Toolkit to Disable Automatic Delivery of Internet Explorer 8

Overview

To help our customers become more secure and up-to-date, Microsoft will distribute Windows Internet Explorer 8 as a high-priority update through Automatic Updates for Windows XP Service Pack 2 (SP2) and higher, Windows XP Professional x64 Edition, Windows Server 2003 SP2 for x64 and x86, Windows Vista for x64 and x86, Windows Vista SP1 for x64 and x86, and Windows Server 2008 for x64 and x86. This Blocker Toolkit is intended for organizations that would like to block automatic delivery of Internet Explorer 8 to machines in environments where Automatic Updates is enabled. The Blocker Toolkit will not expire.

For computers running Windows XP or Windows Server 2003, the Blocker Toolkit prevents the machine from receiving Internet Explorer 8 as a high-priority update via Automatic Updates and the Express install option on the Windows Update and Microsoft Update sites; Internet Explorer 8 will be listed as an optional update with the Custom install option.
For computers running Windows Vista or Windows Server 2008, the Blocker Toolkit prevents the machine from receiving Internet Explorer 8 as an important update via Automatic Updates on the Windows Update and Microsoft Update sites; Internet Explorer 8 will be listed as an optional update.
The Blocker Toolkit will not prevent users from manually installing Internet Explorer 8 as a Recommended update from the Windows Update or Microsoft Update sites, from the Microsoft Download Center, or from external media.
Organizations do not need to deploy the Blocker Toolkit in environments managed with an update management solution such as Windows Server Update Services or Systems Management Server 2003. Organizations can use those products to fully manage deployment of updates released through Windows Update and Microsoft Update, including Internet Explorer 8, within their environment.
If you used the Blocker Toolkit to block Internet Explorer 7 from being installed as a high-priority update, you need to use the Internet Explorer 8 version of the Blocker Toolkit to block Internet Explorer 8 from being installed. There are different registry keys used to block or unblock automatic delivery of Internet Explorer 7 and Internet Explorer 8.

Toolkit Components

This toolkit contains two components:

An executable blocker script
A Group Policy Administrative Template (.ADM file)

Supported Operating Systems

Windows XP Service Pack 2 (SP2) and higher, Windows XP Professional x64 Edition, Windows Server 2003 SP2 for x64 and x86, Windows Vista for x64 and x86, Windows Vista SP1 for x64 and x86, and Windows Server 2008 for x64 and x86

Blocker Script

The script creates a registry key and sets the associated value to block or unblock (depending on the command-line option used) automatic delivery of Internet Explorer 8 on either the local machine or a remote target machine.

Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\8.0

Key value name: DoNotAllowIE80

Value	Result
Key is not defined	Distribution is not blocked.
0	Distribution is not blocked.
1	Distribution is blocked.

The script has the following command-line syntax:

IE80Blocker.cmd [<machine name>] [/B] [/U] [/H]

Machine Name

The <machine name> parameter is optional. If not specified, the action is performed on the local machine. Otherwise, the remote machine is accessed through the remote registry capabilities of the REG command. If the remote registry can't be accessed due to security permissions or the remote machine can't be found, an error message is returned from the REG command.

Switches

Switches used by the script are mutually exclusive and only the first valid switch from a given command is acted on. The script can be run multiple times on the same machine.

Switch	Description
/B	Blocks distribution
/U	Unblocks distribution
/H (or /?)	Displays the following summary help: This tool can be used to remotely block or unblock the delivery of Internet Explorer 8 through Automatic Updates. ------------------------------------------------------------ Usage: IE80Blocker.cmd [<machine name>] [/B][/U][/H] B = Block Internet Explorer 8 deployment U = Allow Internet Explorer 8 deployment H = Help Examples: IE80Blocker.cmd mymachine /B (blocks delivery on machine "mymachine") IE80Blocker.cmd /U (unblocks delivery on the local machine) ------------------------------------------------------------

Group Policy Administrative Template (.ADM file)

The Group Policy Administrative Template (.ADM file) allows administrators to import the new Group Policy settings to block or unblock automatic delivery of Internet Explorer 8 into their Group Policy environment, and use Group Policy to centrally execute the action across systems in their environment.

After adding this administrative template to the Group Policy Editor, you must clear the Only show policy settings that can be fully managed option in the Filtering dialog box before the new policy becomes visible in the Group Policy Editor. This option is found by highlighting Administrative Templates, selecting View, and then selecting Filtering.

Users running Windows XP or Windows Server 2003 will see the policy under Computer Configuration / Administrative Templates / Windows Components / Windows Update / Automatic Updates Blockers v2. Users running Windows Vista or Windows Server 2008 will see the policy setting under Computer Configuration / Administrative Templates / Classic Administrative Templates (ADM) / Windows Components / Windows Update / Automatic Updates Blockers v2. This setting is available only as a Computer setting; there is no Per-User setting.

Note: This registry setting is not stored in a policies key and is thus considered a preference. Therefore if the Group Policy Object that implements the setting is ever removed or the policy is set to Not Configured, the setting will remain. To unblock distribution of Internet Explorer 8 by using Group Policy, set the policy to Disabled.

Related Resources

1. Internet Explorer 8 Blocker Toolkit Q&A

2. Internet Explorer 8 via Automatic Updates

3. Internet Explorer 7 Blocker Toolkit Download

4. Internet Explorer Product Site

5. Readiness Toolkit for Developers, Testers & ITPros

6. Microsoft Update Management Solutions

7. Application Compatibility Tools