Install Internet Explorer 11 with WSUS

Internet Explorer support/lifecycle: better safe than sorry

You should proably know that your browser should stay up-to-date not only because of security issues being fixed or any security or non-security related improvements introduced. Now, it will have to be aligned with the the lastest supported major version of Internet Explorer. The end-of-life of Internet Explorer on a per-OS basis has changed. Microsoft announced in August 2014 that:

Any guidance available?

Let’s have a look at the guidance on how to deploy Internet Explorer 11 on Windows 7 with WSUS.

I found the following technet page but it’s not exactly what I was looking for:
Install Internet Explorer 11 (IE11) – Windows Server Update Services (WSUS)

You may not know but it’s recommended to uninstalll previous IE9 before installing Internet Explorer 11

This page shows how to uninstall Internet Explorer from the commandline.

That’s it for the official guidance šŸ˜¦ If you’ve a better link – an official one pointing to Microsoft’s website – , please feel free to post it in the comments, I may update this article to share it šŸ™‚

Approve the Internet Explorer 11 on WSUS

Internet Explorer 11 is classified in the “Update Rollup” category. This category should be selected in the WSUS settings and the catalog should have been synchronised.

You cannot actually directly approve Internet Explorer 11 like any security update. If you try, you’ll get an error message saying:
“This Update has Microsoft Software License Terms that must be accepted before it can be deployed.”

If I list all the properties of the Internet Explorer 11, we can that the license has not been approved yet:

Fortunately, there’s a license approval method named ‘AcceptLicenseAgreement’ šŸ™‚

Once the IE11 license has been approved, the properties are:

Here’s the piece of code I used to approve all required updates for Internet Explorer 11

(Get-WsusServer).SearchUpdates("Internet Explorer 11")| 
Where {
 -not($_.IsSuperseded) -and
 -not($_.isApproved)   -and 
 $_.Title -match "Windows\s7\sfor\sx64\-(based|Edition)" 
} | ForEach-Object {
 if($_.RequiresLicenseAgreementAcceptance) {
  Write-Verbose -Message "License accepted for $($_.Title)" -Verbose

Any post-installation updates required?
If you deploy Internet Explorer 11, you’ll have to apply post-installation security updates
Currently (on August 14) this is what is approved updates on WSUS

(Get-WsusServer).SearchUpdates("Internet Explorer 11")| ? {
    ($_.isApproved)   -and 
    $_.Title -match "Windows\s7\sfor\sx64\-(based|Edition)" 
} |
Select Title,isApproved,isSuperseded,SecurityBulletins,
@{l='Revision';e={$_.Id.RevisionNumber}},CreationDate,UpdateClassificationTitle | 
ft -AutoSize


What’s the client ‘experience’?
On the Windows 7 client, some prerequisites updates have been approved and installed along with Internet Explorer 11:

To confirm that Internet Explorer 11 was installed on the client, you can watch for the event ID 19.

$HT= @{
 LogName = 'System' ;
 ProviderName = 'Microsoft-Windows-WindowsUpdateClient';
Get-WinEvent -FilterHashtable $HT -MaxEvents 10

Once Internet Explorer 11 has been installed and Windows 7 restarted, a bunch of post-installation updates are still required to be installed on the Windows 7 client

Conclusion: When you deploy Internet Explorer 11 through WSUS, it’s fairly easy but it requires unfortunately 2 scans/installs + reboot to finally get a fully secured and up-to-date version of Internet Explorer 11 šŸ™‚
If it’s manually deployed, you can achieve the same thing with a single reboot. Thanks to DISM, you can chain the uninstallation of IE9, the installation of the prerequisites, IE11 itself plus its post-installation updates and reboot.

Bonus: Here are two useful links if you manage IE11 in a corporate environment


3 thoughts on “Install Internet Explorer 11 with WSUS

  1. The above works if you are running windows 10 as that is the only version of windows that the get-wsus cmdlet is design for (at least that I could find). Have you get a way to do this when running on a Windows 7 X64 Enterprise machine?

    • Hi,
      The Get-WsusServer cmdlet is a built-in cmdlet that you have when you’ve installed and configured the WSUS (Update services) role on a Windows Server.

Leave a Reply

Fill in your details below or click an icon to log in: Logo

You are commenting using your account. Log Out /  Change )

Google+ photo

You are commenting using your Google+ account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )


Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.