locked
IE 11 on Windows 10 crashes with Protected Mode On RRS feed

  • Question

  • I am having an issue where Protected Mode causes certain websites to crash with IE11. I have noticed it on three different websites. Our internal Citrix webpage, GoToAssist's portal, and our Exchange OWA website. If Protected Mode is on, these websites cause IE11 to crash. When Protected Mode is off, the websites work fine. I have only seen this behavior on Windows 10. It works fine on Windows 7. I have noticed this on multiple machines that are both domain and non-domain machines. 

    Dan Chandler-Klein

    Monday, January 18, 2016 11:27 PM

Answers

  • I've found a temporal solution...

    Just delete the C:\Users\Default\Appdata\LocalLow folder before use your syspreped image

    All the new users will work fine. If you have been logged in, just delete the user profile and create a new one with this modification...

    Hope it helps

    • Proposed as answer by Martin Tschreppl Friday, February 26, 2016 9:45 AM
    • Marked as answer by snipazer Thursday, March 3, 2016 11:48 PM
    Monday, February 22, 2016 2:19 PM

All replies

  • Hi Dan Chandler-Klein,

    Protected Mode helps protect users from attack by running the Internet Explorer process with greatly restricted privileges. Protected Mode significantly reduces the ability of an attack to write, alter, or destroy data on the user's machine or to install malicious code. So it is possible that this issue is code related.

    As a workaround, try adding these websites into Internet Explorer 11’s internal Local intranet Zone. Since the Local intranet Zone is less secure than Internet Zone.

    Navigate to Internet Explorer settings>Internet Option>Security Tab>Local intranet

    Select sites and in the opening dialog box, choose Advanced, then add websites.

    Best Regards,

    Tao

    Tuesday, January 19, 2016 8:49 AM
  • Yes, I understand that I can do that and have done so for a workaround. However it would be nice to get the root problem fixed. I don't want to keep updating the Local Intranet sites list every time I find a new website that causes IE11 to crash.

    Dan Chandler-Klein

    Tuesday, January 19, 2016 3:05 PM
  • Can you do the following:

    Windows Key + S > type view all problem reports then click on "View all problem reports Control panel"

    Can you right-click on a few of the "Internet Explorer" "Stopped working" errors > View technical details

    What are the details of the errors?

    Tuesday, January 19, 2016 4:38 PM
  • Source
    Internet Explorer
    
    Summary
    Stopped responding and was closed
    
    Date
    ‎1/‎19/‎2016 8:42 AM
    
    Status
    Not reported
    
    Description
    A problem caused this program to stop interacting with Windows.
    Faulting Application Path:	C:\Program Files\Internet Explorer\iexplore.exe
    
    Problem signature
    Problem Event Name:	AppHangXProcB1
    Application Name:	iexplore.exe
    Application Version:	11.0.10586.20
    Application Timestamp:	56542a5e
    Hang Signature:	16f2
    Hang Type:	134217760
    Waiting on Application Name:	iexplore.exe
    Waiting on Application Version:	11.0.10586.20
    OS Version:	10.0.10586.2.0.0.256.48
    Locale ID:	1033
    Additional Hang Signature 1:	16f2aa6f78fa3435894e4d01c90fb4b8
    Additional Hang Signature 2:	7325
    Additional Hang Signature 3:	7325d2d43ab50eed209bc43a9e12f267
    Additional Hang Signature 4:	16f2
    Additional Hang Signature 5:	16f2aa6f78fa3435894e4d01c90fb4b8
    Additional Hang Signature 6:	7325
    Additional Hang Signature 7:	7325d2d43ab50eed209bc43a9e12f267
    
    
    
    Another problem I noticed. If I Protected Mode on, I cannot click Reply on this web site, it just does nothing. I had to turn off Protected Mode in order to respond to this thread.

    Dan Chandler-Klein

    Tuesday, January 19, 2016 4:46 PM
  • That is a hang report and does not tell us very much.

    Can you try the following and  see if it makes any difference:

    IE > Tools > Internet Options  > Advanced > remove the checkmark in front of "Enable third party browser extensions" > OK then restart IE.

    If that does not help you can re-enable third party browser extensions.

    If it does help, you would have to track down the third party browser extension causing the problem.

    • Proposed as answer by JimmyTheS Thursday, July 28, 2016 3:45 PM
    • Unproposed as answer by JimmyTheS Thursday, July 28, 2016 3:45 PM
    Tuesday, January 19, 2016 5:49 PM
  • I tried that and it did not make a difference. Still crashing.

    Dan Chandler-Klein


    • Edited by snipazer Tuesday, January 19, 2016 6:12 PM
    Tuesday, January 19, 2016 6:12 PM
  • Can you restart the computer in Safe Mode with Networking and see if the same issue exists.
    Wednesday, January 20, 2016 4:07 PM
  • Interesting, the issue does not happen in Safe mode.

    Dan Chandler-Klein

    Wednesday, January 20, 2016 6:10 PM
  • The problem may be a third party driver, service, etc.  that loads at startup.

    You could try a clean boot and see it makes a difference:

    https://support.microsoft.com/en-us/kb/929135

    To open msconfig in Windows 10:  Windows Key + R > type msconfig > OK 

    Reset the computer to start normally after using the clean boot.

    Thursday, January 21, 2016 5:03 PM
  • Clean Boot disables my network connectivity so I can't test it. Which service should I leave running so I can test it?

    Dan Chandler-Klein

    Thursday, January 21, 2016 6:51 PM
  • Hi Dan Chandler-Klein,

    Let's check the network adapter to see if it has been disabled. If yes, please navigate to Control Panel>Network and Internet(category view)>Network and Sharing Center>Change adapter settings

    Right click the network adapter and enable it.

    Best Regards,

    Tao

    Friday, January 22, 2016 1:28 AM
  • Clean Boot disables my network connectivity so I can't test it.

    A clean boot should only disable third party services so should still allow for network connectivity.

    What third party services were disabled?

    Friday, January 22, 2016 2:05 PM
  • Sorry I was being an idiot. I didn't check the "hide all Microsoft services" box before disabling services.

    Once I did a proper clean boot I tested it but IE still crashes.


    Dan Chandler-Klein


    • Edited by snipazer Friday, January 22, 2016 3:28 PM
    Friday, January 22, 2016 3:17 PM
  • A clean boot may not stop all third party drivers from loading at startup.

    What programs may be loaded at startup that would interact with or have an effect on IE such as antivirus, firewall, etc.?

    • Edited by auggyMVP Friday, January 22, 2016 6:10 PM
    Friday, January 22, 2016 6:09 PM
  • I'm starting to think that it might be an issue caused by the media that I used. I'm downloading a fresh copy of Windows 10 the techbench site and am trying again. I'll test and report back.

    Dan Chandler-Klein

    Friday, January 22, 2016 7:33 PM
  • OK wow, I narrowed the problem down. The problem only happens with computers that were deployed using MDT with the copyprofile switched turned to True. Should I make a post in the MDT forum about it?

    Dan Chandler-Klein

    Friday, January 22, 2016 10:54 PM
  • I see you have started a new topic.
    Sunday, January 24, 2016 2:06 PM
  • OK wow, I narrowed the problem down. The problem only happens with computers that were deployed using MDT with the copyprofile switched turned to True. Should I make a post in the MDT forum about it?

    All of this behavior and usage is confirmed with a custom 1511 build that our organization just created (January 11th, 2016). Interesting enough, the CopyProfile=TRUE Unattend file was not a problem previously for us as we rebuilt our Windows 10 Enterprise image in November (with 1511).

    IE11 Internet Zone: Protected Mode On/Flash Disabled/Shockwave Disabled - Sites like CNN.com, FoxNews.com, SpeedTest.net all hang and crash.

    IE11 Internet Zone: Protected Mode Off/Flash Enabled/Shockwave Enabled - All sites work fine.

    The same built-in Adobe Flash for Windows 10 version is the same on a previous build of Windows 10 leveraging the CopyProfile=TRUE Task Sequence step via SCCM 2012. But we do not experience the website hang issue with Protected Mode enabled so it appears something may have changed in the updates or the Copying of the default user profile. The only differences in the build is that we went to the internet to change the IE search provider to Google (*GASPS*).

    Could someone from Microsoft take a look at how we could correct this issue without having to rebuild our imaging processes?

    Wednesday, January 27, 2016 7:46 PM
  • Did you ever find a fix for this?  I was banging my head for a while until I realized Flash Player was the culprit when Protected Mode was enabled.  We also have a Windows 10 Enterprise image where we use CopyProfile.  Several sites would just cause IE11 to hang and finally display "... is not responding".  I believe I narrowed it down to Flash Player when I could not go to http://www.adobe.com/software/flash/about/ without IE crashing.  Chrome and Edge work fine, it's only IE11.

    Protected Mode in Windows 7 IE11 worked fine.  Protected Mode in Windows 10 worked initially, now the few people that have it all have the same problem.  I disabled all plug-ins, content filtering, and anti-virus without success.  I tried resetting IE11 but that too had no affect.  As soon as I disable Protected Mode, all sites start working.  Enabling Protected Mode makes them stop working.  With all add-ons disabled, that only leaves Flash Player which is built-in to IE11.

    Thanks

    Tuesday, February 16, 2016 6:49 PM
  • I just confirmed that I am also having this problem.  Exactly the same setup.  Using copy profile and build 1511.  We need an answer for this Microsoft. Other browsers work fine. Non-flash sites work fine.
    Tuesday, February 16, 2016 10:16 PM
  • All, we are experiencing the same problem with the MDT copy profile.  I had ran into the problem with the protected sites causing on our mdt image only. I had tried everything to get it to work.  On a whim I disabled the protected sites after going through most of the troubleshooting that was done on this thread.   I then googled for IE and protected sites with windows 10 and found this forum.  We are going to disable the copy profile in mdt and verify it fixes the problem for us as well.
    Wednesday, February 17, 2016 4:11 PM
  • I can confirm this is an issue with v1511/10586. I have sysprepped with a loaded Driver database and re-arming Windows and office 2016 for my final images and also have stripped out all drivers  with the unattend.xml entries for my base template images without re-arming windows or office and the problem continues to plague my images when using copyprofile=True.  Not using copyprofile isn't an option for me "            <DoNotCleanUpNonPresentDevices>false</DoNotCleanUpNonPresentDevices>
                <PersistAllDeviceInstalls>false</PersistAllDeviceInstalls>"  I installed all my software as the local administrator in Audit mode, installed the .net framework 3.5 (including 2.0 and 3.0) since some of our software packages require it be installed, I didn't perform any Windows/Office updates (this IE problem happens as well if I DO update Windows and Office prior to sysprepping), I also disable User Account Control (it gets turned back on after deployment), Windows Defender is also permanently disabled in favor of our Antivirus client which gets installed after deployment and ran my sysprep/unattend.xml with copyprofile=true.  the sysprep and image capture and deployment work perfectly and the custom profile mostly works perfectly.  the only thing that doesn't work correctly is Internet Explorer on certain sites due to this bug for all user profiles created from the custom profile except the local administrator account in which IE works correctly.  this happens on non-domain-joined local user accounts or after joining a domain, so it's not domain GP issue.  if I revert to using the original default profile, post deployment and re-create the user's profile,  IE works correctly, but this causes me to have to manually customize the heck out of the GUI and Start menu to make it functional for our users, which is unacceptable, especially in cases where multiple people use the same computer and the interface isn't customized for all users.

    I can reproduce this bug on windows 10 v10586 builds without any additional software or drivers installed. Just a straight Windows 10 install, ctrl+shift+f3 to enter audit mode, make a few customizations to the start menu or Desktop and sysprep with copyprofile=True  and you will be able to reproduce this bug on any user profiles created from the custom profile, except the local admin account.

    I'm able to reproduce this issue on v10240 as well with Cnn.com's article photos.  However, HP's Software and Drivers site works normally and Speedtest.net's site works normally when using copyprofile in v10240 after applying all windows updates prior to sysprepping.  Turning Protected Mode off for Internet Zones on user profiles created from the custom profile will show cnn.com's photos.  local admin account works perfectly with Protected mode on with cnn.com.

    Even if I launch Iexplore.exe -extoff  (addons disabled) in the custom profile,  sites like CNN  and HP's Software and Drivers site will still hang or not display photos, as in the case of CNN.com, so I don't think this is an Adobe Flash issue.  At least not in my case.  Disabling Protected Mode for Internet sites, resolves the issue, but this work around isn't secure.  speedtest.net works with Flash enabled and Protected Mode off, but hangs when Flash is disabled or enabled when Protected Mode is enabled for Internet sites.

    Another work around I found on another thread.  keep Internet Zone Protected Mode on,  but enable the Safety>ActiveX Filtering  and affected sites will work correctly.  The downside is flash enabled sites or videos or ads will stop working as well.

    Please upvote my Feedback post on this issue so Microsoft fixes it.

    Windows-Feedback:?contextid=81&feedbackid=f1b54378-b001-46e6-87bb-e6948901e442&form=1&src=2

    You can also search the Most Recent filter in the Feedback app for "copyprofile=true" to find my post.  Thanks.

    • Edited by mceuser Sunday, February 21, 2016 7:27 PM
    Wednesday, February 17, 2016 9:21 PM
  • I use the same process, sysprep with copyprofile=true and I have the same problem.

    If I open IE as Administrator, all work fine.

    In processmon you will see a kind of loop in the process instead of when you start as admin, but I don't find a problem in folder's security.

    A small webpage for test (put this page in the zone that are protected by Protected Mode...)

    <html>
    <head>
    </head>
    <body>
    test:
    <applet id='test' width='571' height='400'></applet>
    test end
    </body>
    </html>

    Saturday, February 20, 2016 10:18 PM
  • I've found a temporal solution...

    Just delete the C:\Users\Default\Appdata\LocalLow folder before use your syspreped image

    All the new users will work fine. If you have been logged in, just delete the user profile and create a new one with this modification...

    Hope it helps

    • Proposed as answer by Martin Tschreppl Friday, February 26, 2016 9:45 AM
    • Marked as answer by snipazer Thursday, March 3, 2016 11:48 PM
    Monday, February 22, 2016 2:19 PM
  • I've found a temporal solution...

    Just delete the C:\Users\Default\Appdata\LocalLow folder before use your syspreped image

    All the new users will work fine. If you have been logged in, just delete the user profile and create a new one with this modification...

    Hope it helps

    GOOD! The workaround work fine for me. Thank you! You save me a lot of time.
    Monday, February 22, 2016 4:03 PM
  • I tried that work around and now the start menu doesn't work for new users.  Microsoft can you hear us?
    Monday, February 22, 2016 7:38 PM
  • I tried that work around and now the start menu doesn't work for new users.  Microsoft can you hear us?

    This is weird, because locallow has nothing to do with start menu...Could you upload an snapshot of your locallow content??

    Tuesday, February 23, 2016 7:31 AM
  • I tried that work around and now the start menu doesn't work for new users.  Microsoft can you hear us?

    Thank you for identifying this. All of these issues are reconfirmed on a VLS ISO name:

    SW_DVD5_WIN_ENT_10_1511_64BIT_English_MLF_X20-82288.ISO

    Custom image modifying very little except Bing search provider scope (Google) ;) , but even with no modifications to Internet Explorer, the "Protected Mode" for Internet Zones is definitely causing some commotion. I will evaluate a way to automate this via script or Task Sequence step hopefully today.

    Microsoft, we do need some traction on this. Our firm is a Premier customer so I will be following up with a Premier case if this cannot be addressed and share the resolution from Microsoft that way. Thanks all for the contribution so far...

    Tuesday, February 23, 2016 6:21 PM
  • We are having the exact same issue.  We have confirmed that copyprofile breaks our imaging process.  If we do not use copyprofile during sysprep the issue goes away.

    We have been working with premier support and they have been of no help nor do they even seem aware of the issue.  So much for premier.  Definitely not worth the money they charge.

    If Microsoft want companies to deploy Windows 10 they need to do a better job testing and a much better job with support.  Are you listening Microsoft?

    If we find a solution we will post.  We will test the hackaround mention above.....delete the folder prior to sysprep or after sysprep.


    • Edited by BC-- Thursday, February 25, 2016 1:23 PM
    Thursday, February 25, 2016 1:19 PM
  • well if some one else is already working with Microsoft, We can wait for a resolve. But yes, we are having same issue . Currently unchecked copy profile in MDT2013 and had to manually do customization that was incorporated earlier in the administrator profile .
    Thursday, February 25, 2016 1:32 PM
  • If we find a solution we will post.  We will test the hackaround mention above.....delete the folder prior to sysprep or after sysprep.

    You must delete it after the sysprep, because this folder It must not be exist on default user.

    If you have some windows 10 with this problem on production, you can also delete this folder on the problematic users. On the next logon this will be created and working well.

    Thursday, February 25, 2016 4:57 PM
  • This worked for me in my initial test.  You can service your offline image, or Ghost image with Ghost Explorer, and check your Administrator profile and the Default profile and delete the ..\AppData\LocalLow folder and re-commit/save your image files.  Thanks a million everyone!  Hope MS fixes this soon.
    Friday, February 26, 2016 5:27 AM
  • Please, for topical reasons: give that man an oscar!
    Friday, February 26, 2016 9:53 AM
  • I've found a temporal solution...

    Just delete the C:\Users\Default\Appdata\LocalLow folder before use your syspreped image

    All the new users will work fine. If you have been logged in, just delete the user profile and create a new one with this modification...

    Hope it helps

    Works for me too!!! Thank you soooo much. I spent way too much time on this issue and never would have figured this one out.

    Dan Chandler-Klein

    Thursday, March 3, 2016 11:49 PM
  • I've found a temporal solution...

    Just delete the C:\Users\Default\Appdata\LocalLow folder before use your syspreped image

    All the new users will work fine. If you have been logged in, just delete the user profile and create a new one with this modification...

    Hope it helps

    Can confirm that this has also worked for me. Massive thanks for taking the time to figure out and post a solution!

    Hopefully MS address this in the next release.

    Thursday, March 10, 2016 9:59 AM
  • I am seeing the same problem too, however I cannot deploy the above fix (deleting the locallow folder0), because the image has been deployed to over 1,500 machines whom have already logged in.

    I'm wondering if there is a specific file in LocalLow that's causing the issue?

    Monday, March 14, 2016 2:29 AM
  • I am seeing the same problem too, however I cannot deploy the above fix (deleting the locallow folder0), because the image has been deployed to over 1,500 machines whom have already logged in.

    I'm wondering if there is a specific file in LocalLow that's causing the issue?

    I guess is security problems on this folder.

    You can also delete (or rename, for security) the LocalLow of the affect user and then relogon again. You may lost the Java configuration and others IE plugins, but is not very problematic.

    Friday, March 18, 2016 10:12 AM
  • Hi,

    

    We have the following commend distributed as a login script.

    icacls "%userprofile%\appdata\locallow\microsoft" /setintegritylevel (CI)(OI)L

    Then the Internet Explorer works fine.

    Regards,
    Pictop

    • Proposed as answer by Pictop Tuesday, March 22, 2016 10:12 PM
    Friday, March 18, 2016 8:42 PM
  • Hi,

    

    We have the following commend distributed as a login script.

    icacls "%userprofile%\appdata\locallow\microsoft" /setintegritylevel (CI)(OI)L

    Then the Internet Explorer works fine.

    Regards,
    Pictop

    Thx Pictop for the solution, and Thx all the rest for identify the problem.

    https://blogs.msdn.microsoft.com/beanexpert/2016/04/07/copyprofile-ie11-crash-windows-10/


    Friday, April 8, 2016 4:10 PM
  • Hi,

    

    We have the following commend distributed as a login script.

    icacls "%userprofile%\appdata\locallow\microsoft" /setintegritylevel (CI)(OI)L

    Then the Internet Explorer works fine.

    Regards,
    Pictop

    YOU FREAKING ROCK DUDE!!!!!  upvoted!!

    Paid IT Geek; mobile/desktops/deployments

    Wednesday, July 27, 2016 10:51 PM