The Sysadmins

Tips and tricks from the Sysadmins

Group Policy – Internet Explorer 11 Group Policy Preferences

With Internet Explorer 11 being released a couple of days ago for Windows 7 / Server 2008 R2 and Internet Explorer Maintenance being deprecated since IE10- you’re going to want to use one of the alternative methods (Group Policy Preferences, Administrative Templates or the Internet Explorer Administration Kit) to configure Internet Explorer for your organisation. If you’re used to configuring Internet Explorer with Group Policy Preferences, you’ll be thinking “not a problem” and install IE11 onto an administration machine or a server assuming it will add the option to create a new GPP for Internet Explorer 11. This is what you’ll see if you try that.

Note – You will need Windows 8 / Server 2012 or above with RSAT to see the Group Policy preference settings for Internet Explorer 10.

Group Policy Preferences Internet Explorer 10

Where is the option to add an Internet Explorer 11 Group Policy Preference Internet Settings Policy?

There is no option. The Internet Explorer 10 option actually covers Internet Explorer from version 10 to … 99! That’s right 99. To prove this and to visually confirm this is the case, create a policy by using Internet Explorer 10 Internet Settings and find the unique ID of the GPO.

IE11GPP

Browse to \\DC\SYSVOL\Domain\Policies\uniqueID\User\Preferences\InternetSettings and open the InternetSettings XML document in notepad. Note the 5th line which states version 10.0.0.0 -> 99.0.0.0.

IE10 GPP Internet Settings

If you’re looking to use Group Policy Preferences to configure Internet Explorer 11, using the Internet Explorer 10 Internet Settings option will work for version 11 and future releases of Internet Explorer.

13 Comments

  1. Uh, this has been driving me nuts over the last week… Why do this Microsoft? It strikes me as incredibly lazy…
    Thanks for the info.

  2. Great article. Thanks.

  3. Great article…had me searching around for a while.

    Thanks.

  4. Should i be worried that my server is running IE 11, but in the GPME it displays

    NEW -> Internet Explorer 5 and 6
    Internet Explorer 7
    Internet Explorer 8

    And nothing else?

    • Tom@thesysadmins.co.uk

      August 7, 2015 at 7:06 pm

      TWAdmin, you need Windows 8+ or Server 2012+ with RSAT to manage IE10 GPP policy settings. What you’re seeing is correct on Server 2008 R2.

      • Gary Andriotis

        March 1, 2016 at 8:42 pm

        I have 2008r2 with IE11. I installed the latest IE ADM/MX and I cannot seem to manage IE11 browsers.

        What is the best course of action? I cant seem to think that I would need to upgrade the server to 2012 just for a policy.

        • Tom@thesysadmins.co.uk

          March 1, 2016 at 9:33 pm

          Gary, see my reply above. There’s no way to get those options on 2008 R2. Easiest way to enable access to those policies is to use a Windows 8 machine (or above) with RSAT installed.

          • So your suggestion is to go around to 500 computers and individually install this RSAT what ever the hell that is? No thanks. Not even close to a proper solution, and spending 1000’s on new serves to keep up-to-date with web browser is about as ridiculous of a solution to date. MS is beyond lazy with these browser updates, they seem to fail to look at the bigger picture, which is I’m sure is on purpose.

            • Tom@thesysadmins.co.uk

              March 21, 2016 at 7:32 pm

              No. The cheapest solution is to have one Windows 8 or above machine with RSAT installed (Remote Server Administration Tools) to manage the policy. You do not have to install RSAT onto the machines you are trying to manage.

              • Tom,

                I have 6 DCs, 2 of them are 2012 and I can see the IE 10 option. However, the other 4 servers are 2008R2 and they only show IE 5,6,7 and 8.

                My question is, if I create a IE Preference for Windows 10 on the 2012DCs, will it be processed anyway even though the users get connected to the old 2008R2 DCs ??

                • Tom@thesysadmins.co.uk

                  June 27, 2016 at 6:43 pm

                  Yes, the policy will still be applied.

                  • Hey Tom!

                    Are you completely sure it will be applied anyway ? I just made a policy (modifying some proxy settings) using a 2012 DC, I created 2 settings, one for IE 10 and another for IE 8/9.. since our company is using either IE 8 and IE 11. After doing it, I checked on the xml file locally, and I could see both texts, one that says “min 10 max 99” and the other one at the bottom that says “min 8 max 10”.
                    So that’s cool.

                    Thing is, I went to check the same xml file on one of the 2008DCs and the only text that was copied to that SYSVOL was the “min 8 max 10” version. That means the only portion of the policy that was copied to the 2008 SYSVOL was the IE 8/9 one.

                    What should I do ? Thanks!!!!!

  5. Oh god, it was just a matter of text formatting!!! Goshh!!! 😛
    Forget about the latter message, the text on the XML is copied entirely on all DCs, no matter if the DC is either 2008 or 2012.

    I will try out the policy with 2 Lab PCs we have (one with IE8 and the other with IE11). I will let you know the outcome. Thanks!!!!!

Leave a Reply

Your email address will not be published.

*

This site uses Akismet to reduce spam. Learn how your comment data is processed.