Improve Internet Explorer 11’s security settings

Improve Internet Explorer 11's security settings

Even if you always use Chrome, Firefox, or some other non-Microsoft browser for surfing the Web, Internet Explorer is on your PC and its vulnerabilities could affect your system’s overall security and performance.

Never using Internet Explorer won’t keep you safe; some deep-seated IE components can be automatically used in routine and critical Windows processes such as Windows Update.

Therefore, on all Windows versions, IE must be kept up to date and secure. Trouble is, starting this Jan. 12, only IE 11 (and Edge) will receive future security updates on Windows 7, 8.1, and 10. (Vista users get a brief reprieve: IE 9 will be supported on that OS until April 11, 2017 — Vista’s official end of life.)

All other versions of IE are now unsupported, and thus potentially dangerous to use.

That said, if you already have IE 11 installed, you should know that its default settings are optimized for backward compatibility — not for maximum security.

But as you expect with Windows and other Microsoft software, there are settings changes that will make IE 11 much safer. First, however, if you’re a Windows 7 or 8 user and you haven’t already upgraded to IE 11, you should do so immediately! (IE 11 is built into Win10, so no separate upgrade is needed.)

Taking these two essential steps — upgrading to IE 11 and changing settings — applies even if you use only Chrome, Firefox, or another non-Microsoft browser. Again, IE needs to remain on your PC, but new vulnerabilities in the browser could put your system at risk.

So with that, I start by describing how to upgrade to IE 11. If you’ve already upgraded (or you’re on Win10), skip this part and go to the next step: adjusting a number of IE 11’s advanced security settings to make it safer and more secure.

Upgrading Internet Explorer on Win7 and Win8

To see which version of IE is currently installed on your system, open the browser and click the gear icon in the upper-right corner of the browser’s window. (For simplicity on a Win8.1 system, open the desktop version of IE, rather than the tiled version.) Next, select About Internet Explorer — a small dialog box will open and show the currently installed version (see Figure 1).

If you’re running any Internet Explorer earlier than Version 11, download and install IE 11 via the MS download page; it should automatically offer the correct release of the browser for your specific system.

If you have trouble with the automated page, you can manually download IE 11 here:

• Windows 7, both 32-bit and 64-bit
• Windows 8.1, 32-bit
• Windows 8.1, 64-bit

Note: If you have trouble installing IE 11, check that your PC has the necessary prior updates and other prerequisites, as documented in MS Support article 2847882.

After you have IE 11 installed, confirm the version number, as shown previously. If it now says IE 11, you’re ready to adjust security settings.

Accessing the preinstalled IE 11 on Windows 10

Before you can change IE 11’s security settings in Windows 10, you have to find the browser — it’s somewhat hidden by default; you have to dig it out of Win10’s All apps menu.

To do so, click Start and select All apps. Scroll down to the Windows Accessories folder, click it, and then click Internet Explorer to immediately launch IE 11 (see Figure 2).

To access the browser more quickly, you can create shortcuts: right-click the IE 11 icon in All apps and select Pin to Start and/or Pin to taskbar (see Figure 3). You can also right-click the IE 11 icon in the taskbar and select Pin this program to taskbar.

Adjusting IE 11’s many security settings

Internet Explorer 11 has over 100 security and privacy settings. To Microsoft’s credit, most of the default settings are acceptable — for the most part, they provide reasonable security, as-is.

So I won’t discuss the obvious settings and the easily answered browser-security questions. Rather, I’ll focus on lesser-known options deep in IE 11’s Browsing and Security menus.

If you’d like a refresher or other help with the more frequently used settings and options, see the Microsoft help pages: Change security and privacy settings for Internet Explorer, Change Internet Explorer security settings, and Internet Explorer browser settings. A quick Web search will turn up many more help pages. Also, every tab in IE 11 offers context-sensitive help — click the small question mark in the upper-right corner of the Internet options dialog boxes.

I recommend changing about a half-dozen settings in the Advanced security section. Access them by clicking the gear icon in the upper-right corner of an IE 11 window and selecting Internet options, then select the Advanced tab. Scroll down to the Browsing and Security subsections, as discussed below.

By the way, if you don’t like the effects caused by the following changes, you can of course easily reverse them; see the section at the end of this article.

Adjusting an advanced browsing option

In the Advanced/Browsing section, look for Enable third-party browser extensions and make the following change: the default setting is checked (enabled); change that to unchecked (disabled; see Figure 4). This will block nonstandard toolbars, search redirectors, popups, add-ons, and so forth from altering IE 11.

Third-party browser extensions are a common vector for spyware, malware, and browser hijackers. They might change your home page, alter your search-engine choices, redirect your links to locations you don’t want, deliver popup ads, install unwanted toolbars, alter your Favorites, and so on.

By default, IE 11 leaves the Enable third-party browser extensions checked (enabled), meaning that third-party toolbars, extensions, add-ons and similar software can integrate into the browser.

Disabling the Enable third-party browser extensions option provides better security, but if you depend on specific third-party add-ons, toolbars, or other extensions, you might prefer to leave this option enabled (checked) — accepting somewhat reduced online security.

For more information on this topic, see:

• “How to disable third-party tool bands and Browser Helper Objects” – MS Support article 298931
• “Managing toolbars and other third-party browser extensions” – SearchSecurity article

Adjusting advanced security options

Changing other default settings can greatly increase Internet Explorer security. Figure 5 highlights all the recommended changes in the Security section. I’ll discuss the pros and cons of each below.

Note: In all of the following cases, the default setting is unchecked (disabled). The recommended setting is checked (enabled).

► Block unsecured images with other mixed content

There are several types of malware that can hide inside ordinary Web graphics and image files. The images might look fine, but they’re carrying a hidden and destructive payload.

That’s especially problematic on supposedly secure websites such as banking sites. The site’s pages will draw most of their content from secure servers, but also mix in content with images from unsecured graphics or ad servers. That could leave a gaping hole in your browser security.

With Block unsecured images with other mixed content enabled, IE 11 will reject images that come from unsecured locations, when displaying otherwise-secure content.

Keep in mind, however, that some websites might not display normally — and some images and/or graphic links could be broken.

For more info, see:

• “New stegosploit tool hides malware inside Internet images for instant drive-by pwning” – iDigitalTimes article
• “Malware hidden inside JPG EXIF headers” – SecuriNet blog
• “How is it possible to embed executable code in an image?” – Security.stackexchange post
• “Watch out for photos containing malware” – PCWorld article

► Do not save encrypted pages to disk

Many webpages — such as, again, those on banking sites — are SSL/TLS-encrypted for your safety. SSL/TLS encryption makes the pages initially indecipherable to snoops. However, Internet Explorer can store fully decrypted, plain-text versions of these pages in the Temporary Internet File area on your PC, making these pages potentially vulnerable to snooping.

Enabling this option will prevent IE from saving copies of decrypted SSL/TLS pages.

The primary downside is that future access to SSL/TLS-encrypted sites could be slightly slower because the pages will have to be fully downloaded again, rather than pulled from the Temporary Internet File area on your hard drive.

Also, some software-download sites and document services use SSL/TLS encryption, and downloads from these sites will fail because the downloaded files won’t be saved.

To get around this problem, temporarily disable (uncheck) the Do not save encrypted pages to disk option.

► Empty Temporary Internet Files folder when browser is closed

The primary benefit of enabling this setting is that no copies of webpages or page elements will be retained after you close your browser. A potential snoop won’t have an easy way to pull up copies of the sites and pages you’ve visited.

A secondary benefit of enabling this setting: it helps to reduce the clutter and digital debris that IE tends to accumulate over time.

The main drawback is, to my mind, minor. Your first visit to any given webpage might be fractionally slower because the pages will have to be fully downloaded again, rather than pulled from the Temporary Internet File area. However, in my experience, this extra time is imperceptible on all but the very slowest Internet connections. If you’re still on dial-up, you might want to keep this setting disabled.

► Enable 64-bit processes for Enhanced Protected mode

This setting is available only on 64-bit PCs — which probably makes up the bulk of PCs today.

The 64-bit instance of IE 11 has two main classes of internal processes: Manager processes involve the browser’s main operations; they’re essentially 64-bit throughout. Content processes involve creating and displaying the separate tabs you open, which may invoke 32-bit processes, even on 64-bit PCs.

The manager processes are mostly controlled by the settings discussed below in Enable Enhanced Protected Mode.

The Enable 64-bit processes for Enhanced Protected mode setting mostly focuses on the content/tab processes, elevating them to full, Protected Mode 64-bit operation when possible. This provides better security — it might also give better performance.

However, some websites and add-on components might not work properly, if they’re based on elements that are 32-bit only.

If you must visit sites or use add-ons that are not 64-bit compatible, temporarily disable the Enable 64-bit processes for Enhanced Protected mode option.

For more info, see the next section.

► Enable Enhanced Protected Mode

IE’s original, basic, Protected Mode dates back to IE 7. It was designed to help prevent Web-based malware and attackers from installing unwanted software or modifying your system settings.

Enhanced Protected Mode first appeared in IE 10 and adds extra safeguards against memory-based malware exploits, provides better isolation for individual browser tabs, and helps block several types of data-mining (such as remotely accessing documents on your PC).

Despite these benefits, IE 11’s default is to not enable Enhanced Protected Mode, mostly for reasons of backward compatibility.

But I recommend enabling Enable Enhanced Protected Mode — and leaving it enabled (checked), unless you encounter serious issues with websites you regularly visit or with tools you use.

For more info, see:

• “Enhanced Protected Mode” – MSDN article
• “Understanding Enhanced Protected Mode” – MSDN blog
• “Enhanced Protected Mode on desktop IE” – MSDN article
• “How Internet Explorer Enhanced Protected Mode (EPM) is enabled under different configurations” – MSDN blog

► Enable SmartScreen Filter

IE’s SmartScreen Filter will warn you when visiting a site known to host hidden malware or that’s been reported for phishing. Also, much like an anti-malware tool, SmartScreen Filter checks the underlying HTML and other code of each page, looking for signs of malicious intent. It also checks any software you download against a list of known-malicious programs.

I think these are eminently worthwhile functions. However, because IE has to communicate with Microsoft servers (to check the list of sites that host malware, for example), some people view SmartScreen Filter as too intrusive.

It’s your call: I recommend enabling the SmartScreen Filter.

For more info, see: “SmartScreen Filter: FAQ” – Microsoft info.

► Send Do Not Track requests to sites you visit in Internet Explorer

Not all websites honor Do not track requests, but why not at least request this small measure of extra privacy from those sites that will respect your wishes?

There’s really no downside at all to enabling this setting.

For more info, see: “Internet Explorer privacy-Do Not Track requests FAQ” – Microsoft info.

► Warn if changing between secure and not secure mode

Enabling this setting can help safeguard against websites that redirect, divert, or otherwise deliver you from a secure (e.g., HTTPS) page or area to one that isn’t secure (e.g., plain HTTP).

The downside is that in some environments — especially mixed intra-/inter-networks — might generate an annoying number of alerts. If this proves true in your case, disable this setting.

Final actions, repair, and reset options

After making changes in the Internet Settings dialog boxes, remember to click Apply and then OK before exiting; it will ensures that your changes take effect.

Also, if you encounter problems with any of the above settings, simply uncheck the setting to restore it to its default.

Major problems with IE 11 — whether related to the above changes or not — usually can also be easily resolved via a quick reset, which returns the browser to its pristine, just-installed condition.

That and two other IE 11 repair options are shown, step by step, in the July 16, 2015, LangaList Plus column, “How to correct even deep-seated IE 11 problems.”

By installing IE11, adjusting its settings as shown, and then keeping it updated, you’ll go a long way toward keeping your PC safe from malware and hack-attacks.

Ready or not, here comes Windows 10

This week, Microsoft began a more aggressive approach to moving Win7 and Win8.1 consumers to Windows 10. The upgrade is now flagged as a recommended update.

Here’s what to expect, how to ensure the upgrade goes well, and options for customizing the experience.

Pushing out Win10 automatically via WU

On Feb. 1, Microsoft confirmed with ZDNet’s Mary Jo Foley that it would immediately begin pushing the Windows 10 upgrade out as a recommended update, as Foley noted in a blog post.

If you’ve applied Registry changes or used the GWX Control Panel tool (download site) to block the Win10 upgrade, you won’t be affected — the update won’t be offered to you and there will be no changes to your Windows-updating experience.

On the other hand, if you’ve not applied either of the above options, and you’ve not already accepted the upgrade via the “Get Windows 10” option, you should soon see the Win10 upgrade in Windows Update as a prechecked, recommended item (see Figure 1).

Note that when the upgrade process begins, you’ll still have the ability to accept or decline the install (see Figure 2).

If you run into trouble with the Win10 installation, there are documented workarounds for known issues. One of those known issues is installed software, as reported in MS Support article 3107983. For example, if you have Trusteer Rapport software installed to protect your online banking sessions, be sure that all updates have been added before installing Win10. An alternative is to uninstall potentially problematic software before moving to Win10 and then reinstall the software once the new OS is up and running.

Encryption will also cause problems. As noted in Support article 3130052, if your system has third-party encryption in use, you’ll need to unencrypt your data before starting the Win10 upgrade process.

A reminder: If you decide to not stay with Win10, you can usually roll back to your previous OS (Win7 or Win8.1), as long as you do so within 31 days. (Click Start/Settings/Update & security/Recovery.) Note, however, that the roll-back process has been known to fail. Be absolutely sure to make a full backup of your current system before installing Win10.

Customizing your new Win10 setup

As we’ve noted in previous Windows Secrets articles, perhaps the most important step during the installation process is to avoid the default settings. Not only are there privacy issues with the standard settings, you’ll discover that Win10 has reset your Browser to Edge — which will also become the default viewer for PDF documents. Chose the Customize settings option, shown in Figure 3. For more help on getting started with the new OS, see the Jan. 26 Top Story, “Tips for setting up a new Windows 10 system.”

Windows 10 brings back a functional Start menu that Microsoft tried to ditch in Win8. But some of you might still prefer the now classic Win7 system. In that case, I suggest purchasing and downloading Start10 (site); it’s a Win7-like Start menu that’s nicely customizable.

Of course, if you want Win10 to look just like Win7, perhaps you should stay with the older OS for as long as you can. (I think Win10 is best when installed over Win8.1.) If you purchased your PC with Win7, it’s likely that all of your hardware and printers are optimized for that OS. There no guarantee that Win10 will have all the drivers needed to run older printers and other devices properly.

Some Win10 issues that still give me pause

Problems with upgrading to Windows 10 increase in business settings. For example, currently, the software that lets Win10 workstations connect to MS Essentials Server 2012 R2 over a local network is uninstalled with a full build (branch) update. You’ll need to reinstall the software, as noted in a TechNet blog post. We’re still waiting for a fix.

According to a TechNet forum post, there are also problems with file shares based on Server Message Block (SMB) and Common Internet File System (CIFS) networking protocols. Reportedly, the fix should appear in the next Win10 build, although not everyone will see it.

Rumors claim that the next build will be out before the free-upgrade offer ends (July 29, 2016). So if you have a small peer-to-peer network, and you wish to upgrade to Win10, you have two choices: disable SMB V2/3 for now or be patient and wait for the next build release.

Better to be proactive than reactive?

For many Windows 7 and 8.1 users who use automatic updating, the upgrade to Win10 might come as a surprise. (Some might even believe they’re required to upgrade.) The new OS has many great features, but it’s far from perfect. There are still privacy questions and some popular features in Win7 were left on the development floor with the advent of Win10.

I assume that Windows Secrets readers like to maintain control over their Windows migrations, and you’ve already either installed or blocked the Win10 upgrade. But others you know might be confused by the Win10 upgrade process. Take a bit of time to tell them what they need to know.

An imperfectly good result: printer prints

Lounge member Pheasant bought a new Brother printer to replace an old one that had worked on his Win7 system.

Despite much effort and two hours on the phone with Brother support, Pheasant’s Win7 Dell computer continued not seeing the new printer, although another computer did.

He described his problem to fellow Loungers in the Windows 7 forum and received abundant help — none of which straightforwardly fixed the trouble. And yet the printer finally functioned, though as a network printer. You might run into obstacles like his someday, so it’s good to see them discussed.

The following links are this week’s most interesting Lounge threads, including several new questions for which you might have answers:

Office Applications
General Productivity	How to save Windows Secrets and other articles the easy way
Word Processing	Batch-create macro-enabled docs and insert VBA module
Spreadsheets	Listing items in order of preference
Databases	Finding and removing duplicates
Visual Basic for Apps	Unsuccessful in suppressing userform control changes
Microsoft Outlook	Backing up settings, views, accounts, rules, etc. for Outlook 2016
Non-Outlook E-mail	Thunderbird and OneDrive
Other MS Apps	OneNote and OneDrive: Naming notebooks
Windows
General Windows	Breaking news: Monitor murdered by shortcut
Windows 10	Windows 10 file search box
Windows 8	Keep losing the DNS settings
Windows 7	Computer doesn’t see printer
Windows Vista	Trying to install SP1 with no success
Windows XP	Can’t install downloaded progams
Internet/Connectivity
Internet Explorer and Edge	Strange behavior in Edge and IE 11
Third-Party Browsers	All browsers eat over 1GB of memory
Networking	Internet randomly slows down or disconnects
Social Media	Article about Facebook
Software Development
Web Design & Development	Web links not working; hosting or coding problem?
Other Technologies
Security & Scams	Google Drive/OneDrive password protect?
Maintenance	CCleaner question
Hardware	Mini PC questions
Graphics/Multimedia	Windows Media Player documentation?
Other Applications	VMware shake up

starred posts: particularly useful

If you’re not already a Lounge member, use the quick registration form to sign up for free. The ability to post comments and take advantage of other Lounge features is available only to registered members.

If you’re already registered, you can jump right into today’s discussions in the Lounge.