ASD.ISM-1654 - Internet Explorer 11 is disabled or removed.
Overview
Internet Explorer 11 is disabled or removed (ISM-1654, Essential Eight Maturity Level One).
Internet Explorer 11 is out of support and keeps the legacy rendering engine and ActiveX reachable from the desktop. This check reads the Intune settings catalog policies for Windows and looks for Disable Internet Explorer 11 as a standalone browser set to Enabled in an assigned policy. Removing the Internet Explorer optional feature also meets the control; the ASD Blueprint for Secure Cloud does it with a platform script. Maester cannot read platform scripts, so if you rely on removal, turn this test off in maester-config.json (TestSettings, Enabled: false, with the reason). ASD's assessment process guide also asks for an application control rule that blocks iexplore.exe, because standard users can still start it, even on Windows 11.
Remediation action
- In Microsoft Intune admin center, go to Devices > Configuration > Create > New policy > Windows 10 and later > Settings catalog.
- Add, under Administrative Templates > Windows Components > Internet Explorer, the setting Disable Internet Explorer 11 as a standalone browser and set it to Enabled.
- Assign the policy to all devices.
Related links
Test Metadata
| Field | Value |
|---|---|
| Test ID | ASD.ISM-1654 |
| Severity | Low |
| Suite | ASD |
| Product | Intune |
| Feature | Device configuration |
| Area | Devices and endpoints |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1189 Drive-by Compromise |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1654 |
| Benchmark level | ML1 |
| Essential Eight strategy | User application hardening |
| Supports controls | essential-eight:ISM-1654, nist-800-53-r5:CM-7, ism:ISM-1654 |
| PowerShell test | Test-MtAsdInternetExplorerDisabled |
| Services | Graph |
| Compatible licenses | INTUNE_A |
Source
- Test:
tests/asd/intune/Test.ASD.ISM-1654.ps1 - Documentation:
tests/asd/intune/Test.ASD.ISM-1654.md