|
Patch reliability is unclear. Unless you have an immediate, pressing need to install a specific patch, don't do it. |
In Internet Explorer, under About Internet Explorer, there is a check box with the description “Install new versions automatically”.
Does anybody know exactly what that check box does?
There are few results when searching on the internet, but none seems to have a definitive answer.
I had wondered about this for awhile also, so I researched it now.
From https://privacy.microsoft.com/en-us/ie11-win8-privacy-statement:
“If you receive updates automatically through Windows Update, you’ll receive updates to Internet Explorer, including upgrades to new versions. These updates are installed without interrupting you. If you would prefer to choose whether and when you receive an upgrade to a new version of Internet Explorer via Windows Update, you may do so.
If you turn off automatic version upgrades, you’ll still be offered a new version of Internet Explorer if you have Windows Update turned on, but it won’t be installed automatically.”
Here’s the way I interpret it (I didn’t test though):
1. This checkbox affects only those who receive updates automatically through Windows Update.
2. For those who receive updates automatically through Windows Update, if the checkbox is checked, then a major Internet Explorer version update is installed automatically with no user input.
3. For those who receive updates automatically through Windows Update, if the checkbox is unchecked, then a major Internet Explorer version available update triggers a prompt which allows the user to choose whether to install it or not.
More evidence: This checkbox probably is the implementation of the [then] future automatic upgrade option mentioned at https://blogs.windows.com/ie/2011/12/15/ie-to-start-automatic-upgrades-across-windows-xp-windows-vista-and-windows-7/:
“Finally, future versions of IE will provide an option in the product for consumers to opt out of automatic upgrading. “
Two tests of IE 10 on Windows 7, with Windows automatic updates turned off.
Test 1: “Install new versions automatically” checked.
Test 2: “Install new versions automatically” unchecked.
Same results in both cases when running Windows Update: Cumulative Security Update for IE 10 is of status Important, and checked. IE 11 is of status Optional and unchecked.
@Bill C.
The IE check box seems to affect only the status of the next IE version update offer as either Optional or Important. This is the meaning of “Install new versions automatically”, which is based on the assumption that Windows Update is configured to install Automatically either only Important or Important and Recommended updates.
Regardless of the category, the next IE version can be installed using the normal WU behaviour.
It has to be noted that this check box has only historical relevance, being relevant only on IE10 when being offered the upgrade to IE11.
There is no need today to install IE10 before IE11 and the older versions of IE before IE10 do not have that configuration.
Microsoft does not intend to release a newer version of IE which would be named IE12 and as such, the check box in IE11 does not serve any purpose, unless there will be a newer release sometime in the future.
I never knew the answer to that either. In my case as a rule I leave NOTHING on “automatic”, so unchecking it means the question should be moot, and that there is a greater chance that I will have to be involved before anything’s changed.
A corollary observation is that after every IE update they pop up a dialog that asks you to choose between “Use recommended settings” vs. “Don’t use recommended settings”… What’s funny is that if you – as I have done – reconfigure IE to be MORE restrictive (and thus have a higher security level) than Microsoft, then after an update you choose “Use recommended settings”, they will actually lower your security level. It’s just another example of Microsoft most certainly doesn’t know what’s best.
Anyway, I only point that out to show that anything Microsoft checks by default should seriously be considered for unchecking. 🙂
-Noel
I wouldn’t say that Use Recommended Settings does any harm if it does any at all.
The only things configured are to use SmartScreen Filter, which I don’t use but everyone has the right to think differently about it and configure Send Do Not Track requests which again I don’t configure but some people think differently.
I previous versions of IE, the initial configuration was a lot more intrusive, but now it is pretty lean.
And there is always the Group Policy “Prevent running First Run wizard” which can bypass the annoying first run and configure the settings in the most common good way.
Thank you. You’ve taught me something. I didn’t know about the “Prevent running First Run wizard” setting. Exactly what I want.
It’s been a while since I inadvertently chose “Use recommended settings”, but as I recall I saw it make it possible for sites in the Internet zone to do much more than I ever allow normally – e.g. run ActiveX. Drive by malware infections, anyone?
-Noel
The First run wizard would also allow ActiveX controls to run, which I normally do not restrict further than the default behaviour.
This further hardening needs to be done after the initial configuration, run via the wizard or avoided by setting the policy, which I normally do per-user, but it can be done per-computer.
I also prefer to reset the Security Zones as default for “normal” functionality.
I think that the ActiveX filtering setting in the menu list can block all ActiveX controls in one place and may be the configuration which you need.
What is IE without ActiveX though? 🙂
What is IE without ActiveX though?
For me it’s turned into a quite secure browser that brings me the content I seek without the fluff, without the ads, and without the malware. It fits very well into my larger overall strategy of using a managed blacklist to avoid ad/bad sites.
I keep ActiveX and other potentially insecure features enabled only in my Trusted Sites zone, but the list of those sites is vanishingly small and it’s been a long while since I needed to add any site there to get it to work. Originally I put e.g., my bank in there, but the rise of the other non-ActiveX browsers has pretty much made ActiveX obsolete. Same kind of thing as with Flash.
My Internet zone allows almost nothing beyond basic scripting, and even that’s limited. Honestly it feels like I’ve created a little niche in which I enjoy a better, more secure browsing experience than everyone else. I abandoned listening to Microsoft’s advice on what to use for “recommended settings” long ago, and not just for Internet Explorer.
-Noel
This option was introduced in IE 10; source: http://www.anandtech.com/show/5630/indepth-with-the-windows-8-consumer-preview/9.
Here are two tests that I would appreciate if somebody else would do:
As a baseline, use a Windows 7 computer that has IE 10 non-final version installed. Here is an IE 10 installer: http://filehippo.com/download_internet_explorer_windows_7_64/tech/14435/. Importantly, make sure that IE 11 has never been installed or uninstalled on this computer, because as ch100 has noted this is a variable that can change behavior.
First test: Revert to baseline. Set IE 10’s setting “Install new versions automatically” to checked. Record initial version of IE. Set Windows updates to be automatically installed. Let all Windows updates that install automatically install. Record final version of IE.
Second test: Revert to baseline. Set IE 10’s setting “Install new versions automatically” to unchecked. Record initial version of IE. Set Windows updates to be automatically installed. Let all Windows updates that install automatically install. Record final version of IE.
I am doing the above tests, except that I am using a computer that already had IE 11 installed, so I uninstalled IE 11, and then installed IE 10.
Here are the results:
Windows 7 64-bit Ultimate with SP1 ISO, clean install in VMWare VM.
First scan immediately after the installation, with no other patches except for what comes with the ISO and the updated agent which is mandatory, unless using third party tools for updating, offers IE11 as Important Update.
IE10 is not offered at all.
It would likely be offered if I hide IE11, but this is not subject of this test and we don’t want to mess the results by playing with Windows Update.
Set Check for updates to Never.
Install pre-requisites for IE10 according to:
https://support.microsoft.com/en-us/help/2818833/prerequisites-for-installing-internet-explorer-10-in-windows-7-sp1
The article is missing KB2639308 which is required as seen in the C:WindowsIE10_main.log
Without this update, the installer require internet access even if it was configured for update-no.
This is normal.
I install the pre-requisites using a combination of Windows Update and manual where the pre-requisites do not come in the WU list as they are superseded. Installing their higher level replacements would work for a normal installation, but we need clean results here.
Install IE10 with the switch update-no
IE10-Windows6.1-x64-en-us.exe /update-no
What happens from here:
– With the default settings, upgrade IE automatically, when scanning for updates, IE11 is offered as Important
– With IE auto upgrade disabled, IE11 is offered as Optional.
I can consistently reproduce this behaviour.
This means that systems managed via WSUS or SCCM are not affected, because they get administrator approved updates and once approved, they are all seen as Important.
The difference between various update types in WSUS is made at the server level, while the client agent does not care.
Also it appears that a certain later update for IE or possible for the Windows Update Agent has modified this intended behaviour which now is inconsistent with the settings, for systems fully patched.
My tests are all done now with the “bad” agent 7.6.7600.320.
Is this one of the bugs about which nobody cares because it is not understood how it should work anyway?
I think the issue which I raised in the original post is clarified and resolved now.
Thank you everyone who contributed and provided ideas in relation to this setting.
Although I see the issue resolved, please feel free to add other observations or solutions to the current behaviour for patched systems if it happens to find any.
After posting the results of a clean install and with only the minimal number of updates installed, I went all the way and installed all patches available except for IE11.
The behaviour does not change.
The major difference between my recent tests and yours at https://www.askwoody.com/forums/topic/ie-install-new-versions-automatically/#post-101644 is related to IE11 being uninstalled.
With IE11 uninstalled, in all instances, IE11 comes on WU as Optional. I had the same results in the same conditions.
If only IE10 is installed and IE11 never installed, then the results are as expected
https://www.askwoody.com/forums/topic/ie-install-new-versions-automatically/#post-102195
I don’t think the mode of installing updates in WU would make any difference in the results.
I believe this is not a bug; instead, it’s to prevent IE 11 from being automatically installed again after a user has uninstalled IE 11.
Here are my test results using automatic Windows Updates (a question mark means the test was not done):
1. IE setting “Install new versions automatically” = checked
Windows Updates = automatic
IE 11 had previously been installed = yes
IE version before updates were automatically installed = 10.0.9200.16521
IE version after updates were automatically installed = 10.0.9200.17609
2. IE setting “Install new versions automatically” = unchecked
Windows Updates = automatic
IE 11 had previously been installed = yes
IE version before updates were automatically installed = 10.0.9200.16521
IE version after updates were automatically installed = 10.0.9200.17609
3. IE setting “Install new versions automatically” = checked
Windows Updates = automatic
IE 11 had previously been installed = no
IE version before updates were automatically installed = 10.x
IE version after updates were automatically installed = ?
4. IE setting “Install new versions automatically” = unchecked
Windows Updates = automatic
IE 11 had previously been installed = no
IE version before updates were automatically installed = 10.x
IE version after updates were automatically installed = ?
5. IE setting “Install new versions automatically” = checked
Windows Updates = automatic
IE version before updates were automatically installed = 11.x
IE version after updates were automatically installed = ?
6. IE setting “Install new versions automatically” = unchecked
Windows Updates = automatic
IE version before updates were automatically installed = 11.0.9600.17843
IE version after updates were automatically installed = 11.0.9600.18617
Here is a summary of ch100’s and my results when manually checking for Windows updates:
7. IE setting “Install new versions automatically” = checked
Windows Updates = manual
IE 11 had previously been installed = yes
IE version when Windows Update was manually run = 10.x
IE 10 listing on manually run Windows Update = Important, checked
IE 11 listing on manually run Windows Update = Optional, unchecked
8. IE setting “Install new versions automatically” = unchecked
Windows Updates = manual
IE 11 had previously been installed = yes
IE version when Windows Update was manually run = 10.x
IE 10 listing on manually run Windows Update = Important, checked
IE 11 listing on manually run Windows Update = Optional, unchecked
9. IE setting “Install new versions automatically” = checked
Windows Updates = manual
IE 11 had previously been installed = no
IE version when Windows Update was manually run = 10.x
IE 10 listing on manually run Windows Update = Important, checked
IE 11 listing on manually run Windows Update = Important, checked
10. IE setting “Install new versions automatically” = unchecked
Windows Updates = manual
IE 11 had previously been installed = no
IE version when Windows Update was manually run = 10.x
IE 10 listing on manually run Windows Update = ?
IE 11 listing on manually run Windows Update = Optional, unchecked
Summary: IE’s “Install new versions automatically” setting doesn’t matter for IE 11 users because there will be no IE 12, 13, etc. For IE 10 users, this setting can be important in some circumstances.
Here is the “bug” solved.
https://www.askwoody.com/forums/topic/ie-install-new-versions-automatically/#post-102350
https://www.askwoody.com/forums/topic/ie-install-new-versions-automatically/#post-102374
IE11 when uninstalled, leaves behind this registry key which is self-explanatory.
************************************************************************
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\11.0]
“DoNotOfferIE11AU”=dword:00000001
************************************************************************
Thank you both (or all? :D)
very interesting and satisfying results
I’d like to understand why anyone cares about any of this.
Why is anyone still using IE10?
Windows 11 Pro version 22H2 build 22621.2361 + Microsoft 365 + Edge
That link seems totally irrelevant to IE and this discussion. If there’s some obscure connection, could you explain it?
Platform update mentioned above is a prerequisite to IE11 and installed with it automatically. And also known as very problematic, although I’ve never had any issues with it.
Platform update mentioned above is a prerequisite to IE11 and installed with it automatically. And also known as very problematic, although I’ve never had any issues with it.
Platform update is also a pre-requisite for IE10, not only IE11, which makes it even more relevant.
The second part is misleading and people who have hardware not supporting Platform Update in 2017 should stop using Windows 7.
Release Date: February 26, 2013
https://support.microsoft.com/en-us/help/2670838/platform-update-for-windows-7-sp1-and-windows-server-2008-r2-sp1
There is also KB2834140 which should be installed immediately by those who believe that there may be problems with KB2670838.
https://support.microsoft.com/en-us/help/2834140/-0x00000050-stop-error-after-you-install-update-2670838-on-a-computer-that-is-running-windows-7-sp1-or-windows-server-2008-r2-sp1
@b See my other post replying to you.
And I would like to add that there are still people or enterprises which use the image with SP1 and IE8 as starting point and in the process of fully patching, a legitimate question is if it has merit to install IE10 first and IE11 on top of it or just IE11 on top of IE8.
I think I have the correct answer, there is no need to install IE10 in the process, but other people may want to have a roll-back option, just in case.
There are various scenarios and something that not a lot of people know, the result of the installation of IE11 from installer (patched or not) differs from what is achieved after fully resetting IE with its own command. The differences are so subtle than nobody complains except for those getting confused and moving to alternative browsers as a result. A lot of the features under Main registry key and some options visible under Advanced GUI change as result of a full Reset. Values like “Use software rendering instead of GPU rendering” change in the registry following Reset from DWORD to REG_SZ which is very important to understand in managed environments and the list continues. There are also inconsistencies between the 32-bit and 64-bit versions.
Doesn’t research need a purpose?
Actually, no.
The acquisition of knowledge is reason enough for some who believe that to use something most adeptly you should know all about that something.
You seem to ask questions without purpose… Why?
-Noel
So your answer is that this discussion is purely theoretical with no practical purpose?
For me it is, yet I find it interesting nonetheless.
If nothing else, it helps us to get inside the “minds” at Microsoft who would add such options to their software.
And it has every bit as much practical purpose as your asking about why it’s being discussed. A discussion doesn’t need a why. It needs only to be.
-Noel
I explained why I was asking before my question, but you’ve left that out of your quote. Why?
From where I sit, the two parts of your post seemed to be separate and distinct.
Specifically, you expanded the context of your interest in why THIS particular detail was being discussed into a much broader question that stood on its own. I was simply answering the latter in an attempt to show how that answer could apply to the former.
I have also pointed out to you – several times now – that there need be no good reason behind a discussion question besides simple curiosity, which your own posts illustrate nicely.
-Noel
Sorry, but there is a good chance that you have only a partial understanding of the implications of IE10 being still available on Windows Update and there is good reason why it is so.
It is not even superseded by IE11 in Windows Update in some configurations as it was proved in this thread.
I am not promoting IE10 or even Windows 7, but there are legitimate reasons why various users need or want to use both.
If Microsoft had documented this setting properly, this topic probably wouldn’t exist.
IE 10 is still being updated for some versions of Windows. For example, see http://www.catalog.update.microsoft.com/Search.aspx?q=KB4012204.
A bit of a tangent but, related to Internet Explorer AND security for W7 / W8:
Just done a search for ‘Windows 8 x64 March 2017’ on the MS Update Catalog and all except IE March patches are there, wouldn’t it have made more sense to include the IE update for March within the month of March since MS have now made IE updates a satellite patch?
Considering that IE is integral for both OSes, this could be a potential pitfall for many.
Try using “Internet Explorer 11” for your search instead of “Windows”.
Sort by date.
It is there.
http://www.catalog.update.microsoft.com/Search.aspx?q=internet+Explorer+11
I’m not sure the fault was with “welding it in” to the OS so much as their goal and ideal that active content needed to be able to execute software on the client system, and that the world would just provide all this wonderful, integrated web software for people to run freely and automatically, with no problems or malware introduced. Frankly it was a nice idea; it just didn’t adequately anticipate all the predators out there.
Today we hear about well-defined sandboxes where unvetted software from abroad can be run with limited capabilities and reduced risk, and even walled gardens of App Stores where only vetted software can be found – yet malware reports abound. Now we hear of “ransomware” in which baddies take over your data and extort money from you.
Personally I am configured so that I don’t let anything (except the most basic scripting) run automatically from sites abroad, and the list of sites my systems are allowed to contact is sharply limited by well-managed blacklists that are updated daily. On top of that I practice conscientious computing – i.e., I don’t download and run just any old software I find. And guess what? So far no malware has knocked at my door at all.
I liken browsing to visiting the nasty neighborhoods on the seedy side of town. You can dress up in a hazmat suit and put on a bullet-proof vest then go strolling around down there knocking on doors, but you STILL can be hurt.
Or you can program your GPS to route you around the bad parts of town and stay much safer. You might even be able to do without the hazmat suit and be more comfortable.
Avoiding running software from abroad, being smart about what you download/run, and blacklisting bad sites is a strategy that really works.
-Noel
Avoiding running software from abroad
The definition of “abroad” is very difficult to define in this context. 🙂
Donations from Plus members keep this site going. You can identify the people who support AskWoody by the Plus badge on their avatars.
AskWoody Plus members not only get access to all of the contents of this site -- including Susan Bradley's frequently updated Patch Watch listing -- they also receive weekly AskWoody Plus Newsletters (formerly Windows Secrets Newsletter) and AskWoody Plus Alerts, emails when there are important breaking developments.
