OTT Explains – What is Enhanced Protected Mode in IE 10?

With each recover of Windows, there are also a slew of new confidence facilities to repair a problems with a prior versions of Windows! That’s since User Account Control was enclosed in Windows Vista and 7 to repair problems with Windows XP. Every recover of Internet Explorer has had some kind of confidence refurbish enclosed with it. In IE 7, Protected Mode was introduced to forestall antagonistic formula regulating in IE from modifying or accessing complement settings or personal files. In IE 9, a SmartScreen Filter was introduced to forestall socially-engineered attacks. IE 10 is no different!

Enhanced Protected Mode is a new underline in Internet Explorer 10 that fundamentally adds on some-more facilities to Protected Mode. Before we get into details, here’s a discerning overview of a categorical additions enclosed in Enhanced Protected Mode in IE 10:

64-bit processes – When EPM is enabled in IE 10, all processes will be regulating as 64-bit processes. There are some memory insurance facilities in IE 10 that can implement a incomparable 64-bit residence space some-more effectively, thereby creation a complement some-more secure.

Protecting personal information – With EPM, IE 10 is limited from accessing personal information in locations like Documents, etc. For example, when we insert a record to an email in IE 10 with EPM enabled, IE will usually be means to entrance a record temporarily when we click a Open symbol in a record upload dialog. That is not a box yet EPM.

Protecting Intranets – A few some-more changes in IE 10 now forestall IE add-on processes from accessing domain credentials, forestall tabs from handling as internal web servers and prevents tabs from joining to intranet servers.

ie 10

In Windows 8, there are dual versions of Internet Explorer 10: Metro character IE and desktop IE. These are dual totally opposite beasts! To get started, Metro IE always runs with Enhanced Protected Mode enabled. Desktop IE does not have EPM enabled by default. Why is this exactly? we explain below.

How Enhanced Protected Mode works in IE

In sequence to know how EPM unequivocally works, we need to know a design behind IE 10. IE 10 has what is called multi-process architecture. Basically, this means that there are tiers. The initial tier of processes are a Frame or Manager processes. This is your IE 10 window. Within that window, we have tabs or content processes. Every singular web page rendered in IE 10 is finished so in one of a add-on or calm processes. In addition, all ActiveX controls and toolbars also run in add-on or calm processes.

In Windows 8 with both versions of IE, a support or manager processes ALWAYS run as 64-bit processes. In a Metro chronicle of IE 10, a calm or add-on processes also run as 64-bit processes. However, in a desktop chronicle of IE 10, a calm or add-on processes run as 32-bit processes. Why is this we ask? Why does a desktop chronicle of IE 10 have a manager routine regulating in 64-bit, yet a tabs all regulating in 32-bit?

This is since there are unequivocally few plugins or add-ons that support 64-bit during this time. This is since Metro IE does not support any plugins or toolbars whatsoever. If we wish to implement a toolbar or run a certain plugin, you’ll have to switch to a desktop version. Since all a tabs are regulating as 32-bit processes, all is concordant and we can implement add-ons and plugins yet a problem.

If we capacitate Enhanced Protected mode in a desktop chronicle of IE 10, all webpages that bucket in a Internet Zone or Restricted Zone will start regulating 64-bit processes. Note that a other zones will still use 64-bit processes, yet they won’t have EPM enabled. In further to a advantage of 64-bit processes, a second advantage to enabling EPM is that a add-on or calm processes are “sandboxed” in an AppContainer. What a heck is an AppContainer?

AppContainers in IE 10

Starting in Windows Vista, there was a further of firmness levels reserved to processes (low, medium, high). The levels dynamic what tools of a complement and registry a routine could access. Even yet an IE add-on runs in a Low firmness level, it still had review entrance to a whole hoop in prior versions of Windows and IE. With Windows 8 and AppContainer, IE is blocked from reading and essay to many of a system.

Note that a AppContainer is usually a underline of Windows 8. That means when IE 10 comes out for Windows 7, it will usually capacitate 64-bit add-on processes to run if EPM is enabled. This also means that EPM does positively zero on a Windows 7 32-bit complement since a 32-bit complement can't support 64-bit tabs or AppContainer.

With Metro IE 10, all tabs run in 64-bit and with EPM enabled, definition that they run inside AppContainer. For desktop IE 10, a tabs run in 32-bit low firmness mode by default and therefore do not run in AppContainer. To get a additional security, we have to capacitate EPM in desktop mode, that would switch a tabs to 64-bit processes and capacitate AppContainer.

Also, it’s value observant that all Windows Store apps (Metro apps) run inside this AppContainer object.

Benefits of AppContainer

So what’s so good about a AppContainer? There are fundamentally 3 pivotal advantages to regulating AppContainer in IE 10:

1. Inbound Connections Blocked – The initial network limitation is that an EPM add-on can't accept inbound network connections. Some add-ons have this ability to accept remote connections, that could concede someone to remotely bond and entrance your system. This is no longer probable with EPM.

2. Loopback Blocked – A add-on regulating inside AppContainer can't bond to a locally regulating use outward of their possess container. This means that if we have a internal IIS server regulating on your machine, we indeed won’t be means to bond to it from inside a EPM tab. If we try to go to from an IE 10 add-on with EPM enabled, you’ll get a This page can’t be displayed error.

enhance stable mode

Remember, though, that EPM usually works on tabs that are in a Internet and Restricted Sites zones like we mentioned above. is deliberate an Internet section URL and that’s since it’s blocked. However, if we were to form a hostname like http://localhost, it would be deliberate a Local Intranet Zone url and therefore not be blocked.

3. Intranet Resources Blocked – Lastly, this restrictions prevents Internet pages from accessing intranet resources, portion adult images from intranet resources, etc. This underline adds so most confidence that we will indeed be blocked from going to a router residence like regulating an EPM tab. This is since browsers cruise that residence an Internet Zone residence and EPM kicks in. You have to supplement a URL to your Trusted Sites section (which does not have EPM enabled) and afterwards you’ll be means to bucket it.

I attempted this on my home mechanism and it was blocked, yet got a summary observant Private network entrance is off for this site. we was given a choice to capacitate it and afterwards we was means to perspective a URL:

Windows 8 private network

It’s good that we get this summary with a choice to capacitate rather than a Page can't be displayed error. As we can see, enabling EPM unequivocally creates IE 10 a lot some-more secure. Obviously, we have to see your use of add-ons to establish either we can capacitate it for a desktop chronicle of IE.

What’s good about EPM is that even if we have it enabled on a desktop chronicle of IE 10 and we run into a site that requires ActiveX control that is not EPM-compatible, you’ll be given a choice to re-load a page in a special low firmness 32-bit add-on instead of a normal 64-bit add-on regulating in AppContainer. Any add-ons that are not EPM-compatible will be disabled.

Enabling Enhance Protected Mode in Desktop IE 10

Lastly, we only wish to discuss how we would indeed spin on EPM in desktop IE 10 if we wish to. Click on a rigging idol during a tip right, afterwards Internet Options, Advanced add-on and corkscrew down underneath Security.

enable extended stable mode


That’s a lot of technical fact to handle, yet hopefully it gives we an thought about what that environment unequivocally means. You’ll substantially see a garland of online beam display we how to capacitate or invalidate Enhanced Protected Mode, yet we should unequivocally also know what it does and how it works in both chronicle of IE in Windows 8. If we have any questions, feel giveaway to post a comment. Enjoy!

Leave a Reply

Your email address will not be published. Required fields are marked *