This article explains how to disable Internet Explorer enhanced security in Windows Server 2008 and Windows Server 2008 R2 by turning off IE ESC in Server Manager.

One of the first things I usually do when I install a new Windows Server in a test environment, is to turn off Internet Explorer Enhanced Security Configuration (IE ESC). I am talking about this little prompts that get on your nerves whenever you open a website in Internet Explorer on a Windows Server. I described how to disable Internet Explorer Enhanced Security in Windows Server 2003 a while back. Since it is one of the popular articles here on 4syosps and because the procedure is different on Windows Server 2008, I decided to post a follow-up to save you from this constant security prompts.

Disable Internet Explorer Enhanced Security Windows Server 2008 R2 - IE

Usually, when you explain publicly how to turn off a security feature you will be confronted with protests in a moralizing undertone. Feel free to do this in a comment box below. I appreciate all kinds of objections. But let me explain first why I think that disabling Internet Explorer Enhanced Security is a good thing to do.

First of all, one shouldn’t open web pages on production server, anyway. So the best way to enhance security would be if one could uninstall IE entirely. Unfortunately, Microsoft doesn’t allow this, though IE ESC comes very close to a disabled Internet Explorer. Not because it really enhances security, but because it makes IE literally useless.

I just tried to access Microsoft’s homepage on a freshly installed Windows Server 2008. I had to click about ten times on this security prompt until the page was finally displayed. If you decide not to add the site to the trusted sites zone you might get away with just six clicks. If you click on any link the click orgy will usually start again. On other sites it might even be worse. I wonder who really uses IE on a server this way. And, I seriously doubt, that those who really do, know what they are actually adding to their trusted site zones all the time.

Anyway, my recommendation is to use Opera if you really have to access web pages on a productive server. This browser is more secure than IE or Firefox because the bad guys usually only focus on popular browsers.

Disable Internet Explorer Enhanced.Security.Windows Server 2008 R2 - Server Manager

In a test environment, where one doesn’t need this extra security, it makes sense to just disable Internet Explorer Enhanced Security. In Windows Server 2003, one has to uninstall the corresponding Windows Component. In Windows Server 2008, this doesn’t work anymore. You have to click on the root folder in Server Manager. Then you scroll down to the Security Information Section and click “Configure IE ESC”. You can turn off IE ESC for Administrators and/or for users. The latter probably only makes sense in a Terminal Server environment.

55 Comments
  1. TonyP 11 years ago

    I wasted 30 min on Microsoft's website and searching the server itself trying to find how to uninstall the enhanced security (being used to 2003).

    Thanks for the point in the right direction!

  2. HeadInTheClouds 11 years ago

    I am testing using VMWare and Server 20008 R2, running datacenter mode.
    With IE ESC enabled IE takes 5 or more minutes to load, not to mention the barrage of messages and add to trusted. It gets to be impossible to work at all! To configure and check IIS (for me) requires a little playing with IE to test it is working at localhost / local ip address.

    Disable IE ESC and IE loads in a few seconds - phew! Thanks for this tip, I am seriously relieved! I am no longer about to dip the keyboard in a bucket of water... 😉

  3. Jeff 11 years ago

    Please use the proper terminology - it is a "PRODUCTION" server, not a "productive" server. But, hopefully it also is very productive - LOL! 😉

  4. Mark 10 years ago

    Thanks. Your article has shown me exactly what to do to switch off ESC. I agree with your sentiments. This is not the way to make a browser more secure; instead it just makes use of the browser really annoying. I set up Internet Explorer for many of my clients and I make a point of switching off ESC each time, because it renders the browser unusable.

  5. Phil 10 years ago

    I find that having those prompts is a great feature. Often times when working on a mix of servers and workstations I sometimes forget that I am working on a server when I want to look something up quickly. Having this added security is perfect way of asking me.. are you sure you want to browse the web on this computer?

  6. Jeff, thank you so much.

    Phil, I agree that it makes sense to display a warning once. But why 10 or 20 times per page?

  7. Rick Payne 10 years ago

    Thank you Michael !! It was annoying me to no end that as an administrator I couldn't modify any of the security settings, other than adding/removing sites from the lists.

  8. A Concerned Citizen 10 years ago

    Generally, if you're running Windows at all, the server is already insecure, so you might as well disable IE ESC.

  9. shalene 10 years ago

    i tried it but it is not heplful

  10. shalene, hmm maybe you have to try harder? 😉

  11. Jan 10 years ago

    Thanks!!
    As a newbie it was just the information I needed to be at least able to open websites to find out how to do something 'usefull' with Win server 2008 ...
    I love it however more than win 7 ... strange?
    My main platform is OSX and Linux ... Windows is a struggle.!

  12. Gordon Lincoln 10 years ago

    Thanks for the article - installing SBS 2011 Std on a Dell, installing various updates and tools, was getting tired of ESC. There are times when browsing to the mfgr's or publisher's website from a server is more ergonomic and vastly more efficient than the typical flash drive sneakernet alternative.

    I'm far more afraid of technicians walking around with their personal flash drives, who end up using them to transport an update or driver to a critical server, than I am a responsible IT technician using IE with ESC turned off. Carelessly passed around flash drives are the most frequent root source of viruses I encounter in corporate systems.

  13. Richard Hussain 10 years ago

    Thanks. This resolved my issue.

  14. AndyMac 10 years ago

    I think VMware vCenter (on Server 2008 R2) uses web reporting for some things and IE ESC messes with it? Presumably, also any other app that uses http protocols are affected & if installed, these are a good reason to disable this feature?

  15. jomebrew 10 years ago

    Thanks for the helpful and easy to follow procedure.

  16. TekServer 10 years ago

    (sigh) Why does MS always have to move stuff around? I swear it seems like the wait till we figure out where everything is, then release a new version just to move everything around so we have to pull our hair out finding it again!
    Thanks for the info; most helpful!
    😉

  17. James 10 years ago

    How about because ESC is a redundant and ANNOYING feature that is unnessasary.If you run your server through a router ( most do, mutliple routers infact ) and set it up correctly, This feature is completly assinine.

  18. georgy 9 years ago

    thanks a ton

  19. Mike 9 years ago

    Since when has putting 'Internet zone' websites into the 'Trusted zone' enhanced security?

  20. Joseph G 9 years ago

    Thanks for this! It helped!

  21. Bill Dickerson 9 years ago

    For those complaining that this opens up holes and the solution is to "stop browsing the web on a server" - I will toss this back at ya - this is NOT impacting "web browsing" as we don't do that on a server. However, it DOES impact even LOCAL or INTRANET applets, applications, services and consoles. We run some security software that uses IE as the LOCAL INTERFACE to the services running ON THAT SERVER. The requests never leave the box, but IE won't allow things to work properly thanks to all the griping it does. Sure - your next comment "then just add it to...." nope, doesn't work. IE doesn't care where the site (even the LOCAL MACHINE FILES) are listed, local, intranet, safe or trusted sites and so on. The only way to make some software work - including MICROSOFT SECURITY PATCHES in IE on 2008R2 is to turn this protection off.
    We're fine with it as we restrict access to server consoles, we audit and track all logins, and we don't "browse the web" on servers. We to that on our own desktop/notebook systems. If we need to search or research, we do it on a computer that is not a server. Remote to the server on one monitor, run Windows on the other monitor, you still get the work done safely - but faster.
    Please give us a bit of credit. I know what's not safe -

  22. Leslie Parece 9 years ago

    Thank you. We have a lot of other tools that do a better job for the security.

  23. Ben Dyson 9 years ago

    Hi all and thanks to Michael for posting, it was very helpful.

    I've not used Opera so my comment is merely academic and isn't intended to single out Opera, just the concept of less popular browsers being safer.

    If more people are trying to hack popular browsers, like Chrome and IE that means that the developers are always plugging gaps and holes will be reported faster due to the larger user base. Where as Opera is smaller, less targeted but presumably doesn't have the same sized dev team, and Michaels comment "Because Apple’s developers are smarter?" also applies here. Opera still has holes to exploit because it was programmed by fallible people just like IE. But doesn't Opera have a smaller user base to highlight issues and less developers to fix them?

    In summary I suggest that with popular browsers Hackers are more likely to find holes to exploit but that they will be be plugged relatively quickly. However less popular browsers are less likely to be targeted but "IF" exploited will pose a greater security risk* and for longer.

    * There is also the concept that you have greater faith in your browser and therefor your guard is lower.

    I suspect that from an academic POV I have a valid point, but the reality is the stats involved would show that Opera is still the safer option.

  24. Natalia 8 years ago

    I am installing SQL Server 2012 on Windows Server 2008 R2, this feature does not allow me to go through installation, looking for updates. Am I doing something wrong? I made this installation couple times already, never had this problem before.

  25. Tim 7 years ago

    I knew all about this setting. However, on my RDS Hosts this is turned off for both "Users" and "Administrators" but is still popping up for users in the RDS environment....Very annoying

Leave a reply

Please enclose code in pre tags

Your email address will not be published. Required fields are marked *

*

© 4sysops 2006 - 2022

CONTACT US

Please ask IT administration questions in the forums. Any other messages are welcome.

Sending

Log in with your credentials

or    

Forgot your details?

Create Account