Internet Explorer Enhanced Security Configuration

Internet Explorer Enhanced Security Configuration places your server and Microsoft Internet Explorer in a configuration that decreases the exposure of your server to potential attacks that can occur through Web content and application scripts. As a result, some Web sites may not display or perform as expected.

For more information, see the following:



Internet Explorer Security Zones

In Internet Explorer, you can configure security settings for several built-in security zones: the Internet zone, the Local intranet zone, the Trusted sites zone, and the Restricted sites zone. Internet Explorer Enhanced Security Configuration assigns security levels to these zones as follows:

Return to top



How to browse when Internet Explorer Enhanced Security Configuration is enabled

The enhanced security configuration increases the level of security on your server, but may also affect Internet browsing in the following ways:

Return to top



Effects of Internet Explorer Enhanced Security Configuration

Internet Explorer Enhanced Security Configuration adjusts the security levels for the existing security zones. The following table describes how each zone is affected.

Zone Security level Result
Internet zone High This zone has the same security settings as the Restricted sites zone. All Internet and intranet sites are assigned to this zone by default.

Web pages may not display in Internet Explorer as expected and applications that require the browser may not work correctly because scripts, Microsoft ActiveX controls, the Microsoft virtual machine (Microsoft VM) for HTML content, and file downloads have been disabled. If you trust an Internet site and need it to be functional, you can add that site to the Trusted sites zone in Internet Explorer. For more information, see Add sites to the Trusted sites zone.

Local intranet zone Medium-Low When visiting intranet sites, you may be repeatedly prompted for credentials (your user name and password) as a result of the enhanced security configuration. In the past, Internet Explorer automatically passed your credentials to intranet sites. The enhanced security configuration disables the automatic detection of intranet sites. If you want your credentials to be passed automatically to certain intranet sites, add those sites to the Local intranet zone. For more information, see Add sites to the Local intranet zone.

Do not add Internet sites to the Local intranet zone, because your credentials will be passed automatically to the site if they are requested.

Trusted sites zone Medium This zone is for the Internet sites whose content you trust. For more information, see Add sites to the Trusted sites zone.
Restricted sites zone High This zone contains sites you don't trust, such as sites that may damage your computer or data if you attempt to download or run files from them.

The enhanced security configuration also adjusts the Internet Explorer extensibility and security settings to further reduce exposure to possible future security threats. These settings can be found on the Advanced tab of Internet Options in Control Panel. The following table describes the settings that are affected.

Name Default setting Description
Enable third-party browser extensions Off Disables features you installed for use with Internet Explorer that may have been created by companies other than Microsoft.
Play sounds in Web pages Off Disables music and other sounds.
Play animations in Web pages Off Disables animations.
Check for server certificate revocation On Automatically checks a Web site's certificate to determine if the certificate has been revoked.
Do not save encrypted pages to disk On Disables saving secured information in your Temporary Internet Files folder.
Empty Temporary Internet Files folder when browser is closed On Automatically clears the Temporary Internet Files folder when IE is closed.
Warn if changing between secure and not secure mode On Displays a warning that the browser is redirecting from a secure Web site to a non-secure Web site.
Enable Memory Protection to help mitigate online attacks Off Enables Data Execution Prevention (DEP) to help mitigate online attacks.

These changes reduce the functionality in Web pages, Web-based applications, local network resources, and applications that use a browser to display online help, support, and general user assistance.

For more information on using the Local intranet or Trusted sites zones' inclusion lists, see Managing Internet Explorer Enhanced Security Configuration.

When Internet Explorer Enhanced Security Configuration is enabled:

Effects of Internet Explorer Enhanced Security Configuration on the Internet Explorer user experience

The following table describes how Internet Explorer Enhanced Security Configuration affects each user's experience with Internet Explorer.

Task Can be completed by
Administrators? Power Users? Limited Users? Restricted Users?
Turn on/off Internet Explorer Enhanced Security Configuration Yes No No No
Adjust the security level for a particular zone in Internet Explorer Yes Yes No No
Add sites to the Trusted sites zone Yes Yes Yes Yes
Add sites to the Local intranet zone Yes Yes Yes Yes

All other Internet Explorer tasks can be completed by all user groups, unless the server administrator chooses to further restrict user access.

Return to top



Managing Internet Explorer Enhanced Security Configuration

Internet Explorer Enhanced Security Configuration is designed to reduce your server's exposure to security threats. To ensure that you get the most benefit from the enhanced security configuration, consider these browser management recommendations:

Add sites to the Trusted sites zone

When Internet Explorer Enhanced Security Configuration is enabled on your server, the security settings for all Internet sites are set to High. If you trust a Web page and need it to be functional, you can add that page to the Trusted sites zone in Internet Explorer.

  1. Navigate to the site that you want to add.
  2. On the File menu, click Add this site to, and then click Trusted Sites Zone.
  3. In the Trusted sites dialog box, click Add to move the site to the list, and then click Close.
  4. Refresh the page to view the site from its new zone.
  5. Check the Status bar of the browser to confirm that the site is in the Trusted sites zone.

Notes

Add sites to the Local intranet zone

When Internet Explorer Enhanced Security Configuration is enabled, the security settings for all intranet sites are set to High. As a result, you are prompted for your credentials (your user name and password) each time you visit intranet sites that have not been added to the Local intranet zone. If you routinely use intranet sites, and you know those sites are trustworthy, you can add them to the Local intranet zone in Internet Explorer.

  1. Navigate to the site that you want to add.
  2. On the File menu, click Add this site to, and then click Local Intranet Zone.
  3. In the Local intranet dialog box, click Add to move the site to the list, and then click Close.
  4. Refresh the page to view the site from its new zone.
  5. Check the Status bar of the browser to confirm that the site is in the Local intranet zone.

Notes

Apply Internet Explorer Enhanced Security Configuration to specific users

Internet Explorer Enhanced Security Configuration allows you to control the level of Internet Explorer access allowed to certain user groups on your server.

To enable IE ESC for all users

  1. Close all instances of Internet Explorer.
  2. Click Start, point to Administrative Tools, and then click Server Manager.
  3. If a User Account Control dialog box appears, click Continue.
  4. Under Security Summary, click Configure IE ESC.
  5. Under Administrators, click On (Recommended).
  6. Under Users, click On (Recommended).
  7. Click OK.
  8. To disable IE ESC, click Off for both Administrators and Users, and then click OK.

Notes

Strengthen Internet Explorer security settings manually on your server

If you do not use Internet Explorer Enhanced Security Configuration in your environment, you can easily strengthen Internet Explorer by using Internet Options in Control Panel to manually raise the security settings on your server.

  1. Open Internet Explorer.
  2. On the Tools menu, click Internet Options.
  3. On the Security tab, select the Web content zone you want to adjust: Internet, Local intranet, Trusted sites, or Restricted sites.
  4. Under Security level for this zone, click Default Level to use the default security level for the zone, or click Custom Level and then select the settings you want.

Notes



Browser Security — Best Practices

Using servers for Internet browsing does not adhere to sound security practices because Internet browsing increases the exposure of your server to potential security attacks. Regardless of the browser you use, you should restrict browsing on your server.

To reduce the risk to your server of potential attacks from malicious Web-based content:

Return to top