorer 10 from the Microsoft Download Center or installing it from external media.
Q. Will the Blocker Toolkit prevent users from being automatically upgraded to Internet Explorer 10?
A. Yes. For enterprise customers who are using the Blocker Toolkit to prevent installation of Internet Explorer 10 through Automatic Updates, automatic upgrades from Internet Explorer 8 or Internet Explorer 9 to Internet Explorer 10 will also be blocked.
Q. How does the provided script work?
A. The script accepts one of two command line options (block and unblock) and creates or removes the registry key that controls whether Internet Explorer 10 is offered automatically to the system (through Automatic Updates scans).
Q. What is the ADM template used for?
A. The Administrative Template (.adm file) allows administrators to import the new Group Policy settings to block or unblock automatic delivery of Internet Explorer 10 into their Group Policy environment, and to use Group Policy to centrally execute the action across systems in their environment.
Q. Will the tool be localized?
A. The tool will not be localized. It will only be released in EN, but will work without modification on any language edition of the supported operating systems.
Internet Explorer 10 Blocker Toolkit and Other Update Services
Q. Will this Internet Explorer 10 blocking mechanism also block delivery of Internet Explorer 10 through Software Update Services (SUS), WSUS, or SMS?
A. No, this mechanism only blocks automatic delivery of Internet Explorer 10 in environments that do not use SUS, WSUS, or SMS. Internet Explorer 10 can still be deployed using SUS, WSUS, SMS, and other methods even if the blocking mechanism is activated. If your organization uses WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your organization.
Q. If I have WSUS configured to 'auto-approve' Update Rollup packages (this is not the default configuration), how can I stop Internet Explorer 10 from automatically installing throughout my organization?
A. You will need to take action if:
- You use WSUS to manage updates in your organization.
- You have Windows 7 SP1-based computers or Windows Server 2008 R2 SP1-based computers that have Internet Explorer 8 or Internet Explorer 9 installed.
- You do not want to upgrade Internet Explorer 8 or Internet Explorer 9 computers to Internet Explorer 10 at this time.
- You have configured WSUS to auto-approve Update Rollups for installation.
If these scenarios apply to your organization, see
Internet Explorer 10 Delivery Through Automatic Updates for more information on how to prevent automatic installation.