How to Disable IE Enhanced Security on Windows Server

To disable IE Enhanced Security on Windows Server, change the setting in Server Manager and turn off protection for the user groups that need it. The process takes about two minutes and lets approved sites or legacy management tools load without the repeated security prompt.

Prerequisites

• A Windows Server installation with Desktop Experience, such as Windows Server 2012 R2, 2016, 2019, 2022, or 2025. The menu names can vary slightly between releases.
• An RDP session using the local Administrator account or another account with local administrator rights. You can use a Windows VPS with administrator access if you need a fresh server for testing.
• A specific reason for changing the setting, such as a trusted vendor portal or an older administration tool. IE Enhanced Security Configuration reduces exposure to unsafe web content, so do not switch it off merely to browse the web casually.
• A tested backup or snapshot if the server is production-critical. The change is reversible, but a snapshot gives you a quick recovery option before changing server security settings.

Step 1: Open the Local Server properties

Server Manager exposes IE Enhanced Security Configuration as a local server property, so you can change the setting without editing the registry.

1. Sign in to the server through RDP with an administrator account.
2. Open Start → Server Manager. If Server Manager is already open, select its window.
3. In the left navigation pane, select Local Server.
4. Wait for the properties panel to finish loading. Locate IE Enhanced Security Configuration in the Properties area.

The value normally reads On for administrators and users. Select the value, not the nearby Windows Firewall or Internet Options setting; those controls manage different security layers.

Step 2: Turn off IE Enhanced Security Configuration

The dialog separates administrator protection from standard-user protection, allowing you to make the smallest change that solves the access problem.

1. In Server Manager → Local Server, select the On value beside IE Enhanced Security Configuration.
2. In the Internet Explorer Enhanced Security Configuration window, select Off under Administrators.
3. Select Off under Users only if standard users also need to open the affected site or application. Leaving Users on is safer when only administrators need access.
4. Select OK to save the change.

You should now see Off for the group or groups you changed in the Local Server properties. Microsoft describes these two settings as administrator and user controls: when enabled, IE ESC limits exposure to web pages outside the Local Intranet and Trusted Sites zones. See the Microsoft IE ESC configuration reference for the scope of each setting.

Step 3: Restart the affected browser or tool

Existing browser processes can retain the previous security context, so close the affected application before testing the new setting.

1. Close every Internet Explorer or legacy browser window opened under the affected account.
2. Close the vendor application or management console that was displaying the warning.
3. Open a new browser window or restart the application.
4. Visit only the approved HTTPS address that required the change. Do not use this setting as a reason to open unknown downloads or untrusted sites.

On newer Windows Server releases, Internet Explorer is retired or unavailable as a general-purpose browser. In that case, use Microsoft Edge for normal browsing and use IE mode only when a documented legacy application requires it. Disabling IE ESC does not restore Internet Explorer or make an incompatible website work in Edge.

Verify the setting

The Local Server page is the authoritative visual check for this change.

1. Return to Server Manager → Local Server.
2. Confirm that IE Enhanced Security Configuration shows Off for the intended groups.
3. Open the approved site or application in a new session and confirm that the original IE Enhanced Security warning is gone.

Expected status in Server Manager:

IE Enhanced Security Configuration
Administrators: Off
Users: Off

If you intentionally disabled protection for administrators only, the expected result is Administrators: Off and Users: On. If the site still fails after this check, the cause is probably TLS, proxy, authentication, SmartScreen, application compatibility, or a separate security policy rather than IE ESC.

Troubleshooting

The setting changes back to On

A domain Group Policy, security baseline, provisioning script, or hosting image may be restoring the hardened value. Open Windows PowerShell as an administrator and run gpresult /r to see whether the server is receiving computer policies, then ask the domain administrator to approve the exception or change the baseline.

gpresult /r

Look for the Applied Group Policy Objects section in the output. If the server is managed by an organization, do not repeatedly force the local setting; the central policy will overwrite it again.

The IE Enhanced Security Configuration dialog is unavailable

You may be connected with a standard account, using Server Core, or viewing a remote server that is not the one you intended to change. Reconnect with a local administrator, confirm that Local Server is selected, and make sure the RDP session is connected to the correct hostname. Server Core has no normal Server Manager desktop workflow, so use the organization’s approved unattended configuration or management policy instead of copying registry commands from an unrelated Windows release.

The warning remains after selecting Off

The old browser process may still be open, or the warning may come from a different account. Close all affected browser windows, sign out and back in if necessary, and test with the same administrator or user account whose setting you changed. Then refresh Server Manager → Local Server to ensure the displayed value still says Off.

A website is still blocked even though IE ESC is Off

IE ESC is only one part of Windows browser security. A blocked page can instead be caused by an invalid certificate, TLS incompatibility, proxy authentication, Windows Defender SmartScreen, a firewall, or the application’s own allowlist. Check the exact error and fix that layer; do not disable Defender, TLS validation, or the Windows firewall as a workaround.

Hardening

• Turn IE ESC back on when the legacy task is complete. Set Administrators and Users to On in Server Manager → Local Server → IE Enhanced Security Configuration.
• Prefer Microsoft Edge for supported sites and keep Windows Server patched. Use IE mode only for a known application with a documented compatibility requirement.
• If only one vendor portal needs access, ask the application owner whether a supported Edge workflow or a narrowly scoped trusted-site policy is available instead of lowering protection for every user.
• Record who approved the exception, which account needed it, and when the setting should be restored. This prevents a temporary browser workaround from becoming an unnoticed server baseline.

FAQ

What does IE Enhanced Security Configuration protect?

IE ESC hardens Internet Explorer by limiting how web content from Internet and other less-trusted zones interacts with the server. Microsoft exposes separate controls for administrators and standard users, so the risk reduction can differ by account type.

Does turning off IE ESC disable Windows Defender?

No. This setting changes Internet Explorer’s enhanced security behavior; it does not turn off Microsoft Defender Antivirus, Windows Firewall, SmartScreen, or Windows Update. Those controls should remain enabled.

Do I need to restart Windows after changing IE ESC?

Usually not. Close and reopen the affected browser or application so it creates a new process with the updated setting. Sign out and back in only if the warning persists for the same account after a full application restart.

Can I disable IE ESC only for administrators?

Yes. In the configuration dialog, select Off for Administrators and leave Users set to On. This is the narrower option when a server administrator needs a legacy portal but standard users do not.