Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

We use WSUS on our LAN. We have to complete some testing before I can let users upgrade to IE 9.

I would like to block it prevent it from being auto-installed until testing is complete.

The Microsoft document here refers me to KB 946202.

However, the information in KB 946202 seems dated and vague. Basically it tells you to disallow automatic approval of Update Rollup packages.

I have the following questions:

  • Is there a better way to block IE 9 using WSUS?
  • Will turning off auto-approval of Update Rollups block IE 9? I never would have guessed that a browser upgrade is an “Update Rollup.”
  • What other effects will this have? Will we be missing other important updates?
share|improve this question
up vote 6 down vote accepted

Yes, temporarily disabling Update Rollups is the way to do it.

You won't really be missing out on anything - it will still download the update rollups metadata, it just won't automatically approve them. Once the IE9 metadata has downloaded to your WSUS server, you can switch the auto-approval of update rollups back on if you so desire (personally the only thing I auto-approve is definition updates though).

It won't block Internet Explorer 9, per se but what it will allow you to do is either approve it for a subset of users (a test group for example) or just leave it unapproved for the time being until you do decide to deploy it.

share|improve this answer
Good point about blocking. I don’t need to block it, just stop it from being auto-approved so this sounds like the right way to go. – Nate Mar 17 '11 at 21:36

Try selecting the specific IE9 package/update and setting it to Not Approved.

share|improve this answer

It's also possible to deploy a registry key using a startup script to disable Internet Explorer 9.

Under HKLM\Software\Microsoft\Internet Explorer\Setup\9.0 create a key called DoNotAllowIE90 and set it to 1 for blocked and change it to 0 to unblock it.


share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.