Internet Explorer 8 Blocker Toolkit: Frequently Asked Questions

A. Users of Windows XP SP2 and Windows Server 2003 SP2 will be offered Internet Explorer 8 as a high-priority update if they have Automatic Updates enabled or if they perform a manual scan for updates using the "Express" install option on the Windows Update or Microsoft Update sites. Internet Explorer 8 will also be offered as a recommended update to any user who performs a manual update scan on the Windows Update and Microsoft Update sites using the "Custom" install option.

Note:

• Internet Explorer 8 will not install automatically – the Automatic Updates delivery process will include a welcome screen that offers users choices of Install, Don’t Install, and Ask Me Later prior to installation.
• The notification and installation process will not start unless and until a user who is a local administrator logs on to the machine. Users who are not local administrators will not be prompted to install the update and will thus continue using Internet Explorer 6 or 7.
• Organizations do not need to deploy the Blocker Toolkit in environments managed with an update management solution such as Windows Server Update Services or Systems Management Server 2003. Organizations can use those products to fully manage deployment of updates released through Windows Update and Microsoft Update, including Internet Explorer 8, within their environment.

For more details on how Internet Explorer 8 will be distributed via Automatic Updates and information on other options for blocking deployment within organizations, please review the TechNet announcement at here.

A. Users of Windows Vista and Windows Server 2008 will be offered Internet Explorer 8 as an important update if they have Automatic Updates enabled or if they perform a manual scan for updates using the "Express" install option on the Windows Update or Microsoft Update sites. Internet Explorer 8 will also be offered as a recommended update to any user who performs a manual update scan on the Windows Update and Microsoft Update sites by using the Custom install option.

Note:

• Internet Explorer 8 will not install automatically – the Automatic Updates delivery process will include a welcome screen that offers users choices of Install, Don’t Install, and Ask Me Later prior to installation.
• The notification and installation process will not start unless and until a user who is a local administrator logs on to the machine. Users who are not local administrators will not be prompted to install the update and will thus continue using Internet Explorer 6 or 7.
• Organizations do not need to deploy the Blocker Toolkit in environments managed with an update management solution such as Windows Server Update Services or Systems Management Server 2003. Organizations can use those products to fully manage deployment of updates released through Windows Update and Microsoft Update, including Internet Explorer 8, within their environment.

For more details on how Internet Explorer 8 will be distributed via Automatic Updates and information on other options for blocking deployment within organizations, please review the TechNet announcement here.

A. The Blocker Toolkit is available immediately in the Microsoft Download Center. Microsoft encourages IT administrators who want full control over the deployment of updates to their systems to use Windows Server Update Services (WSUS), a free tool for users of Windows Server, or the more advanced configuration management tools System Center Configuration Manager (SCCM) or Systems Management Server 2003 (SMS).

A. Once the blocking registry key value is set to its blocked value, automatic delivery of the update will be deactivated permanently as long as the registry key value is not removed or changed.

A. Microsoft strongly urges customers not to disable Automatic Updates because it provides the ongoing delivery of critical security and reliability updates to all enabled systems, and disabling Automatic Updates can potentially leave these systems more vulnerable. Microsoft encourages IT administrators who want full control over the deployment of updates to their systems to use Windows Server Update Services (WSUS), a free tool for users of Windows Server, or the more advanced configuration management tools System Center Configuration Manager (SCCM) or Systems Management Server 2003 (SMS). Microsoft has specifically created this Blocker Toolkit to safely disable and re-enable delivery of Internet Explorer 8 to systems in organizations that cannot use WSUS, SCCM, SMS, or another update-management solution.

A. This is not recommended because it would stop delivery of all critical security and reliability updates to the organization for all supported versions of the Windows desktop and server operating systems, which would leave all systems more vulnerable.

A. Because the Blocker Toolkit being provided by Microsoft relies on a new registry key that is used only for the purpose of disabling and re-enabling delivery of Internet Explorer 8, there should be no additional impact or side effect on the system. No additional testing should be necessary to validate the Toolkit.

A. HKLM\SOFTWARE\Microsoft\Internet Explorer\Setup\8.0

A. The key value name is "DoNotAllowIE80".

If the value is '1', automatic delivery of Internet Explorer 8 through Automatic Updates and the Windows Update/Microsoft Update site "Express" install option is disabled. If the value is not '1' or if the key doesn't exist, the system will be offered Internet Explorer 8 by Automatic Updates or if a user performs a manual update scan for high-priority updates via the Windows Update/Microsoft Update sites.

A. No, this mechanism only blocks automatic delivery of Internet Explorer 8 in environments that do not use SUS, WSUS, or SMS. Internet Explorer 8 can still be deployed using SUS, WSUS, SMS, and other methods even if the blocking mechanism is activated.

If your organization uses WSUS to manage updates, and Update Rollups are configured for automatic installation, Internet Explorer will automatically install throughout your organization. This scenario is discussed in detail in the Knowledge Base article located here.

A. You will need to take action if:

• You use WSUS to manage updates in your organization.
• You have Windows XP Service Pack 2 (SP2)-based computers, Windows Vista-based computers, Windows Server 2003 Service Pack 2 (SPs)-based computers, or Windows 2008-based computers that have Internet Explorer 6 or Internet Explorer 7 installed.
• You do not want to upgrade Internet Explorer 6 or Internet Explorer 7 machines to Windows Internet Explorer 8 at this time.
• You have configured WSUS to auto-approve Update Rollups for installation.

The following steps will temporarily modify the auto-approval that you may have created to ensure that packages classified as Update Rollups are not automatically approved for installation. These steps are the steps for WSUS 3.0. For WSUS 2.0 please refer to the product documentation.

1. Click Start, click Administrative Tools, and then click Microsoft Windows Server Update Services 3.0.
2. Expand ComputerName, and then click Options.
3. Click Automatic Approvals.
4. Click the rule that automatically approves an update that is classified as Update Rollup, and then click Edit.
   Note The properties for this rule will resemble the following:
   • When an update is in Update Rollups
   • Approve the update for all computers
5. Click the Update Rollups property under the Step 2: Edit the properties (click an underlined value) section.
6. Clear the Update Rollup check box, and then click OK.
7. Click OK to close the Automatic Approvals dialog box.

Note If you do not see a rule that resembles step 4, you have not configured WSUS to automatically approve Update Rollups for installation. Therefore, no further action is required.

The steps above ensure Windows Internet Explorer 8 is not automatically approved for installation. After the Internet Explorer 8 package is available for download, you should manually synchronize the new package to your WSUS server so that when you re-enable auto-approval for Update Rollups it will not be installed. These steps are the steps for WSUS 3.0. For WSUS 2.0 please refer to the product documentation.

1. Click Start, click Administrative Tools, and then click Microsoft Windows Server Update Services 3.0.
2. Expand ComputerName, and then click Synchronizations.
3. Click Synchronize Now.
4. Expand ComputerName, expand Updates, and then click All Updates.
5. Choose Unapproved in the Approval dropdown.
6. Ensure that Windows Internet Explorer 8 is listed as an unapproved update.
   Note There may be multiple updates listed depending on the language and operating system updates you imported.

Optional If the business needs of your organization require that Update Rollups packages are set to auto-approve, you can change your settings back to auto-approve in the Update Services Microsoft Management Console Snap-in. To do this, follow these steps:

1. Click Start, click Administrative Tools, and then click Microsoft Windows Server Update Services 3.0.
2. Expand ComputerName, and then click Options.
3. Click Automatic Approvals.
4. Click the rule that automatically approves updates of different classifications, and then click Edit.
5. Click the Update Rollups property under the Step 2: Edit the properties (click an underlined value) section.
6. Enable the Update Rollups check box, and then click OK.
7. Click OK to close the Automatic Approvals dialog box.

Note Because auto-approval rules are only evaluated when an update is first imported into WSUS turning this rule back on after the Windows Internet Explorer 8 update has been imported/synchronized to the server will not cause the auto-approval of this update.

A. No. The Blocker Toolkit will prevent covered computers from being offered Internet Explorer 8 as a high-priority update automatically through Automatic Updates or through the "Express" install option on the Windows Update/Microsoft Update sites. Internet Explorer 8 will still appear as an optional update that users can select through the "Custom" install option via the Windows Update/Microsoft Update site scans, and the blocker will not prevent users from downloading Internet Explorer 8 from the Microsoft Download Center or installing it from external media.

A. The script accepts one of two command line options (block and unblock) and creates or removes the registry key that controls whether Internet Explorer 8 is offered automatically to the system (via Automatic Updates or the “Express” install option for manual Windows Update/Microsoft Update site scans).

A. The Administrative Template (.adm file) allows administrators to import the new Group Policy settings to block or unblock automatic delivery of Internet Explorer 8 into their Group Policy environment, and to use Group Policy to centrally execute the action across systems in their environment.

A. The tool will not be localized. It will only be released in EN, but will work without modification on any language edition of the supported operating systems.