Prevent IIS installation
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: Windows Server 2003 only
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Internet Information Services Description
"This policy setting prevents installation of Internet Information Services (IIS) on this computer. If you enable this policy setting, Internet Information Services (IIS) cannot be installed, and you will not be able to install Windows components or applications that require IIS. Users installing Windows components or applications that require IIS might not receive a warning that IIS cannot be installed because of this Group Policy setting. Enabling this setting will not have any effect on IIS if IIS is already installed on the computer. If you disable or do not configure this policy setting, IIS can be installed, as well as all the programs and applications that require IIS to run."
Registry
Software\Policies\Microsoft\Windows NT\IIS Value name: PreventIISInstall
Enabled: PreventIISInstall = 1
Disabled: PreventIISInstall = 0
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_IIS/PreventIISInstall Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Prevent IIS installation
; State: Enabled
; Supported on: Windows Server 2003 only
[HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\IIS]
"PreventIISInstall"=dword:00000001More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Prevent IIS installation
# State: Enabled
# Supported on: Windows Server 2003 only
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\IIS'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventIISInstall' -Value 1 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_IIS/PreventIISInstall
Data type: String
Value:
<enabled/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Prevent IIS installation
# State: Enabled
# Supported on: Windows Server 2003 only
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\IIS' -Name 'PreventIISInstall' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Prevent IIS installation
# State: Enabled
# Supported on: Windows Server 2003 only
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\IIS'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventIISInstall' -Value 1 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Prevent IIS installation
# State: Enabled
# Supported on: Windows Server 2003 only
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Prevent IIS installation
# State: Enabled
# Supported on: Windows Server 2003 only
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\Software\Policies\Microsoft\Windows NT\IIS' -Name 'PreventIISInstall' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Prevent IIS installation
# State: Enabled
# Supported on: Windows Server 2003 only
$path = 'HKLM:\Software\Policies\Microsoft\Windows NT\IIS'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'PreventIISInstall' -Value 1 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.