My IE11 Removal Journey

[Michael]

Hi all,

 

Thought I'd share my experience of removing IE11 in a network domain. For this example, I'm using Windows 10 x64, Google Chrome x86 and Word 2016 x86.

 

First Step

 

First thing's first, you should have an answer file for Chrome extensions -

 

 

It's OK to save this in your Netlogon share and configure the GPO - Computer Config > Policies > Admin Templates > Windows Components > File Explorer > Set a default associations configuration file

 

Specify \\servername\netlogon\File_Associations.XML for example.

 

Second Step

 

Within your nominated GPO, navigate to Computer Config > Preferences > Windows Settings > Registry

 

Create the following GPP regedits -

 

Path: HKLM\SOFTWARE\Classes\htmlfile\shell\open\command
Value: (Default)
Type: REG_SZ
Data: "C:\Program Files (x86)\Google\Chrome\Application\Chrome.exe" %1

 

This registry entry will allow hyperlinks to continue working in Word 2016, otherwise you'll see the following error -

 

Your organization's policies are preventing us from completing this action (or similar).

 

Path: HKLM\SOFTWARE\Wow6432Node\Microsoft\Office\9.0\Common\Internet
Value: ForceShellExecute
Type: REG_DWORD
Data: 1

 

This registry key will also allow hyperlinks to continue working in Word 2016, otherwise you'll see the following error -

 

Unable to open https://example.com Cannot download the information you requested (or similar).

 

Third Step

 

House keeping - make sure all your shortcuts for users are pointing to Chrome, for example in the Target field -

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" https://www.google.co.uk/

 

Fourth Step

 

Removing Internet Explorer can be achieved in various ways, but here's the command I used -

 

@echo off
If not exist "C:\Program Files (x86)\Internet Explorer\iexplore.exe" goto :exit
dism /Online /Disable-Feature /Quiet /NoRestart /FeatureName:Internet-Explorer-Optional-amd64
:exit

 

Again you can save this within your Netlogon share as a .bat extension, then navigate to: Computer Config > Policies > Windows Settings > Scripts Startup/Shutdown > Startup

 

Specify \\servername\netlogon\RemoveIE11.bat for example.

 

This'll take a few restarts, but is completely transparent to the end user. IE11 is then seamlessly removed as an optional feature for good, however aspects of it will still exist within Control Panel for other browsers to use.

 

The other way to tell is navigating to C:\Program Files (x86)\Internet Explorer, you'll see there's no iexplore.exe which is why I've configured the script to look for it or skip as required.

 

Recommended - so long as Computer Config > Policies > Admin Templates > System > Logon - Always wait for the network at computer startup and logon is enabled, this script (and others) have a much better chance running sooner.

 

Fifth Step

 

For Birmingham Schools I've actioned this for all user levels - Pupils, Staff, and MIS - even the likes of HR Portal now works in Chrome, as it was the only service I was aware of which only supported IE.

 

I hope you find this guidance useful!

[tmoon-mint]

Thanks for sharing. At the moment I have just hidden IE as best I can using XML files for the start menu and default file associations to get rid of it. I took this approach expecting horror stories from people that removed it but your experience sounds quick and painless.

[jthompson]

Isn't IE11 automatically unfindable and unrunnable these days anyway? Seems strange that you would need to go to such trouble.

 

If you want to set Chrome as the default browser for everyone, the Group Policy guidance here works a treat - https://support.google.com/chrome/a/answer/7009292?hl=en

[Koldov]

IE 11 is very much both 'findable and runnable' here, not sure if it depends on which version of Windows 10 (or 11) you are running but one thing I noticed in the prerequisites for the GPO setting 'Disable Internet Explorer 11 as a standalone browser' is that you have to have Edge installed...

 

https://learn.microsoft.com/en-us/deployedge/edge-ie-disable-ie11

 

Prerequisites

The following Windows updates and Microsoft Edge software are required:

 

Windows updates

 

Windows 10, version 21H1 or later

Windows 10, version 2004; Windows Server version 2004; Windows 10, version 20H2; Windows Server version 20H2: KB4598291 or later

Windows 10 version 1909: KB4598298 or later

Windows Server 2019; Windows 10 Enterprise 2019 LTSC: KB4598296 or later

Windows Server 2016; Windows 10 Enterprise 2016 LTSB: KB4601318 or later

Windows 10 Enterprise 2015 LTSB: KB4601331 or later

Windows 8.1; Windows Server 2012 R2: KB4601384 or later

Windows Server 2012: KB4601348 or later

 

Microsoft Edge Stable Channel

 

We don't have Edge installed so maybe that is why.

[Michael]

Thanks both - for everyone's reference I do make Chrome the default also (once template files are imported) - User Config > Policies > Admin Templates > Google > Google Chrome - Set Google Chrome as Default Browser - Enabled

 

So what's motivated me to do this?

 

- I'm always looking at ways of lowering the surface area of attack (in general)

- Good practice to establish browser requirements/compatibility of a school/business

- Give end users the best browser experience

 

Microsoft's advice is forever confusing/contradictory + my thought process -

 

- IE support ended in June 2022

- Microsoft Edge with IE mode is the recommendation and is supported until 2029

- Microsoft will disable (not remove) IE on Windows SAC releases as of February 2023

- If you remove IE, (as per my guidance above), Edge with IE mode or Chrome with IE Tab will stop working

- This tells me the IE engine is still required and isn't really a true software emulation

- This also tells me Microsoft will still need to continue supporting/securing IE in some capacity, or will they?

- I suspect a new regedit or GPO will be required to re-enable IE as part of the February 2023 release (if required)

- Could IE in future be a new target for malware - similarly to Windows 7

- Removing IE if you've established isn't required for all or most users would seem a sensible approach

[jthompson]

Ah yes, of course. That would make sense. Windows 10 21H2 and 22H2 here.

[Michael]

An easy workaround to not having Edge installed is - User Config > Policies > Admin Templates > System - Don't run specified Windows applications - Enabled, enter - iexplore.exe

[Koldov]

Is the policy setting explanation for this ~GPO incorrect...?

 

Note: Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting.

Note: To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe).

 

EDIT: Does this also mess with Hyperlinks...?

Edited November 16, 2022 by Koldov

[Michael]

Is the policy setting explanation for this ~GPO incorrect...?

 

Note: Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting.

Note: To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe).

 

EDIT: Does this also mess with Hyperlinks...?

 

This GPO is the other way round - a list of allowed .exe's. Run Only specified Windows applications vs Don't run specified Windows applications (I use this one).

 

So long as you have Chrome installed and followed all my other steps, it should work fine. By all means test before deploying to the masses as always!

[Koldov]

You had me worried that I'd used the wrong one for a minute there... but it appears they both have the same 'note' at the bottom of the explanation.

 

Probably just a copy/paste error by someone at MS...

 

[Michael]

It definitely looks that way - your template files look newer than mine as the description's shorter.

[Michael]

Another request came in - XML files, but easily resolved as follows -

 

User Config > Preferences > Control Panel Settings > Folder Options > New > Open With, then populate as follows -

 

[Koldov]

Interesting... we have this for XML file type...

 

 

Looking through the 'Choose a default app for each type of file' there are still loads of random file types associated with IE. A lot of the basic ones are covered by making Chrome default or IIRC installing after removing IE can also help.

 

Going to 'Default apps > Set defaults by app > Internet Explorer > Manage', so there's a few I could change over, but some don't 'see' Chrome as an option to do it this way (.mht, .mhtml, .partial, .website, .MK, .RES).

 

[Michael]

All those extensions are in my file associations file, posted above

[Koldov]

Another request came in - XML files, but easily resolved as follows -

 

User Config > Preferences > Control Panel Settings > Folder Options > New > Open With, then populate as follows -

 

[ATTACH=CONFIG]67154[/ATTACH]

 

All those extensions are in my file associations file, posted above

 

Could you not just add XML to the file associations then, or are different people going to want to open them in different apps (and so easier to target with GPO)?

[Michael]

Could you not just add XML to the file associations then, or are different people going to want to open them in different apps (and so easier to target with GPO)?

 

Unfortunately no (if only it were that simple), but I think it had something to do with .xml not being listed as an extension within Control Panel > Default Programs > Associate a file type. This kind of makes sense, seeing as my Chrome answer file above is approving Chrome for all common/known extensions.

 

There probably is another way, but this GPP method was quick and easy.

[Michael]

The only issue I've found so far in removing IE, is Office Add-ins (if you use them).

 

 

We just need Microsoft to fix this propriety mess, as I'm not aware of a fix. Scroll down for the table of information and you'll see what I mean.

[clareq]

Following, as I'm seeing the Office Add-in error too.

[Michael]

Realistically I can't see there being a fix for a while, however I know Microsoft will be disabling IE early 2023 on most versions of Windows 10.

 

Logically Office Add-ins should stop working similarly when IE's disabled or IE's removed completely. It's not something I've tried.

[Chuckster]

If you use an .xml file to set default app associations, then you will want to add the following line:

 

[color=#881280][font=monospace][/font][/color]

 

This will ensure that the default browser is able to open URL shortcuts correctly, otherwise it will open in whichever browser displaying code and not the website.