How to Solve Protected Mode Incompatibilities

Some applications that were designed to work with Internet Explorer 6 might not work with Internet Explorer 7 or later versions on Windows Vista and later operating systems because of restrictions imposed by Protected Mode. Applications that are failing because of Protected Mode have the following characteristics:

• Applications that use Iexplore.exe cannot write directly to disk while in the Internet zone.
• Applications might not know how to handle new Internet Explorer 7 or later versions or Windows Vista or later operating system prompts.

Before upgrading users to Internet Explorer 7 or later versions , whether upgrading the browser on Windows XP or upgrading users to Windows Vista or later operating systems, you need to ensure that critical Web applications still work correctly. Because Internet Explorer has a different rendering engine and higher security, some applications might not work correctly using the standard settings.

If you do identify a compatibility problem, you should enable Compatibility Logging to help you isolate the exact cause of the problem. To enable Compatibility Logging using a Group Policy setting, enable the Turn On Compatibility Logging setting under Computer Configuration\Administrative Templates\Windows Components\Internet Explorer or User Configuration\Administrative Templates\Windows Components\Internet Explorer.

For more information about Compatibility Logging, read "Finding Security Compatibility Issues in Internet Explorer 7" at http://msdn.microsoft.com/en-us/library/bb250493.aspx.

After using logging to identify the problem, you might be able to resolve Protected Mode incompatibilities using the following techniques:

• Add the site in question to the Trusted Sites zone Sites in the Trusted Sites zone have more privileges than sites in other zones. For more information, read the section titled "Security Zones" later in this tutorial.
• Change the application to handle Protected Mode, including responding to any related prompts that might be displayed Most applications can run successfully in Protected Mode if they are written to follow Microsoft best practices and use minimal privileges. However, many existing applications might not have been created to follow these guidelines. Work with your developers to design applications for Protected Mode. For more information, read "Understanding and Working in Protected Mode Internet Explorer" at http://msdn.microsoft.com/en-us/library/bb250462.aspx.
• Disable Protected Mode (not recommended) Protected Mode is an important security feature that can reduce the damage caused by malicious sites and malware. If Protected Mode is causing problems that cost you more than the security improvements benefit you, you can disable Protected Mode for individual security zones. To disable Protected Mode, open the Internet Options dialog box, click the Security tab, select the zone, and clear the Enable Protected Mode check box. Then restart Internet Explorer. Protected Mode is disabled by default for the Trusted Sites zone. You can also disable Protected Mode using the Group Policy setting named Turn On Protected Mode. For more information, read the section titled "Security Zones" later in this tutorial.

Note If you disable Protected Mode, Internet Explorer runs at the medium-integrity level.

To confirm compatibility with key Web applications, use the Microsoft Application Compatibility Toolkit (ACT). For more information about the ACT, visit http://technet.microsoft.com /en-us/windows/aa905066.aspx. In addition to the ACT, the Internet Explorer 8 Readiness Toolkit has detailed information and tools to identify and resolve compatibility issues. To download the Internet Explorer 8 Readiness Toolkit, visit http://www.microsoft.com/windows /internet-explorer/readiness/developers.aspx. For more information about Web page problems caused by security settings, read "Finding Security Compatibility Issues in Internet Explorer 7" at http://msdn.microsoft.com/en-us/library/bb250493.aspx.