Microsoft Internet Explorer Unsupported Version Detection is Tenable Nessus plugin 22024, which reports Windows hosts where Internet Explorer is present in a state Tenable considers unsupported. Fix it by enabling the “Disable Internet Explorer 11 as a standalone browser” policy, keeping cumulative updates current, and moving legacy sites to Microsoft Edge IE mode, then rescan.
What the scanner is actually detecting
The finding title is Microsoft Internet Explorer Unsupported Version Detection, reported by Tenable Nessus and the Nessus Agent as plugin 22024 in the Windows family. It is a local check. It needs a credentialed scan with full remote registry access (it depends on the SMB/registry_full_access and SMB/IE/Version knowledge base items), so an uncredentialed network scan never produces it. Tenable’s published solution is to upgrade to a supported version of Internet Explorer or disable it on the device.
The detection logic has changed several times, which explains many “why is this still open” tickets:
- Tenable stated that the plugin does not fire on Windows 11, or on Windows 10 hosts that have KB5022834 (the February 14, 2023 cumulative update, OS builds 19042.2604, 19044.2604 and 19045.2604) or a later update that supersedes it.
- It also skips hosts where Internet Explorer has been redirected to Edge by Group Policy or registry.
- The plugin changelog records extra checks for unsupported IE on Windows 10 and 11 (August 2024) and a mandatory registry check for the Edge policy InternetExplorerIntegrationReloadInIEModeAllowed (July 2025, plugin version 1.32).
Real-world risk
Tenable rates 22024 Critical with a CVSS score of 10.0, and its stated rationale is “Tenable score for unsupported products”. No CVE is attached. Treat the score as policy, not as proof of an exploitable flaw. The actual exposure depends on the operating system:
- Windows 10 client (Semi-Annual Channel, IoT, Enterprise multi-session): the IE11 desktop app went out of support on June 15, 2022, and Microsoft permanently disabled it through a Microsoft Edge update on February 14, 2023. On an up-to-date host, launching IE11 opens Edge.
- Windows 10 LTSC and Windows Server 2016, 2019 and 2022: Microsoft still lists IE11 as supported for the lifecycle of the OS, and the standalone app still launches unless you disable it. Windows Server 2012 and 2012 R2 left extended support in October 2023, so IE11 there is only serviced under ESU.
- All versions: the MSHTML (Trident) engine stays on the system to power IE mode and keeps receiving security updates. A host that is behind on cumulative updates is the genuine exposure.
The practical risk is someone browsing the internet with a legacy engine (common on servers, where admins reach for whatever browser is there) and line-of-business apps that silently depend on IE. Disabling the standalone browser removes the first and forces you to inventory the second.
How to confirm it on the host
Run these from an elevated PowerShell session. They show the version the scanner reads, the OS build, whether IE11 is installed as a feature or capability, and the relevant policy values.
# IE version values in the registry
Get-ItemProperty 'HKLM:SOFTWAREMicrosoftInternet Explorer' |
Select-Object svcVersion, Version
# OS build; Windows 10 22H2 = 19045, KB5022834 or later = UBR 2604 or higher
$cv = Get-ItemProperty 'HKLM:SOFTWAREMicrosoftWindows NTCurrentVersion'
'{0}.{1}' -f $cv.CurrentBuild, $cv.UBR
# Is IE11 installed as a Windows feature or an optional capability?
Get-WindowsOptionalFeature -Online -FeatureName Internet-Explorer-Optional-amd64 |
Select-Object FeatureName, State
Get-WindowsCapability -Online | Where-Object Name -like 'Browser.InternetExplorer*' |
Select-Object Name, State
# Policy values
Get-ItemProperty 'HKLM:SOFTWAREPoliciesMicrosoftInternet ExplorerMain' -ErrorAction SilentlyContinue |
Select-Object DisableInternetExplorerApp
Get-ItemProperty 'HKLM:SOFTWAREPoliciesMicrosoftEdge' -ErrorAction SilentlyContinue |
Select-Object InternetExplorerIntegrationLevel, InternetExplorerIntegrationSiteList,
InternetExplorerIntegrationReloadInIEModeAllowedA missing DisableInternetExplorerApp value on a Windows Server or LTSC host, or a Windows 10 client with a UBR below 2604, matches the conditions under which the plugin reports.
How to fix it
Step 1: Move legacy sites into Edge IE mode first
Anything that genuinely needs IE should open in IE mode inside Microsoft Edge. With the current Microsoft Edge administrative template, go to Computer Configuration > Administrative Templates > Microsoft Edge and set:
- Configure Internet Explorer integration: Enabled, Internet Explorer mode (registry value InternetExplorerIntegrationLevel = 1)
- Configure the Enterprise Mode Site List: Enabled, with the HTTPS or UNC path to your XML (InternetExplorerIntegrationSiteList)
The site list must use schema v.2. Entries with open-in set to IE11 open in IE mode. Authentication and SSO servers should be neutral sites (open-in None), otherwise sign-in fails inside IE mode.
<site-list version="1">
<site url="legacyapp.corp.example">
<compat-mode>Default</compat-mode>
<open-in>IE11</open-in>
</site>
<site url="login.corp.example">
<open-in>None</open-in>
</site>
</site-list>Step 2: Disable IE11 as a standalone browser (Windows 10 and Windows Server 2012 to 2022)
This is the fix Microsoft recommends because it leaves IE mode working. Go to Computer Configuration > Administrative Templates > Windows Components > Internet Explorer > Disable Internet Explorer 11 as a standalone browser, set it to Enabled, and choose a notification option: Never, Always or Once per user.
Prerequisites: a cumulative update from early 2021 or later (for example KB4601318 on Server 2016 or KB4598296 on Server 2019), updated inetres.admx and inetres.adml files in your Central Store, and Microsoft Edge Stable installed on the host. Without Edge, the policy does not take effect.
For hosts outside Group Policy, the policy writes this value (per the Policy CSP ADMX mapping):
reg add "HKLMSOFTWAREPoliciesMicrosoftInternet ExplorerMain" /v DisableInternetExplorerApp /t REG_DWORD /d 1 /fIn Intune, the same setting is the ADMX-backed Policy CSP ./Device/Vendor/MSFT/Policy/Config/InternetExplorer/DisableInternetExplorerApp. Once enabled, IE11 icons disappear, iexplore.exe and IE file associations open Edge, and site-list entries open in IE mode.
Step 3: Block ad hoc reloads in IE mode
Set Allow unconfigured sites to be reloaded in Internet Explorer mode to Disabled under the mandatory node (Administrative Templates > Microsoft Edge, not the “Default Settings (users can override)” node). This keeps the legacy engine limited to your site list, and it is the value Tenable’s July 2025 change checks.
reg add "HKLMSOFTWAREPoliciesMicrosoftEdge" /v InternetExplorerIntegrationReloadInIEModeAllowed /t REG_DWORD /d 0 /fEdge picks this up after a browser restart.
Step 4: Keep Windows 10 clients on current cumulative updates
KB5022834 itself is no longer offered: Microsoft notes that as of March 31, 2026 it is no longer available from the Microsoft Update Catalog. Install the latest cumulative update instead. Tenable added supersedence logic, so a later update satisfies the check.
Optional: remove IE11 where IE mode is not needed
Only do this on hosts that will never need IE mode, typically servers. Microsoft warns that removing IE this way also disables IE mode in Edge. The rendering engine, some folders and registry keys remain, so keep installing security updates.
# Windows 10 client where IE11 is an optional capability
dism /online /Remove-Capability /CapabilityName:Browser.InternetExplorer~~~~0.0.11.0
# Windows 10 and Windows Server where IE11 is a Windows feature
dism /online /Disable-Feature /FeatureName:Internet-Explorer-Optional-amd64
# PowerShell equivalent
Disable-WindowsOptionalFeature -Online -FeatureName Internet-Explorer-Optional-amd64 -NoRestartRestart the host to complete the change.
How to verify the fix and rescan
gpupdate /force
gpresult /scope computer /r
reg query "HKLMSOFTWAREPoliciesMicrosoftInternet ExplorerMain" /v DisableInternetExplorerApp
reg query "HKLMSOFTWAREPoliciesMicrosoftEdge" /v InternetExplorerIntegrationReloadInIEModeAllowedThen run iexplore.exe: Edge should open instead. Open edge://policy to confirm the IE mode policies are applied, and load one site-list URL to check it renders in IE mode. If the GPO reports as applied but the registry value never appears, work through why a security GPO is not applying before blaming the scanner.
Finally, rescan with the same credentialed policy. Confirm the scan authenticated and had registry access, because plugin 22024 simply does not run without it.
What can break and how to roll back
- Legacy web apps that are not on the site list open in modern Edge and may render badly. Add them to the XML rather than re-enabling IE.
- Single sign-on inside IE mode fails if the identity provider is not a neutral site.
- Scripts that drive IE through COM automation keep working under the policy. Removing the feature removes the iexplore.exe entry point, so test those scripts first.
- Feature removal breaks IE mode on that host entirely.
To roll back, set the policy to Not Configured (or delete the value) and refresh policy. To reinstall a removed IE11, use the method you used to remove it:
reg delete "HKLMSOFTWAREPoliciesMicrosoftInternet ExplorerMain" /v DisableInternetExplorerApp /f
dism /online /Enable-Feature /FeatureName:Internet-Explorer-Optional-amd64
dism /online /Add-Capability /CapabilityName:Browser.InternetExplorer~~~~0.0.11.0On Windows 10 client editions, removing the policy does not bring the standalone IE11 app back. The February 2023 Edge update disabled it permanently.
Common false positive reasons
- Stale results or failed credentials. The fix is in place, but the last credentialed scan or agent upload predates it, or authentication failed and the old result was never replaced.
- Policy set only under User Configuration. The setting works per user, but a scan reads machine-wide policy most reliably. Configure it under Computer Configuration.
- Edge missing or old ADMX files. The policy silently does nothing without Edge Stable, and outdated templates in the Central Store may not include it.
- IE mode reload still allowed. If only the Disable IE policy is set, check InternetExplorerIntegrationReloadInIEModeAllowed in the mandatory Edge policy path.
- Server and LTSC lifecycle mismatch. Microsoft still supports IE11 on these, so the finding reflects Tenable’s policy rather than a vendor end of support. Disabling the standalone browser is still the cleanest way to close it.
FAQ
Does disabling IE11 break Edge IE mode?
Not if you use the “Disable Internet Explorer 11 as a standalone browser” policy. Removing the feature with DISM or Disable-WindowsOptionalFeature does break IE mode.
Can I just install KB5022834?
No. It is no longer available from the Update Catalog. Install the latest cumulative update for your Windows 10 version, which supersedes it.
Is IE11 on Windows 11?
The IE11 desktop app is not available on Windows 11. The MSHTML engine remains in the OS to power IE mode, so you will still find iexplore.exe and IE version values in the registry.
Do I still need IE security updates after disabling it?
Yes. The engine stays on disk for IE mode and other components, and Microsoft continues to patch it through regular Windows updates.
Tracking this finding across many hosts
On a mixed fleet of Windows 10 clients and servers, the slow part is proving that every host picked up the policy. SITEY, a self-hosted vulnerability management platform, imports Nessus results from uploaded .nessus exports and can re-test individual Nessus findings such as plugin 22024 after the change lands. For hosts outside Group Policy, its AI can draft a host-specific script, which its Windows agents deploy only after human approval.