{"id":867,"date":"2026-10-18T13:00:00","date_gmt":"2026-10-18T13:00:00","guid":{"rendered":"https:\/\/vpslake.com\/blog\/?p=867"},"modified":"2026-10-18T13:00:00","modified_gmt":"2026-10-18T13:00:00","slug":"disabling-ie-enhanced-security-windows","status":"publish","type":"post","link":"https:\/\/vpslake.com\/blog\/2026\/10\/18\/disabling-ie-enhanced-security-windows\/","title":{"rendered":"How to Disable IE Enhanced Security on Windows Server"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">To disable IE Enhanced Security on Windows Server, change the setting in Server Manager and turn off protection for the user groups that need it. The process takes about two minutes and lets approved sites or legacy management tools load without the repeated security prompt.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Prerequisites<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>A Windows Server installation with Desktop Experience, such as Windows Server 2012 R2, 2016, 2019, 2022, or 2025. The menu names can vary slightly between releases.<\/li>\n\n\n<li>An RDP session using the local Administrator account or another account with local administrator rights. You can use a <a href=\"https:\/\/vpslake.com\/buy-windows-rdp\">Windows VPS with administrator access<\/a> if you need a fresh server for testing.<\/li>\n\n\n<li>A specific reason for changing the setting, such as a trusted vendor portal or an older administration tool. IE Enhanced Security Configuration reduces exposure to unsafe web content, so do not switch it off merely to browse the web casually.<\/li>\n\n\n<li>A tested backup or snapshot if the server is production-critical. The change is reversible, but a snapshot gives you a quick recovery option before changing server security settings.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Step 1: Open the Local Server properties<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Server Manager exposes IE Enhanced Security Configuration as a local server property, so you can change the setting without editing the registry.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Sign in to the server through RDP with an administrator account.<\/li>\n\n\n<li>Open <strong>Start \u2192 Server Manager<\/strong>. If Server Manager is already open, select its window.<\/li>\n\n\n<li>In the left navigation pane, select <strong>Local Server<\/strong>.<\/li>\n\n\n<li>Wait for the properties panel to finish loading. Locate <strong>IE Enhanced Security Configuration<\/strong> in the <strong>Properties<\/strong> area.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">The value normally reads <strong>On<\/strong> for administrators and users. Select the value, not the nearby Windows Firewall or Internet Options setting; those controls manage different security layers.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 2: Turn off IE Enhanced Security Configuration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The dialog separates administrator protection from standard-user protection, allowing you to make the smallest change that solves the access problem.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>In <strong>Server Manager \u2192 Local Server<\/strong>, select the <strong>On<\/strong> value beside <strong>IE Enhanced Security Configuration<\/strong>.<\/li>\n\n\n<li>In the <strong>Internet Explorer Enhanced Security Configuration<\/strong> window, select <strong>Off<\/strong> under <strong>Administrators<\/strong>.<\/li>\n\n\n<li>Select <strong>Off<\/strong> under <strong>Users<\/strong> only if standard users also need to open the affected site or application. Leaving <strong>Users<\/strong> on is safer when only administrators need access.<\/li>\n\n\n<li>Select <strong>OK<\/strong> to save the change.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">You should now see <strong>Off<\/strong> for the group or groups you changed in the Local Server properties. Microsoft describes these two settings as administrator and user controls: when enabled, IE ESC limits exposure to web pages outside the Local Intranet and Trusted Sites zones. See the <a href=\"https:\/\/learn.microsoft.com\/en-us\/windows-hardware\/customize\/desktop\/unattend\/microsoft-windows-ie-esc\" target=\"_blank\" rel=\"noopener\">Microsoft IE ESC configuration reference<\/a> for the scope of each setting.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Step 3: Restart the affected browser or tool<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Existing browser processes can retain the previous security context, so close the affected application before testing the new setting.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Close every Internet Explorer or legacy browser window opened under the affected account.<\/li>\n\n\n<li>Close the vendor application or management console that was displaying the warning.<\/li>\n\n\n<li>Open a new browser window or restart the application.<\/li>\n\n\n<li>Visit only the approved HTTPS address that required the change. Do not use this setting as a reason to open unknown downloads or untrusted sites.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">On newer Windows Server releases, Internet Explorer is retired or unavailable as a general-purpose browser. In that case, use Microsoft Edge for normal browsing and use IE mode only when a documented legacy application requires it. Disabling IE ESC does not restore Internet Explorer or make an incompatible website work in Edge.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Verify the setting<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The Local Server page is the authoritative visual check for this change.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n\n<li>Return to <strong>Server Manager \u2192 Local Server<\/strong>.<\/li>\n\n\n<li>Confirm that <strong>IE Enhanced Security Configuration<\/strong> shows <strong>Off<\/strong> for the intended groups.<\/li>\n\n\n<li>Open the approved site or application in a new session and confirm that the original IE Enhanced Security warning is gone.<\/li>\n\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Expected status in Server Manager:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>IE Enhanced Security Configuration\nAdministrators: Off\nUsers: Off<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">If you intentionally disabled protection for administrators only, the expected result is <strong>Administrators: Off<\/strong> and <strong>Users: On<\/strong>. If the site still fails after this check, the cause is probably TLS, proxy, authentication, SmartScreen, application compatibility, or a separate security policy rather than IE ESC.<\/p>\n\n\n\n<aside class=\"vl-element vl-cta-banner\" aria-label=\"Get a ready Windows VPS\">\n\t<div class=\"vl-cta-banner__content\">\n\t\t<p class=\"vl-cta-banner__eyebrow\">Windows Server access<\/p>\n\t\t<h3 class=\"vl-cta-banner__title\">Get a ready Windows VPS<\/h3>\n\t\t<p class=\"vl-cta-banner__text\">Use administrator access to configure trusted browser and server tools on a fresh Windows VPS.<\/p>\n\t<\/div>\n\t<a class=\"vl-cta-banner__button\" href=\"\/buy-windows-rdp\" aria-label=\"View Windows VPS\">View Windows VPS<\/a>\n<\/aside>\n\n\n\n<h2 class=\"wp-block-heading\">Troubleshooting<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">The setting changes back to On<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">A domain Group Policy, security baseline, provisioning script, or hosting image may be restoring the hardened value. Open <strong>Windows PowerShell<\/strong> as an administrator and run <code>gpresult \/r<\/code> to see whether the server is receiving computer policies, then ask the domain administrator to approve the exception or change the baseline.<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>gpresult \/r<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Look for the <strong>Applied Group Policy Objects<\/strong> section in the output. If the server is managed by an organization, do not repeatedly force the local setting; the central policy will overwrite it again.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The IE Enhanced Security Configuration dialog is unavailable<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">You may be connected with a standard account, using Server Core, or viewing a remote server that is not the one you intended to change. Reconnect with a local administrator, confirm that <strong>Local Server<\/strong> is selected, and make sure the RDP session is connected to the correct hostname. Server Core has no normal Server Manager desktop workflow, so use the organization\u2019s approved unattended configuration or management policy instead of copying registry commands from an unrelated Windows release.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">The warning remains after selecting Off<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The old browser process may still be open, or the warning may come from a different account. Close all affected browser windows, sign out and back in if necessary, and test with the same administrator or user account whose setting you changed. Then refresh <strong>Server Manager \u2192 Local Server<\/strong> to ensure the displayed value still says <strong>Off<\/strong>.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">A website is still blocked even though IE ESC is Off<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">IE ESC is only one part of Windows browser security. A blocked page can instead be caused by an invalid certificate, TLS incompatibility, proxy authentication, Windows Defender SmartScreen, a firewall, or the application\u2019s own allowlist. Check the exact error and fix that layer; do not disable Defender, TLS validation, or the Windows firewall as a workaround.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Hardening<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n\n<li>Turn IE ESC back on when the legacy task is complete. Set <strong>Administrators<\/strong> and <strong>Users<\/strong> to <strong>On<\/strong> in <strong>Server Manager \u2192 Local Server \u2192 IE Enhanced Security Configuration<\/strong>.<\/li>\n\n\n<li>Prefer Microsoft Edge for supported sites and keep Windows Server patched. Use IE mode only for a known application with a documented compatibility requirement.<\/li>\n\n\n<li>If only one vendor portal needs access, ask the application owner whether a supported Edge workflow or a narrowly scoped trusted-site policy is available instead of lowering protection for every user.<\/li>\n\n\n<li>Record who approved the exception, which account needed it, and when the setting should be restored. This prevents a temporary browser workaround from becoming an unnoticed server baseline.<\/li>\n\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">FAQ<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">What does IE Enhanced Security Configuration protect?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">IE ESC hardens Internet Explorer by limiting how web content from Internet and other less-trusted zones interacts with the server. Microsoft exposes separate controls for administrators and standard users, so the risk reduction can differ by account type.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Does turning off IE ESC disable Windows Defender?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">No. This setting changes Internet Explorer\u2019s enhanced security behavior; it does not turn off Microsoft Defender Antivirus, Windows Firewall, SmartScreen, or Windows Update. Those controls should remain enabled.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Do I need to restart Windows after changing IE ESC?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Usually not. Close and reopen the affected browser or application so it creates a new process with the updated setting. Sign out and back in only if the warning persists for the same account after a full application restart.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Can I disable IE ESC only for administrators?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Yes. In the configuration dialog, select <strong>Off<\/strong> for <strong>Administrators<\/strong> and leave <strong>Users<\/strong> set to <strong>On<\/strong>. This is the narrower option when a server administrator needs a legacy portal but standard users do not.<\/p>\n\n\n\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"What does IE Enhanced Security Configuration protect?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"IE ESC hardens Internet Explorer by limiting how web content from Internet and other less-trusted zones interacts with the server. Microsoft exposes separate controls for administrators and standard users, so the risk reduction can differ by account type.\"}}, {\"@type\": \"Question\", \"name\": \"Does turning off IE ESC disable Windows Defender?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"No. This setting changes Internet Explorer\u2019s enhanced security behavior; it does not turn off Microsoft Defender Antivirus, Windows Firewall, SmartScreen, or Windows Update. Those controls should remain enabled.\"}}, {\"@type\": \"Question\", \"name\": \"Do I need to restart Windows after changing IE ESC?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Usually not. Close and reopen the affected browser or application so it creates a new process with the updated setting. Sign out and back in only if the warning persists for the same account after a full application restart.\"}}, {\"@type\": \"Question\", \"name\": \"Can I disable IE ESC only for administrators?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Yes. In the configuration dialog, select **Off** for **Administrators** and leave **Users** set to **On**. This is the narrower option when a server administrator needs a legacy portal but standard users do not.\"}}]}<\/script>\n\n","protected":false},"excerpt":{"rendered":"Disable IE Enhanced Security on Windows Server from Server Manager, verify the change, fix common policy issues, and restore protection safely.","protected":false},"author":1,"featured_media":868,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"csco_singular_sidebar":"","csco_page_header_type":"","csco_page_load_nextpost":"","footnotes":""},"categories":[5,11],"tags":[62,51,87,42],"class_list":["post-867","post","type-post","status-publish","format-standard","has-post-thumbnail","category-guides","category-windows-server","tag-internet-explorer","tag-security","tag-server-manager","tag-windows-server","cs-entry"],"_links":{"self":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/867","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/comments?post=867"}],"version-history":[{"count":1,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/867\/revisions"}],"predecessor-version":[{"id":3629,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/posts\/867\/revisions\/3629"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media\/868"}],"wp:attachment":[{"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/media?parent=867"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/categories?post=867"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/vpslake.com\/blog\/wp-json\/wp\/v2\/tags?post=867"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}