Microsoft to Disable VBScript in IE 11 in Windows 7 and 8.x

Posted on August 3, 2019 by Paul Thurrott in Cloud, Dev, Windows with 15 Comments

Continuing a years-long push to phase out its insecure legacy technologies, Microsoft has announced a new milestone for VBScript. This month, it will disable VBScript by default in Internet Explorer 11 running under Windows 7, 8, and 8.1.

“The change to disable VBScript will take effect in the upcoming cumulative updates for Windows 7, 8, and 8.1 on August 13, 2019,” the Microsoft Edge team revealed. “VBScript will be disabled by default for Internet Explorer 11 and [web browser controls] for Internet and Untrusted zones on all platforms running Internet Explorer 11. This change is effective for Internet Explorer 11 on Windows 10 as of the July 9th, 2019 cumulative updates.”

For those unfamiliar with VBScript, it’s a scripting language based on classic Visual Basic that first launched in 1996 alongside JScript, Microsoft’s 90s take on JavaScript. VBScript could be used on both the client- and server-sides on the web, but because the client version was only supported in Internet Explorer, it didn’t gain much traction against JavaScript, which was universally supported. VBScript did see some success on the server, however, as it could be used to power database-backed websites running on Microsoft’s Internet Information Server (IIS) using Active Server Pages (ASP).

VBScript was also used for writing scripts—basically more modern versions of MS-DOS batch files—that ran under the Windows Scripting Host (WSH) starting in Windows 95 (later renamed Windows Script Host). And it was briefly used as a scripting language in just one Microsoft Office application, Outlook 97. It was even used in Windows CE.

But by the turn of the century, Microsoft was transitioning to .NET and VBScript was left behind. Microsoft transitioned Office to Visual Basic for Applications (VBA), it utilized Visual Basic .NET for both client- and server-side development, and it eventually replaced WSH with PowerShell. By the 2010s, Microsoft explained that VBScript was deprecated and “should no longer be used as a scripting language.” It was only permitted for websites rendered in legacy document modes, and then only in IE 11.

In 2017, Microsoft released a cumulative update for Windows 10 that included an option for blocking VBScript execution in IE 11 for all document modes. And it noted that it would disable VBScript entirely in some future update. That day has arrived: Microsoft disabled VBScript by default in IE 11 on Windows 10 in July, and it is doing so today on all remaining supported Windows versions.

“Should you still need to utilize this legacy scripting language, the settings to enable or disable for VBScript execution in Internet Explorer 11 will remain configurable per site security zone, via Registry, or via Group Policy,” Microsoft notes.

Normally, I would assume that once IE 11 is no longer supported, Microsoft would officially kill VBScript for good. But IE 11 will be supported for the supported life of Windows 10, which is currently indefinite. I assume that will have to change at some point. But for now, VBScript continues forward, albeit in dramatically diminished form.

Elevate the Conversation!

Join Thurrott Premium to enjoy our Premium comments.

Premium member comments on news posts will feature an elevated status that increases their visibility. This tab would allow you to participate in Premium comments with other premium members. Register to join the other Premium members in elevating the conversation!

Register or Subscribe

Join the discussion!


Don't have a login but want to join the conversation? Become a Thurrott Premium or Basic User to participate