Figure 1 - Where is the Enhanced Security Configuration for Internet Explorer in Windows Server 2008 - Server Manager
Ever tried testing your application on Internet Explorer in a Windows Server environment and noticed that you just can’t browse like you do normally. In short, its “a pain in the ass”! (pardon my French) because IE just keeps buging you at every single URL that you enter – and not just once… but 3-4 times for a single website. And in order to see the looks of that website, you have to keep adding in the “trusted zone” in the dialog box that appears all the time! But anyway, enough of this whining now, lets get down to some business.
Well, today I was really determined to stop all those nonsensical security alerts so first I went to where common sense leads you to – Yeah you’re right, I went to the Internet Options –> Security Tab –> Internet Zone to turn down the security level. But when you go there, it appears disabled (grayed-out), so obviously you can’t change that like the way you’d usually expect! (Wonder why Microsoft did it that way?!?! But anyway…)
Figure 2 - Internet Explorer Enhanced Security Configuration
So going to the good ol’ Google for help and reading a document on Microsoft, I cam to know that all you need to do, is to fire up Server Manager (usually it sits in the Quick Launch bar but you can also go to Control Panel –> hit Classic view –> Programs and Features –> Turn Windows features on or off). Once you’re there, you’d see the screen similar to Figure 1 above. In that just hit the link Configure IE ESC. Next up, you’d see the screen in figure 2 on the right. Just turn the IE Enhanced Security Configuration (IE ESC) off for the administrators. It is recommended however, that you do turn it back on when you put the server into production. After you’re done with that you can go back to Internet Explorer –> Internet Options –> Security tab –>Internet zone and bring it down to medium-low. Now you can browse as usual.
I hope you find this post useful although it seems like a very trivial issue yet its quite annoying when you’re in a hurry or something.
So keep the feedback coming in, I’d be more than
happy to hear from ya!
#1 by Mike Morearty on March 1, 2011 - 7:29 AM
Thanks for posting this! I just set up an Amazon EC2 instance, and was struggling with this. I felt handcuffed by Internet Explorer, but this post helped me out.
#2 by J.H. on May 31, 2011 - 6:51 PM
Thank you very much…this was driving me insane. I didn’t want to start modifying the registry unless I had to, so it’s nice to know MS put in something like this (although why they continue to handcuff administrators is mind boggling, security concerns or not…if someone’s going to hack it, they’re going to hack it…let the admins worry about that but give them the tools they need to do their jobs).
#3 by Imran Akram on June 1, 2011 - 8:18 AM
Totally agree with you J.
#4 by Tim Melton on June 5, 2011 - 3:29 PM
Thanks for the help. In my case it would still only go down to medium.
#5 by John A on June 15, 2011 - 8:23 PM
Excellent – thanks, this too was driving me NUTS. Incredible that MS makes this so difficult to find / do.
#6 by Ben on June 27, 2011 - 9:17 PM
Thanks a ton, I have been looking for this option for a while. Other posts I read didn’t tell where the Configure IE ESC was located, just that was where you turned it off. So, again thanks for showing us where it is.
#7 by Imran Akram on June 27, 2011 - 10:33 PM
My pleasure
Thanks a lot for your feedback
#8 by daniel.d.k on August 23, 2011 - 5:29 PM
Thanks! Quickbooks didn’t worked before I changed it, you’re great.
#9 by coolguy on September 29, 2011 - 4:41 PM
Imran, thanks for putting up this article. Well done!
#10 by Imran Akram on September 30, 2011 - 8:02 AM
Thanks a lot buddy, glad u like it!
#11 by Mark on November 15, 2011 - 11:42 AM
Just to say thanks for this, I needed to do this last night but now I know how
#12 by Todd B on November 23, 2011 - 5:58 PM
Thanks for this…I installed Server 2008 five months ago, and for five months I’ve been looking for the answer to this! Obviously, I was looking in the wrong place for the solution, lol.
#13 by Imran Akram on November 24, 2011 - 3:49 PM
Glad it helped you Todd
#14 by Muhammad on January 24, 2012 - 4:52 PM
Thanks a lot, it was a great help!!!!!
#15 by Tech on February 2, 2012 - 6:44 PM
Hi Imram Akram, I am not sure if you can help or look at your blog anymore but:
We have a Windows 2008 R2 server used for remote access and terminal services. So having ESC turned off is a must in order for the users to actually do anything in Internet Explorer. We have dozens of GPO’s to cope with security for our servers. However, whenever they browse the internet, almost any site they need to use blocks them and notifies them they need cookies enabled to continue. Windows 2008 R2 reports that ESC is turned off – so we went into GPO to modify IE settings for the default users which is the Internet Explorer Maintenance —> Security —> Security Zone and Privacy Settings.
After clicking to import settings, we can’t slide the security zone bar up or down for the Internet Zone. I believe we can change the privacy stuff to allow cookies but I think we will run into more trouble because our internet zone is set to max with protected mode. I think this has something related to ESC (we verified that it ‘shows’ off), but do you know why we cant’ modify the security zones here?
Thanks in advance
#16 by Imran Akram on February 3, 2012 - 4:19 PM
Hi there,
Its hard for me to say much from here since I haven’t worked with GPO’s in this regard but I think this problem may as well be caused by one group policy overwriting/overriding another one in the same domain perhaps. Or you should perhaps try to turn off ESC for users as well and see what it does. But do keep me posted as well when you do find a solution to this because its new for me as well
All the best!
#17 by mytechlifedays on February 6, 2012 - 7:47 AM
Thank You very much for this post! This IE setting was somewhat kind of a show stopper for me !… and it worked with the solution in your post !
#18 by Jamie on February 21, 2012 - 6:28 PM
THANK YOU.