Group Policy management tools
Caution
Update: The retired, out-of-support Internet Explorer 11 desktop application has been permanently disabled through a Microsoft Edge update on certain versions of Windows 10. For more information, see Internet Explorer 11 desktop app retirement FAQ.
Group Policy, based on Microsoft Active Directory Domain Services (AD DS), lets you manage your organization's computer and user settings as part of your Group Policy objects (GPOs), which are added and changed in the Group Policy Management Console (GPMC). GPOs can include registry-based Administrative Template policy settings, security settings, software deployment information, scripts, folder redirection, and preferences. The most effective way to target a specific GPO is to use Windows Management Instrumentation (WMI) filters. Like, creating a WMI filter that applies a GPO only to computers with a specific make and model.
By using Group Policy, you can set up a policy setting once, and then copy that setting onto many computers. For example, you can set up multiple Internet Explorer 11 security settings in a GPO that's linked to a domain, and then apply all of those settings to every computer in the domain.
Note
For more information about Group Policy, see the Group Policy TechCenter. This site provides links to the latest technical documentation, videos, and downloads for Group Policy.
Managing settings with GPOs
After deploying IE11 to your organization, you can continue to manage the browser settings by using Active Directory Domain Services (AD DS) together with the following Group Policy-related setting management groups:
Administrative templates and Internet Explorer 11. Used to manage registry-based policies and options.
Group policy preferences and Internet Explorer 11. Used to set up and manage options that can be changed by the user after installation.
Note
Whenever possible, we recommend that you manage IE11 using Administrative Templates, because these settings are always written to secure policy branches in the registry. In addition, we recommend that you deploy using standard user accounts instead of letting your users log on to their computers as administrators. This helps to prevent your users from making unwanted changes to their systems or overriding Group Policy settings.
Users won't be able to use the IE11 user interface or the registry to change any managed settings on their computers. However, they will be able to change many of the preferences associated with the settings you set up using the Internet Explorer Administration Kit 11 (IEAK 11).
Which GPO tool should I use?
You can use any of these tools to create, manage, view, and troubleshoot Group Policy objects (GPOs). For information about each, see:
Group Policy, the Group Policy Management Console (GPMC), and Internet Explorer 11. Provides a single location to manage all GPOs, WMI filters, and Group Policy–related permissions across multiple forests in an organization.
Group Policy, the Local Group Policy Editor, and Internet Explorer 11. Provides a user interface that lets you edit settings within individual GPOs.
Group Policy, Advanced Group Policy Management (AGPM), and Internet Explorer 11. An add-on license for the Microsoft Desktop Optimization Pack (MDOP) that helps to extend Group Policy for Software Assurance customers.
Group Policy, Windows Powershell, and Internet Explorer 11. A command-line shell and scripting language that helps automate Windows and application administration on a single computer locally, or across many computers remotely.