Microsoft to Disable VBScript in IE 11 in Windows 7 and 8.x
- Paul Thurrott
- Aug 03, 2019
-
15
Continuing a years-long push to phase out its insecure legacy technologies, Microsoft has announced a new milestone for VBScript. This month, it will disable VBScript by default in Internet Explorer 11 running under Windows 7, 8, and 8.1.
“The change to disable VBScript will take effect in the upcoming cumulative updates for Windows 7, 8, and 8.1 on August 13, 2019,” the Microsoft Edge team revealed. “VBScript will be disabled by default for Internet Explorer 11 and [web browser controls] for Internet and Untrusted zones on all platforms running Internet Explorer 11. This change is effective for Internet Explorer 11 on Windows 10 as of the July 9th, 2019 cumulative updates.”
Windows Intelligence In Your Inbox
Sign up for our new free newsletter to get three time-saving tips each Friday — and get free copies of Paul Thurrott's Windows 11 and Windows 10 Field Guides (normally $9.99) as a special welcome gift!
"*" indicates required fields
For those unfamiliar with VBScript, it’s a scripting language based on classic Visual Basic that first launched in 1996 alongside JScript, Microsoft’s 90s take on JavaScript. VBScript could be used on both the client- and server-sides on the web, but because the client version was only supported in Internet Explorer, it didn’t gain much traction against JavaScript, which was universally supported. VBScript did see some success on the server, however, as it could be used to power database-backed websites running on Microsoft’s Internet Information Server (IIS) using Active Server Pages (ASP).
VBScript was also used for writing scripts—basically more modern versions of MS-DOS batch files—that ran under the Windows Scripting Host (WSH) starting in Windows 95 (later renamed Windows Script Host). And it was briefly used as a scripting language in just one Microsoft Office application, Outlook 97. It was even used in Windows CE.
But by the turn of the century, Microsoft was transitioning to .NET and VBScript was left behind. Microsoft transitioned Office to Visual Basic for Applications (VBA), it utilized Visual Basic .NET for both client- and server-side development, and it eventually replaced WSH with PowerShell. By the 2010s, Microsoft explained that VBScript was deprecated and “should no longer be used as a scripting language.” It was only permitted for websites rendered in legacy document modes, and then only in IE 11.
In 2017, Microsoft released a cumulative update for Windows 10 that included an option for blocking VBScript execution in IE 11 for all document modes. And it noted that it would disable VBScript entirely in some future update. That day has arrived: Microsoft disabled VBScript by default in IE 11 on Windows 10 in July, and it is doing so today on all remaining supported Windows versions.
“Should you still need to utilize this legacy scripting language, the settings to enable or disable for VBScript execution in Internet Explorer 11 will remain configurable per site security zone, via Registry, or via Group Policy,” Microsoft notes.
Normally, I would assume that once IE 11 is no longer supported, Microsoft would officially kill VBScript for good. But IE 11 will be supported for the supported life of Windows 10, which is currently indefinite. I assume that will have to change at some point. But for now, VBScript continues forward, albeit in dramatically diminished form.
Conversation 15 comments
-
skane2600
<p>Hopefully outside of IE, it is still supported on Windows (although what is inside and outside IE is ill-defined). VBScript has automation capabilities that VBA doesn't have, namely the ability to automate Office programs (and others) from the outside. Also it was a option that avoided all the version issues that plagued .NET. </p><p><br></p><p>It obviously wasn't something you'd use to create a stand-alone application of any significance but as a scripting language it was quite useful.</p>
-
skane2600
<blockquote><em><a href="#447342">In reply to hrlngrv:</a></em></blockquote><p>VBScript support being included as part of Windows' standard install made the existence of other scripting languages somewhat moot on Windows. Not a matter of quality or power, but of practicality. </p><p><br></p><p>Yes, the potential removal of wscript.exe was what I was concerned with along with mshta.exe.</p>
-
skane2600
<blockquote><em><a href="#447348">In reply to wright_is:</a></em></blockquote><p>The concern stems from the fact that a number of these technologies were bundled as part of IE (recall MS's legal argument was that removing IE would break Windows) and thus could be in jeopardy depending on how Microsoft plays it.</p>