Utility Spotlight : Disable the Internet Explorer 9 Automatic Update
The Internet Explorer 9 Blocker Toolkit will help prevent any inadvertent installations of Microsoft’s latest browser.
Microsoft released Internet Explorer 9 in March, but you might not want to let your entire user community automatically upgrade to the latest version of the browser. For now, anyone who wants to install Internet Explorer 9 has to manually download and install it from the dedicated Web page. That will change in late June, however, when Microsoft adds Internet Explorer 9 to its Automatic Updates feature.
Though the new browser will be available as an Automatic Update, it will offer users a choice of whether they wish to install. It will also require local administrator rights. Still, there’s always a chance it could be inadvertently installed on any PC enabled with Automatic Updates. To guard against unwanted installation at organizations that need to manage Internet Explorer 9 rollouts, you can change Internet Explorer 9 to an optional update with the free Microsoft Internet Explorer 9 Blocker Toolkit.
The Blocker Toolkit is designed for organizations that don’t use systems management products like Windows Server Update Services or System Center Configuration Manager to manage Microsoft software updates. Internet Explorer 9 will show up through Automatic Updates on PCs running Windows Vista SP2 and higher, Windows 7, Windows Server 2008 SP2 and higher, and Windows Server 2008 R2, so the toolkit is compatible with all of those OSes.
The Blocker Toolkit isn’t a catch-all. Anyone can still manually install Internet Explorer 9 as an optional update, or grab it directly from the Microsoft Download Center. This toolkit can at least ensure that the new browser won’t be automatically installed as an important update.
You can download the Blocker Toolkit from its page at the Microsoft Download Center. The toolkit has two separate components—a command-line script that creates a new Registry key and a Group Policy ADM file. You can use either of these to block Internet Explorer 9 as an important update.
When you run the IE9_BlockerToolkit.exe file, it extracts the four following files:
- IE9_Blocker.cmd– This is the command script you run to create the Registry key.
- IE9_Blocker.adm – This is the Group Policy template.
- IE9_BlockerHelp-GPFilteringDialog.jpg – This is an image showing how to change the filtering in Group Policy to display the new setting.
- IE9_BlockerHelp.htm – This is simply a help file explaining how to use the toolkit.
Let’s look at the script to create the Registry file first. You’ll need to open a command prompt to the location where you extracted the files. The command itself (IE9_Blocker.cmd) offers three switches:
- B - block Internet Explorer 9 deployment
- U - unblock Internet Explorer 9 deployment
- H or ? - displays help information
Running the script creates the following Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\9.0
This sets the value name as DoNotAllowIE90. By default, the command IE9_Blocker.cmd /B will make the change on your local machine. You can specify a different computer, however, if you wish to run the script remotely. For example, the command IE9_Blocker.cmd winserver /revert will revert the Registry change on a machine called winserver. You can, of course, run this command on every computer on your network through a login script or other automated process.
Disabling with Group Policy
If you’re using Group Policy, you may instead wish to disable Internet Explorer 9 through the toolkit’s administrative template. From your Group Policy editor, add the IE9_Blocker.adm file to the Computer Configuration | Administrative Templates folder.
If filtering is turned on, you’ll need to clear the “Only show policy settings that can be fully managed,” option in the Filtering dialog to see the new policy setting. To do this, select the Administrative Templates folder, select View, and then select Filtering.
After clearing this option, you’ll see the new Internet Explorer 9 policy setting under Computer Configuration | Administrative Templates | Classic Administrative Templates (ADM) | Windows Components | Windows Update | Automatic Updates Blockers v3.
Figure 1 You can use the Internet Explorer 9 Blocker Toolkit to prevent Internet Explorer 9 being installed as an automatic update.
To block Internet Explorer 9 as an important update, simply open the setting and set its value to “Enabled” (see Figure 1). Whether you use the Registry script or the Group Policy template, you can easily re-enable Internet Explorer 9 as an important update at any time.
Most organizations probably want to carefully manage or at least standardize IE deployments. So this may be an option you’ll want to keep turned on permanently. You can learn more about the Microsoft Internet Explorer 9 Blocker Toolkit at its Microsoft FAQ page.