Virtualizing Internet Explorer: Microsoft Takes The Ball and Goes Home

For all the benefits of improved security and reliability in Internet Explorer (IE) 8, many business still have a critical need to support IE6.  IE6 may well be over 10 years old, it may well be two versions behind the most current release; the fact remains many businesses still have critical applications that rely on IE6’s cumbersome standards implementation and more relaxed security requirements.
In a previous article, Running Internet Explorer Beyond Windows XP I suggested that Microsoft reconsider its policy on supporting IE as a virtualized application. And Microsoft did reconsider. Go me. But, rather than allow it, Microsoft have actively sought to prevent IE virtualization: stopping one application virtualization company from promoting their offer of delivering virtualised versions of IE from their website and restating their support options for virtualised IE.
What will the impact be to your business you if you need to continue to support IE6 on Windows Vista or Windows 7. Are Microsoft’s recommended solutions the only option now? Is it possible to have a seamless, simple, fast and importantly low cost solution to allow users gain the benefits of the latest IE release while maintaining access to legacy web applications?

IE6 can no longer be Spoon fed to you

In our last article, we highlighted that Spoon had an innovative option for deploying a virtualised instance of IE. This is no longer the case. Techtarget reported that Kenji Obata, CEO of Spoon, had a “nastygram from Microsoft’s attorney” waiting on his return from TechEd Europe 2010. The letter specifically stated that distributing IE from the Spoon website is in violation of Microsoft’s intellectual property rights, leaving Spoon little option but to remove the offer of virtualised versions of IE from their website.
Spoon are not the only application virtualization company to enable IE virtualisation – Endeavours, InstallFree and Symantec all have that capability. Spoon is unique in that it offered a pre-packaged instance of the versions of IE, allowing customers the ability to launch IE versions 6, 7 and 8  directly from Spoon’s website, or as a download to host themselves. Spoon had little option but to comply with Microsoft’s request, but the capability to dynamically deploy IE into different desktops is something many businesses want and need.
Spoon still offers you the facility to download and run other browsers such Firefox, Opera and Chrome, but in the browser section of Spoon’s website it now states:
Microsoft has asked us to remove Internet Explorer from this service. We hope to work with Microsoft to restore cloud-based access to their browsers shortly, but in the meantime we have disabled access to Internet Explorer.
It is unlikely that this statement will impact the take-up of IE8, or increase the market share of other browsers.  But, by heavily policing the virtualization of IE, Microsoft slow migration away from Windows XP, an OS that almost three-quarters of business PCs still run Microsoft’s Steve Balmer admitted in June. Does this matter to Microsoft? Users are likely buying licenses for Windows 7 and downgrading which is perhaps a factor in Microsoft feeling so confident in striding ahead.
That said, this doesn’t help you if you need to continue to support IE6 and need to move from Windows XP or Windows 2003.
Running multiple versions of Internet Explorer on a single instance of Windows is unsupported
Following on from the clamp down on Spoon, Microsoft released an updated knowledge base article explicitly stating that multiple versions of IE on a single instance is not an option they will provide support for:
Running multiple versions of Windows Internet Explorer, or portions of Windows Internet Explorer, on a single instance of Windows is an unlicensed and unsupported solution. Microsoft strongly discourages the use of any solution or service (hosted or on-premises) that repackages the executable components of Internet Explorer, or portions of those components, into a separate installation. Any attempts to repackage Windows to execute multiple versions of Internet Explorer from such packages on a single instance of Windows will result in an unsupported configuration by Microsoft Customer Support Services.
Is this such a problem? For many organisations – yes. Yes because IE6 typically gives access to web applications that are often themselves old and either unsupported, or expensive to modify. Yes because while the solution is to replace or update the web application that is an often an expensive and time consuming process. Without legacy IE6 available, upgrades to desktop operating systems or moving to different browsers may need to be put on hold.
Microsoft recommends a number of solutions and details them in a white-paper Virtualizing Internet Explorer. Options include Microsoft Enterprise Desktop Virtualization (MED-V), Windows XP Mode, and Terminal Services. Only Windows XP Mode is ‘free’, each other option may well involve investing in new licenses, all have increased hardware considerations.  If you need to support IE6 you’ll have to maintain Windows XP and Windows 2003 in your environment and moreover none of these solutions offer a completely seamless and straightforward user experience.
Browsium: thinking outside the box, inside the tab.

In some instances the need for IE6 functionality is considered a short-term or specific use case requirement. Microsoft’s alternative options can be expensive to implement, difficult to manage and they appear cumbersome to end users.
Browsium are offering an alternative solution. The management team come from a background in developing Internet Explorer at Microsoft and have used that experience to create UniBrows, an innovative solution to enable your business to extend your IE functionality. UniBrows is intended to provide you the facility to deploy, control, and secure your browser of choice in ways that synchronizes with the rest of your current technology infrastructure and, importantly, do not fall foul of Microsoft’s anti-IE-application-virtualization stance.
Last week I caught up with Matt Heller (CEO) and Mat Crowley (CTO) last week and they walked me through what UniBrows delivers in some impressive demo examples.

• Alternative Browser Engine The application provides the facility to change the browser engine in IE using a set of administrator defined rules. This means that the from the user’s point of view, IE8 functionality is available up until a specific site or zone or URL is selected – and then the appropriate pages are rendered and accessed as if in IE6. Issues with style sheets and javascript support that IE8’s improved adherence to standards gives as the more relaxed standards-challenged IE6 engine takes over.
• Security through Isolation UniBrows does not revert or remove the improved security of IE8 – instead it provides an isolated ‘sandboxed’ runtime environment. This maintains security and allows you to include legacy controls, access to file systems and registry settings that allow users to use the web application and associated controls.
• Centralised Rules – UniBrows runs as a user application it doesn’t need an administrator install or a new agent it is designed to be centrally administered and managed. The Rules Manager component allows a fine degree of granularity of when the IE6 engine will be available to users: for example by specific URL, site, by domain or by zone. The Rules Manager is also used to define which ActiveX controls, which registry keys and file accesses are available and permitted.

UniBrows isn’t intended simply to aid migration to Windows 7. The application’s Microsoft Install (msi) package has a small footprint and it doesn’t incur a large memory resource overhead making it available as a solution for physical PCs or hosted desktops, or on a Terminal Services running on 32 or 64-bit OSes. How does this not fall foul of Microsoft’s stance? In the first instance – UniBrows’ installation contains no Microsoft components – they are available directly from Microsoft. Browsium have worked closely with Microsoft and believe the solution is legal and in compliance with applicable laws and Microsoft’s agreements.
How much I hear you ask? $5 per user, per year. Yes, I was surprised at that as well.
While the first release is intended to offer IE6 functionality future releases are intended to provide better compatibility support between versions – IE7 running in IE9 for instance – IE does have “Compatibility Mode” and of course, the Centralised Rules gives administrators a greater level of control of functionality within the browser.
The Customer is Always Right?
It is understandable that Microsoft would want to rule against third-party distribution of IE. Fundamentally, this is what Spoon fell foul of. Spoon can help virtualise IE, but not distribute the code. However, there is little logic in Microsoft’s stance against Windows license holders virtualizing IE with Microsoft App-V or other tools.
Microsoft’s official stance may well be that IE can be virtualized using Terminal Services, virtual desktop infrastructure/hosted virtual desktops or running XP in a virtual machine locally through Windows XP mode. Yet, this is not ideal in terms of effort, in terms of cost and in terms of user experience.
Application Virtualization’s benefit is the ability to maintain application compatibility rather than enable the running of legacy applications. IE6 support in App-V could set the way for more rapid adoption of Windows 7, ergo more users using IE8 and a greater drive to take up that browser’s features. Virtualising the application enables a more flexible and dynamic application environment – a foundation for enabling your business to benefit from more rapid application deployment.
There may well be great outrage to Microsoft’s reluctance to play ball and support virtualization of IE as without an alternative, the solutions offered by Microsoft are expensive, cumbersome and difficult to maintain. However, virtualising the application may well allow different browser versions to co-exist, but the user-experience can be burdensome with links to other applications not always launching the correct browser and users having to know which browser to choose. Here is where Unibrows offers an interesting alternative, utilising isolation to support the deployment of different controls and centralisation to allow management and control and importantly, wrapped up in what sounds like a very appealing cost.