18.10.34.1 (L1) Ensure 'Disable Internet Explorer 11 as a standalone browser' is set to 'Enabled: Always'

Information

This policy setting restricts the launching of Internet Explorer as a standalone browser.

This setting performs the following actions when enabled:

- Prevents Internet Explorer 11 from launching as a standalone browser.
- Restricts Internet Explorer's usage to Microsoft Edge's native

Internet Explorer mode

.
- Redirects all attempts at launching Internet Explorer 11 to Microsoft Edge Stable Channel browser.
- Overrides any other policies that redirect to Internet Explorer 11.

The recommended state for this setting is: Enabled: Always

Official support for Internet Explorer (IE) 11 desktop applications (workstation) ended on June 22, 2022. Unsupported software could contain vulnerabilities that are left unpatched. Unpatched vulnerabilities can lead to application weaknesses that could allow attackers to leverage the security vulnerability by running malicious code.

Solution

To establish the recommended configuration via GP, set the following UI path to Enabled: Always :

Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Disable Internet Explorer 11 as a standalone browser

Note: This Group Policy path is provided by the Group Policy template InetRes.admx/adml that is included with the Microsoft Windows 10 Release 21H1 Administrative Templates (or newer).

Impact:

Users will no longer be able to launch IE 11 and will be redirected to Microsoft Edge.

Note: IE 11 is still supported on Windows 10 LTSC and Windows Server versions.

Note #2: On February 14, 2023, a

Microsoft Edge update

disabled IE 11 on Windows 10 (except those mentioned above).

See Also

https://workbench.cisecurity.org/benchmarks/16514

Item Details

Category: CONFIGURATION MANAGEMENT, SYSTEM AND COMMUNICATIONS PROTECTION

References: 800-53|CM-10, 800-53|SC-18, CSCv7|7.1

Plugin: Windows

Control ID: e9720753480f8d748e79f58ba1d8a133374c20b6f3057ef1d5375cf47bfb78ca