Applies to: Windows Server 2016, 2019 and 2022 with Desktop Experience (Internet Explorer 11); notes for Windows Server 2025; steps from Microsoft’s documentation, as Windows can’t run in our Docker test lab
To turn off Internet Explorer Enhanced Security Configuration (IE ESC), open Server Manager, select Local Server, click the current value next to IE Enhanced Security Configuration, choose Off for Administrators, Users or both, select OK, then the Refresh icon. On Windows Server 2022 you often don’t need to: use Microsoft Edge, which is included, instead of Internet Explorer.
What IE ESC does
IE ESC is on by default on Windows Server. According to Microsoft it puts the Internet zone at the High security level, the Trusted sites zone at Medium and the Local intranet zone at Medium-low, and every site starts in the Internet zone. Scripts and ActiveX controls are blocked, so most modern websites don’t work properly in Internet Explorer, and it keeps asking whether to add sites to the Trusted sites zone. It also switches off browser extensions, animations and videos in web pages.
That is deliberate: a server is not meant for everyday browsing, and a malicious page opened as an administrator can do real damage.
Turn it off in Server Manager
- Type Server Manager in Windows search and open it.
- Select Local Server in the left pane.
- In the Properties list, find IE Enhanced Security Configuration and click the value next to it (On).
- In the dialog, choose Off under Administrators, Users or both, and select OK.
- Select the Refresh icon on the Server Manager toolbar to see the new setting.
A sensible middle ground is to switch it off for Administrators only while you do a task, and turn it back on afterwards. Keep it on for Users on a Remote Desktop server shared by several people.
From the command line
Microsoft’s FAQ on ESC contains a batch file for turning it off. Its core lines, in an elevated Command Prompt:
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}" /v "IsInstalled" /t REG_DWORD /d 0 /f
REG ADD "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}" /v "IsInstalled" /t REG_DWORD /d 0 /f
REG ADD "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap" /v "IEHarden" /t REG_DWORD /d 0 /f
The full batch file also resets further keys and runs Rundll32 iesetup.dll for users and administrators; copy it from Microsoft’s FAQ (linked below) if you script this for many servers. In a domain, Microsoft describes setting the IEHarden value to 0 under HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap with Group Policy Preferences (User Configuration, Preferences, Windows Settings, Registry).
Keep ESC on and trust one site
If you only need one site to work in Internet Explorer, add it to the Trusted sites zone. With ESC on, Internet Explorer offers this itself when a site tries to run scripts. Microsoft’s advice is to add a site only when you are sure it is trustworthy and the address is correct.
Windows Server 2022 and 2025
- The Internet Explorer 11 desktop app has been retired and out of support since 15 June 2022.
- Microsoft Edge is included with Windows Server 2022 (Desktop Experience), replacing Internet Explorer. ESC is an Internet Explorer setting, so Edge is the easier way to download something on the server.
- Microsoft removed the standalone Internet Explorer application from Windows Server 2025. For old sites that need it, Microsoft points to IE mode in Edge.
- On older versions where Internet Explorer is the only browser, turning ESC off for Administrators while you download a browser or installer, then back on, avoids the constant prompts.
Better: don’t browse on the server
Download installers on your own computer and copy them over the Remote Desktop connection, or fetch them directly in PowerShell with Invoke-WebRequest -Uri URL -OutFile FILE. That keeps the server’s attack surface small. New to your server? See connect to a Windows VPS with Remote Desktop and enable Remote Desktop from the command line. Our Windows VPS plans include the Windows Server licence.
Official documentation: FAQs about Enhanced Security Configuration, manage the Local Server in Server Manager and features removed in Windows Server 2025.
