# Internet Explorer 11 is disabled or removed

Internet Explorer 11 is disabled or removed (ISM-1654, Essential Eight Maturity Level One).

Source: https://maester.dev/docs/tests/ASD.ISM-1654

<!-- This file is generated by website/scripts/generate-test-docs.mjs. Do not edit manually. -->

<div class="test-byline"><div class="test-byline-avatars"><a class="test-byline-avatar test-byline-avatar--author" href="/contributors/jusso-dev" title="jusso-dev · Original author"><img src="https://github.com/jusso-dev.png" alt="jusso-dev" width="28" height="28" loading="lazy" decoding="async" /></a></div><div class="test-byline-meta"><span class="test-byline-text">Contributed by <a href="/contributors/jusso-dev">jusso-dev</a></span><a class="test-byline-link" href="/contributors">All contributors →</a></div></div>

<p class="test-part">Part of <a href="/docs/tests/asd">ASD</a> · Intune · Device configuration · <a href="/docs/tests">All checks</a></p>

```powershell title="Run this check"
Invoke-Maester -TestId ASD.ISM-1654
```

## Overview

Internet Explorer 11 is disabled or removed (ISM-1654, Essential Eight Maturity Level One).

Internet Explorer 11 is out of support and keeps the legacy rendering engine and ActiveX reachable from the desktop. This check reads the Intune settings catalog policies for Windows and looks for **Disable Internet Explorer 11 as a standalone browser** set to **Enabled** in an assigned policy. Removing the Internet Explorer optional feature also meets the control; the [ASD Blueprint for Secure Cloud](https://blueprint.asd.gov.au/configuration/intune/devices/scripts/userapplicationhardening-removefeatures/) does it with a platform script. Maester cannot read platform scripts, so if you rely on removal, turn this test off in `maester-config.json` (`TestSettings`, `Enabled: false`, with the reason). ASD's assessment process guide also asks for an application control rule that blocks `iexplore.exe`, because standard users can still start it, even on Windows 11.

#### Remediation action

1. In **Microsoft Intune admin center**, go to **Devices** > **[Configuration](https://intune.microsoft.com/#view/Microsoft_Intune_DeviceSettings/DevicesMenu/~/configuration)** > **Create** > **New policy** > **Windows 10 and later** > **Settings catalog**.
2. Add, under **Administrative Templates** > **Windows Components** > **Internet Explorer**, the setting **Disable Internet Explorer 11 as a standalone browser** and set it to **Enabled**.
3. Assign the policy to all devices.

#### Related links

* [Essential Eight maturity model](https://www.cyber.gov.au/business-government/asds-cyber-security-frameworks/essential-eight/essential-eight-maturity-model)
* [Disable Internet Explorer 11 as a standalone browser](https://learn.microsoft.com/deployedge/edge-ie-disable-ie11)

## Details

<details>
<summary>Every attribute of this check</summary>

| Field | Value |
| --- | --- |
| Test ID | ASD.ISM-1654 |
| Severity | Low |
| Suite | ASD |
| Product | Intune |
| Feature | Device configuration |
| Area | Devices and endpoints |
| Resource type | Tenant |
| User impact | Low |
| Implementation cost | Low |
| MITRE ATT&CK | T1189 Drive-by Compromise |
| Supports benchmark | ASD Essential Eight maturity model (version 2026.09.4), requirement ISM-1654 |
| Benchmark level | ML1 |
| Essential Eight strategy | User application hardening |
| Supports controls | essential-eight:ISM-1654, nist-800-53-r5:CM-7, ism:ISM-1654 |
| PowerShell test | [Test-MtAsdInternetExplorerDisabled](https://github.com/maester365/maester/blob/main/tests/asd/intune/Test.ASD.ISM-1654.ps1) |
| Services | Graph |
| Compatible licenses | INTUNE_A |

</details>

## Source

- Test: [`tests/asd/intune/Test.ASD.ISM-1654.ps1`](https://github.com/maester365/maester/blob/main/tests/asd/intune/Test.ASD.ISM-1654.ps1)
- Documentation: [`tests/asd/intune/Test.ASD.ISM-1654.md`](https://github.com/maester365/maester/blob/main/tests/asd/intune/Test.ASD.ISM-1654.md)