IE8 Deployed with WSUS
IE 8 and 7 were deployed in our network by WSUS prior to my arrival. This was done by accident by a prior admin. Corporate has not authorized the move to IE 8. I would like to know the following:
1) Can IE8 be mass removed?
2) If IE8 cannot be mass removed and the subsequent updates have been declined can they be restored?
We have an audit coming up and network scans are showing vulnerable systems because of IE8 updates. IF I have no other choice but to install these I guess that is that.
Thanks.
Answers
- > 1) Can IE8 be mass removed?
Not easily, and not via WSUS, but it's not impossible. I would suggest inquiring in the Internet Explorer forums for detailed information on doing an enterprise rollback of an inadvertent IE8 deployment. At a minimum, you should ensure IE8 is Not Approved on WSUS to preclude any further deployments.
> 2) If IE8 cannot be mass removed and the subsequent updates have been declined can they be restored?
I'm not entirely sure what you're asking here. If IE8 is already deployed, then declining the update is kinda like nailing the the barn door closed after the horses have escaped. Yes, you can prevent any more horse escapes, but only if you still have horses in the barn. Nailing the door is overkill, though; closing the door is usually sufficient (i.e. remove any existing approvals for the IE8 packages).
The package can be UN-declined if you later wish to intentionally deploy IE8 from WSUS.
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)
My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
My Blog: http://onsitechsolutions.spaces.live.com- Marked As Answer byAl_Stu34 Monday, November 02, 2009 11:08 PM
- You can decline the actual IE8 base packages (which are titled "Internet Explorer 8 for Windows <version> ") so that no future machines install it while still approving any IE8 patches to fix any existing installations of IE8 to get them to the latest patch level. If you declined them, make sure to set your Approval view in the WSUS Console to "Declined" to see the updates in order to change their approval from "Declined" back to "Install."
About the uninstall; as Lawrence said, you may want to post on the IE forum (or maybe the Windows Installer?) to see if there's a way to force out an uninstallation.- Marked As Answer byAl_Stu34 Monday, November 02, 2009 11:08 PM
All Replies
- > 1) Can IE8 be mass removed?
Not easily, and not via WSUS, but it's not impossible. I would suggest inquiring in the Internet Explorer forums for detailed information on doing an enterprise rollback of an inadvertent IE8 deployment. At a minimum, you should ensure IE8 is Not Approved on WSUS to preclude any further deployments.
> 2) If IE8 cannot be mass removed and the subsequent updates have been declined can they be restored?
I'm not entirely sure what you're asking here. If IE8 is already deployed, then declining the update is kinda like nailing the the barn door closed after the horses have escaped. Yes, you can prevent any more horse escapes, but only if you still have horses in the barn. Nailing the door is overkill, though; closing the door is usually sufficient (i.e. remove any existing approvals for the IE8 packages).
The package can be UN-declined if you later wish to intentionally deploy IE8 from WSUS.
Lawrence Garvin, M.S., MCITP:EA, MCDBA
Principal/CTO, Onsite Technology Solutions, Houston, Texas
Microsoft MVP - Software Distribution (2005-2009)
My MVP Profile: http://mvp.support.microsoft.com/profile/Lawrence.Garvin
My Blog: http://onsitechsolutions.spaces.live.com- Marked As Answer byAl_Stu34 Monday, November 02, 2009 11:08 PM
- You can decline the actual IE8 base packages (which are titled "Internet Explorer 8 for Windows <version> ") so that no future machines install it while still approving any IE8 patches to fix any existing installations of IE8 to get them to the latest patch level. If you declined them, make sure to set your Approval view in the WSUS Console to "Declined" to see the updates in order to change their approval from "Declined" back to "Install."
About the uninstall; as Lawrence said, you may want to post on the IE forum (or maybe the Windows Installer?) to see if there's a way to force out an uninstallation.- Marked As Answer byAl_Stu34 Monday, November 02, 2009 11:08 PM
