Ensure 'Prevent Internet Explorer security prompt for Windows Installer scripts' is set to 'Disabled'

Warning! Audit Deprecated

This audit has been deprecated and will be removed in a future update.

View Next Audit Version


This policy setting controls whether Web-based programs are allowed to install software on the computer without notifying the user.

The recommended state for this setting is: Disabled.


Suppressing the system warning can pose a security risk and increase the attack surface on the system.


None - this is the default behavior.


To establish the recommended configuration via GP, set the following UI path to Disabled:

Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Installer\Prevent Internet Explorer security prompt for Windows Installer scripts

Note: This Group Policy path is provided by the Group Policy template MSI.admx/adml that is included with all versions of the Microsoft Windows Administrative Templates.

Note #2: In older Microsoft Windows Administrative Templates, this setting was initially named Disable IE security prompt for Windows Installer scripts, but it was renamed starting with the Windows 8.0 & Server 2012 (non-R2) Administrative Templates.

Default Value:

Disabled. (When a script hosted by an Internet browser tries to install a program on the system, the system warns users and allows them to select or refuse the installation.)

See Also


Item Details


References: 800-53|CM-11(1), CSCv6|7, CSCv7|5.1

Plugin: Windows

Control ID: fa7c6ff8310ee39a118517cd871f2e4fec509c5e367d7ea132f7b3a90dddd645