Learn about Internet Explorer 10 central administration and picking the right management method: Group Policy Settings, Group Policy Preferences, Internet Explorer Administration Kit IEAK, and Answer Files.

Microsoft released Internet Explorer 10 as part of Windows RT, Windows 8 and Windows Server 2012. Also, Internet Explorer 10 will become available for Windows 7 and Windows Server 2008 R2. (A preview is already available today.)

Internet Explroer 10 logo

About Internet Explorer 10

Internet Explorer 10 is a significant upgrade to Internet Explorer 9. It has updated support for HTML5, CSS3 and SVG. On the security side, it brings the Enhanced Protected Mode and SmartScreen download reputation to the table. When you’re concerned with your organization’s privacy, it’s good to know Do Not Track (DNT) is on by default in Internet Explorer 10.

Windows 8 features two distinct versions of Internet Explorer 10. There’s ‘Internet Explorer 10 for the desktop’, and Internet Explorer for the new interface. The latter one is referred to in Microsoft’s documentation as just ‘Internet Explorer’.

Internet Explorer 10 administration

With double the Internet Explorer presence on a system, centralized management of Internet Explorer must surely be more complex, right?

Actually … no. Microsoft aimed to make managing Internet Explorer easier. For instance, there will be no version 10 of the Internet Explorer Maintenance Extension for Group Policy. It is discontinued, as is the Profile Manager portion you might be familiar with from previous versions of the Internet Explorer Administration Kit.

Today, Microsoft recommends you to use the following four technologies to centrally manage Internet Explorer 10:

Group Policy Settings

In networking environments with Active Directory, you can use Group Policy settings to manage Internet Explorer 10. Group Policy settings allow you to granularly scope settings, based on Active Directory Domains, Active Directory Sites and Organizational Units (OUs), it also allows you to filter based on WMI properties of computer- and user accounts. Group Policy settings for Internet Explorer are applied at boot and/or login and are refreshed in the background every 90 to 120 minutes.

For Internet Explorer 10, additional Group Policy settings are available to manage its new features. These new settings add to the 1500 available settings for Internet Explorer 9. When you’ve managed previous versions of Internet Explorer with Group Policy settings, you’ll already be familiar with the hierarchy of Group Policy Objects, but in Part 2 of this series, I’ll show you how to manage these, including a couple of neat tricks.

Integration with Offline Domain Join (ODJ) and the free Security Compliance Manager v2 Solutions Accelerator make the possibilities of Group Policy Settings endless.

Group Policy Preferences

Group Policy Preferences were introduced with Windows Vista. They use the same distribution and management infrastructure as Group Policy settings, but are different in possibilities and refresh. Where the possibilities of Group Policy Settings can be seen as the equivalent of many of the Control Panel settings, the possibilities of Group Policy Preferences can best be compared to startup- and logon scripts. This also uncovers the second big difference: Where Group Policy settings are refreshed in the background by default, Group Policy Preferences can be configured to get applied only once.

The Internet Explorer-related Group Policy Preferences are displayed as the Internet Options tabs, making them extremely easy to manage, as I’ll show you in part 3 of this series.

Internet Explorer Administration Kit (IEAK 10)

Internet Explorer Administration Kit 10, is the most robust management tool to manage Internet Explorer and can even be used in environments without a centralized Directory solution, such as Active Directory and for computers that are not members of the Active Directory, but that do access the corporate intranet. This makes the Internet Explorer Administration Kit ideal for BYO* scenarios.

Unattended Windows Installation Answer Files

Since Internet Explorer 10 is an integral part of Windows, you can take advantage of the unattended installation options for installing Windows 8 and Windows Server 2012, to deliver Internet Explorer in a managed way, straight from the first boot.

In part 5 of this series, I’ll show you how to write your own unattended installation answer file and apply them to your Windows 8 and Windows Server 2012 installations.

Picking the right administration technology

Each of the management methods offers its own advantages and you might be inclined to decide you only need one management method for all your Internet Explorer management needs. However, you’ll find yourself using most tools as each has its own pros and cons and together they paint the complete centralized Internet Explorer management picture.

The table below paints the picture:

Internet Explorer management goalGroup Policy SettingsGroup Policy PreferencesIEAKAnswer files
Manage Internet Explorer 10 on Windows 8 and Windows Server 2012
Enforce settings in Active Directory environments

Enforce settings in non-Active Directory environments

Suggest settings (apply once capabilities)

Titlebar customization

Security Zones & Privacy Settings customization

Dial-up and VPN Connection Settings


Manage Internet Explorer 10 on Windows 7 and Windows Server 2008 R2
Enforce settings

Suggest settings (apply once capabilities)

Table: Internet Explorer 10 administration methods and their capabilities

In my next post I will discuss Internet Explorer 10 Group Policy settings.

  1. Ron 11 years ago

    I am running IE 10 on 64 bit Win 8 (RTM). I have just learned something annoying, and I’m hoping you can give me a better answer.

    Apparently if you install a different browser and make it default you cannot see the Metro version of IE 10. I confirmed this be restting IE to default and it switched back to allowing me to see metro IE.

    Do you know of any way of allowing a different browser to be default while still allowing me to see IE 10 Metro.


  2. Ryan Overby 11 years ago

    I have a question for you. We recently updated our client workstations to WES 7 thin clients running IE 10. I would like to make some GP changes to work with IE 10 but when I got to USER CONFIG>PREFERENCES>CONTROL PANEL SETTINGS>INTERNET SETTINGS>NEW… I only see IE 5,6,7,&8. But when I see your screen shot it shows IE 9 & 10 as well. Am I missing something, an update maybe? Or is management only allowed through Server 2012? Thank you for your time.

  3. MHammons 10 years ago

    Nice to see Ryan’s questions remains unanswered. I have not found a solution to this issue. It would appear Microsoft would require us to install a 2012 Server or Win8 workstation to manage IE 10 that they forced on us as a critical update.

  4. Cliff 9 years ago

    Maybe it’s just me but the “Internet Explorer 10 administration methods and their capabilities” table is less than clear to me, too abstract, are the dots to indicate a lack of support or specific support?

Leave a reply

Your email address will not be published. Required fields are marked *


© 4sysops 2006 - 2023


Please ask IT administration questions in the forums. Any other messages are welcome.


Log in with your credentials


Forgot your details?

Create Account