Complete guide to disabling IE ESC and installing Google Chrome on Windows Server

Why is IE ESC enabled and should it be disabled?

Feature Internet Explorer Enhanced Security Configuration (IE ESC) Enabled by default on Windows Server to reduce the risk of running unsafe content. This feature restricts the execution of scripts, ActiveX, and unwanted downloads.

While IE ESC is a useful layer of defense, Complete deactivation It can reduce server security—especially on production servers. The logical approach is to either disable it for Administrator accounts only or for specific domains, or to use modern browsers such as Microsoft Edge (Chromium) Or Google Chrome Use with organizational policies.

Disabling IE ESC with Server Manager (recommended method for servers with Desktop Experience)

If your server has Desktop Experience, the easiest and safest way is to use the GUI. Steps:

• Login with account Administrator.
• Open Server Manager (Start → Server Manager).
• Click on Local Server In the left panel.
• Click on the value On Front Internet Explorer Enhanced Security Configuration.
• In the window that opens, for Administrators Amount Off Select (or just for Users as needed).
• Click OK and refresh Server Manager to see the status. Off Change.

If you only want to access a few specific sites, it's best to use the feature. Trusted Sites Use Internet Options to keep IE ESC enabled in public mode and only allow access to trusted addresses.

Disabling IE ESC for Core Server or Remotely — The Secure Approach

The Core Server does not have a graphical interface, so you must use PowerShell, the registry, or Group Policy. It is recommended to list the required domains instead of disabling them altogether. Trusted Sites Add.

Example of adding a domain to Trusted Sites via registry with PowerShell (verify before running in a test environment):

$trusted = "intranet.example.local"
$regPath = "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\$trusted"
New-Item -Path $regPath -Force
New-ItemProperty -Path $regPath -Name "*" -Value 2 -PropertyType DWord -Force

In the example above, the value 2 Equivalent Trusted Sites Always back up the registry before modifying it.

Installing Google Chrome on Windows Server — Different Methods

There are several common methods for installing Google Chrome on Windows Server that you can choose from depending on the scale and needs of your organization.

4.1 Manual installation with MSI (suitable for Enterprise/Deploy)

For enterprise environments, it's best to use the Google Chrome Enterprise MSI and deploy it with tools like SCCM, Intune, or Group Policy.

• Download Google Chrome Enterprise MSI from the official Google Chrome Enterprise page and select the x64 version.
• Copy MSI to server, e.g. C:\Temp\GoogleChrome.msi.
• Running the installation silently:

msiexec /i "C:\Temp\GoogleChrome.msi" /qn /norestart

Advantages: Better control over updates, ability to deploy in groups, and compatibility with GPO.

4.2 Installation with Chocolatey (simple and fast)

If you have permission to install package management tools, Chocolatey is the fastest way. First, install Chocolatey (in PowerShell with elevated rights):

Set-ExecutionPolicy Bypass -Scope Process -Force
[System.Net.ServicePointManager]::SecurityProtocol = [System.Net.SecurityProtocolType]::Tls12
iex ((New-Object System.Net.WebClient).DownloadString('https://chocolatey.org/install.ps1'))

Then install Chrome:

choco install googlechrome -y

4.3 Installation via PowerShell (direct download + msiexec)

Example to download and install MSI automatically (check the official MSI address before running):

$msiUrl = "https://dl.google.com/path/to/GoogleChromeStandaloneEnterprise64.msi"
$out = "C:\Temp\GoogleChromeEnterprise.msi"
Invoke-WebRequest -Uri $msiUrl -OutFile $out
Start-Process msiexec.exe -ArgumentList "/i `"$out`" /qn /norestart" -Wait

4.4 Installation on Server Core

On Server Core, you can also use Chocolatey or download the MSI and run msiexec with PowerShell. Since there is no UI, a silent installation is necessary.

Security configuration and policies after installing Chrome

After installation, you need to manage Chrome with organizational policies:

• Download ADMX templates from Google and importing them into the Central Store (\\domain\sysvol\…\Policies\PolicyDefinitions).
• Set homepage, disable extensions, block specific addresses, and manage auto-update.

Example of registry change to set homepage:

reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v HomepageLocation /t REG_SZ /d "https://intranet.example.local" /f

Turn off auto-update (if managed from the other side — caution required):

reg add "HKLM\SOFTWARE\Policies\Google\Update" /v AutoUpdateCheckPeriodMinutes /t REG_DWORD /d 0 /f

Practical Security Tips (Before and After Disabling IE ESC)

• Using a non-Admin account to browse: Use limited accounts to browse the web.
• Outbound firewall and proxy: Limit server outbound access to required addresses.
• Application Whitelisting: Use AppLocker or Windows Defender Application Control to prevent unauthorized applications from running.
• Sandboxing: If possible, run the scan in a separate VM or container to reduce the attack surface.
• Logs and Audits: Enable auditing for registry changes and software installations.
• Patches and updates: Make sure to install operating system and browser security updates.

Practical tips for site administrators, DevOps, and traders

For trading VPS: Run the browser in a managed environment with Web-Proxy and MFA.

For gaming and remote desktop: Install Chrome on servers with low ping (use one of 85+ locations We can reduce download and update delays.

For AI or rendering: Installing Chrome makes no difference in computing performance, but use VM images with Desktop Experience to manage graphical UI.

Distribution at scale (multiple servers/automation)

Use configuration management tools to distribute and automate across multiple servers:

• Ansible for Windows (win_* modules like win_package and win_regedit).
• Chef / Puppet / SCCM To install MSI and apply policies.
• CI/CD: Package the Chrome version in the artifact repository and deploy via pipeline.

Alternative solutions and final recommendations

• Instead of completely disabling IE ESCUse the Edge (Chromium) browser, which has better support and updates on Windows Server.
• List management Trusted Sites and use of bastion host Recommended for web browsing access.
• In cloud and VPS environments, using servers with anti-DDoS services, BGP networks, and CDNs can increase the stability and security of administrative access and updates.

Summary and quick checklist

• Before disabling IE ESC: Back up your settings and perform a risk assessment.
• Preference: Disable for Administrator only or add trusted domains.
• Chrome installation: with MSI for organizations, or Chocolatey for quick installation.
• Configuration: Use ADMX and the registry for security policies and update control.
• Network protection: Outbound firewall, AppLocker, logging, and task isolation.

Frequently Asked Questions