How to Disable Internet Explorer Enhanced Security Configuration

Before we learn how to disable Internet Explorer Enhanced Security Configuration, we have to understand that Internet Explorer functionality is heavily restricted on Windows Server by its default Enhanced Security Configuration, especially as Microsoft removed the standalone Internet Explorer application from Windows Server 2025. This article explains why this is the case and provides step-by-step instructions showing how to disable it.

Internet Explorer’s Enhanced Security Configuration (IE ESC) is designed to reduce the exposure of computers running Windows Server operating systems to online security vulnerabilities, which is highly important for servers that power businesses and other critical infrastructure (especially if they hold sensitive data). However, these limitations can prevent you from performing certain necessary system administration tasks, and you’ll need to disable these restrictions occasionally.

If you prefer a visual guide, watch our video entitled “How to Disable Internet Explorer Enhanced Security Configuration.”

Overview of Internet Explorer Enhanced Security Configuration (IE ESC)

Internet Explorer’s Enhanced Security Configuration enforces the following restrictions:

• Disables ActiveX scripts and controls
• Disables browser extensions, installing web components on demand, and the Microsoft VM compiler
• Disables media content
• Enforces checks for server certificate revocation
• Enforces checks for signatures on downloaded applications
• Disables storing secure data in temporary files
• Automatically clears temporary fileswhen the browser is closed

There are a few scenarios where you may need to disable IE ESC:

• Downloading unsigned software
• Downloading a more secure web browser to use instead
• Website compatibility
• Accessing administrative web interfaces that require ActiveX scripts (to avoid being prompted each time a script attempts to load)

Considerations for disabling IE ESC

As mentioned earlier, IE ESC was specifically created to address the growing problem of Internet Explorer being used as an attack vector for Windows servers.

Internet Explorer is no longer compatible with a large proportion of the internet: it’s outdated and may contain unaddressed security vulnerabilities. More specifically, IE 11’s desktop application (the final version of Internet Explorer) ended support for certain operating systems on June 15, 2022, and customers have been encouraged to move to Microsoft Edge with IE mode. For this reason, it’s wise to only disable IE ESC protection temporarily to perform a specific task and then immediately reenable it.

The first task you should perform if you do need to regularly access internet sites and web interfaces from your Windows server is to install a modern, more secure web browser like Microsoft Edge and then install plugins to disable all scripts by default so that they can then be allowed only for trusted sites.

You should also ensure that your Windows Server deployments are up to date and managed using a robust monitoring and management platform to increase the visibility of your infrastructure and reduce the risk of online threats.

Step-by-step guide: How to disable Internet Explorer Enhanced Security Configuration

Before you make any major configuration changes to your Windows server, you should perform a system backup that you can revert to in case something goes wrong. You should also ensure that your antivirus and firewall software are properly configured before disabling IE ESC. Once IE ESC is disabled, you should make sure to only visit trusted websites and scan all downloads for viruses.

To disable Internet Explorer’s Enhanced Security Configuration, you’ll need to be logged in as an administrator. If you’re using Internet Explorer on a workstation with IE ESC enabled, you’ll need to contact your network admin to disable it for you.

Disable Internet Explorer Enhanced Security Configuration from the Windows Server Manager by following these steps:

1. Close all Internet Explorer windows for all logged-in users.
2. Open the Start menu and then open Server Manager.
3. Select Local Server from the menu to the left.
4. In the Properties panel on the right, locate IE Enhanced Security Configuration and click On.
5. You can disable IE ESC for administrators and regular users separately. Toggle the option to Off for each user category.
6. Click OK to apply the change.

IE Enhanced Security Configuration will now appear as Off in the Server Manager.

The steps to disable Internet Explorer Enhanced Security Configuration differ on older versions of Windows Server (particularly Windows Server 2003/2008):

1. Ensure Internet Explorer is not running by closing all windows.
2. Navigate to the Control Panel.
3. Open Add or Remove Programs.
4. Click Add/Remove Windows Components.
5. In the Components panel, click Details next to Internet Explorer Enhanced Security Configuration.
6. Uncheck the checkbox for the users for whom you want to disable IE Enhanced Security Configuration.

1. Click Next and then click Finish.

With all this said, it’s extremely important to note that Windows Server 2008 Premium Assurance ended on January 13, 2026, and that Windows Server 2012’s Extended Security Updates will end on October 13, 2026.

Why and when to reenable Internet Explorer Enhanced Security Configuration

You should reenable IE ESC as soon as you’ve performed your administrative tasks. As discussed above, Internet Explorer is vulnerable to online threats and should only be used when absolutely necessary for compatibility reasons or for downloading a more modern web browser to use instead.

The process for reenabling the Enhanced Security Configuration is exactly the same as listed above except you need to toggle it back to On.

Disable IE ESC using PowerShell

You can also disable IE ESC using the following PowerShell script:

# Disable IE ESC for administrators

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" -Name "IsInstalled" -Value 0

# Disable IE ESC for users

Set-ItemProperty -Path "HKLM:\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}" -Name "IsInstalled" -Value 0

# Restart explorer to apply change

Stop-Process -Name Explorer

Write-Host "Internet Explorer Enhanced Security Configuration disabled."

Troubleshooting IE ESC and common issues

If you’re still overwhelmed with prompts to display blocked content, you can try adding the website to your Trusted Sites zone and reducing the security setting for that zone. Again, this isn’t recommended and presents an ongoing security concern, so you should revert this change as soon as possible and avoid browsing the web from your critical infrastructure.

Secure your Windows servers from internet security vulnerabilities

It’s important to keep your critical Windows Server infrastructure secure. To do this, you should avoid disabling Internet Explorer Enhanced Security Configuration unless absolutely necessary to perform system administration tasks—and only temporarily.

Following best practices surrounding Windows Server operating systems isn’t enough to address the modern online threat landscape. To help resolve this predicament, NinjaOne’s endpoint security platform gives you complete visibility and control over your corporate network and devices, ensuring that

• secure-by-default configurations are applied,
• software is up to date, and
• devices and sensitive data are secured.