Note: The Internet Explorer 11 desktop application will be retired and go out of support on June 15, 2022 (for a list of what's in scope, see the FAQ). The same IE11 apps and sites you use today can open in Microsoft Edge with Internet Explorer mode. Learn more here.

Summary

A new URL action, URLACTION_ALLOW_VBSCRIPT_IE (140C), enables VBScript execution policy to be configured per Security Zone or Security Zone Template. You can specify the following values for this URL action:

Enabled (default setting)

URLPOLICY_ALLOW

Disabled (recommended setting for Internet Zone, Restricted Sites Zone, and High and Medium-High Security Zone templates)

URLPOLICY_DISALLOW

Prompt

URLPOLICY_QUERY


This article describes three methods to disable VBScript execution in Internet Explorer for Internet Zone and Restricted Sites Zone. 

Note: To use the URL action that's described in this article, you must have Windows 10 Creators Update or the April cumulative security update for Internet Explorer installed.  

Microsoft easy fix solution

Click the easy fix link, click Run in the File Download dialog box, and then follow the steps in the Easy fix wizard.

Click this easy fix to disable VBScript in Internet Explorer 11 for Internet Zone and Restricted Sites Zone. 

Note: After you apply this easy fix, Internet Explorer will not run VBScript from websites that use Internet Explorer’s legacy document modes (Internet Explorer 10 and earlier versions), and that are in the Internet Zone or Restricted Sites Zone.

Click this easy fix to restore VBScript in Internet Explorer 11 for Internet Zone and Restricted Sites Zone.

For more information about how to use easy fix solutions, see How to use Microsoft easy fix solutions.

Registry settings

Important
Follow the steps in this section carefully. Serious problems might occur if you modify the registry incorrectly. Before you modify it, back up the registry for restoration in case problems occur.

To manually edit the registry and disable VBScript execution in Internet Explorer for Internet Zone and Restricted Sites Zone, follow these steps:

  1. Click Start > Run, type regedt32 or regedit, and then click OK.

  2. To disable VBScript execution in Internet Zone, locate the following registry subkey in Registry Editor:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\140C

    To disable VBScript execution in Restricted Sites Zone, locate the following registry subkey in Registry Editor:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\140C

  3. Right-click the appropriate registry subkey, and then click Modify.

  4. In the Edit DWORD (32-bit) Value dialog box, type 3.

  5. Click OK, and then restart Internet Explorer.

Note: After you apply these settings, Internet Explorer will not run VBScript from websites that use Internet Explorer’s legacy document modes (Internet Explorer 10 and earlier versions), and that are in the Internet Zone or Restricted Sites Zone. To restore VBScript execution in a Security Zone, set the value of corresponding registry subkey to 0, and then restart Internet Explorer.

Group Policy settings

Enterprise customers can use Group Policy settings to disable VBScript execution in Internet Explorer for Internet Zone and Restricted Sites Zone. To do this, follow these steps:

  1. Open Group Policy Management.

  2. Select Group Policy Object (GPO), and then right-click and select Edit.

  3. In the Group Policy Management Editor, browse to the settings for Internet Zone and Restricted Sites Zone by using the following paths:

    To disable VBScript execution in Internet Zone, browse to the following setting in the Group Policy Management Editor:

    Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Internet Zone

    To disable VBScript execution in Restricted Sites Zone, browse to the following setting in the Group Policy Management Editor:

    Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Restricted Sites Zone

  4. Double-click and edit the Allow VBScript to run in Internet Explorer setting.

  5. Click Enabled to enable the policy.

  6. Under policy Options, select Disable from the list.

  7. Click OK.

Note: Administrators should make sure that this Group Policy is applied appropriately by linking the GPO to the appropriate organizational unit (OU) in their environment. After you apply this policy, Internet Explorer will not run VBScript from websites that use Internet Explorer’s legacy document modes (Internet Explorer 10 and earlier versions), and that are in the Internet Zone or Restricted Sites Zone. If you disable or don’t configure this Group Policy setting, VBScript runs without any interaction in the specified zone.


For more information about this Group Policy setting, see New Group Policy Settings for Internet Explorer.

To download Administrative Templates, see Administrative Templates (.admx) for Windows 10 Creators Update.

Need more help?

Expand your skills
Explore Training
Get new features first
Join Microsoft Insiders

Was this information helpful?

What affected your experience?

Thank you for your feedback!

×