Neil MacDonald

A member of the Gartner Blog Network

Neil MacDonald
VP & Gartner Fellow
15 years at Gartner
25 years IT industry

Neil MacDonald is a vice president, distinguished analyst and Gartner Fellow in Gartner Research. Mr. MacDonald is a member of Gartner's information security and privacy research team, focusing on operating system and application-level security strategies. Specific research areas include Windows security…Read Full Bio

Coverage Areas:

Virtualizing IE6 Using Application Virtualization Violates Microsoft’s EULA?

by Neil MacDonald  |  September 22, 2010  |  11 Comments

Migrating from IE6 to IE8 is not easy because of legacy web-enabled applications that don’t render correctly on IE8 and vendors that are slow to officially support it. There are a variety of ways to virtualize IE6 to help with this issue, including using application virtualization tools. I originally wrote about the potential issues using application virtualization with IE6 in this post. In this blog post I stated:

There’s also the legal implications of virtualizing IE. Since Microsoft treats IE as part of the OS, encapsulating IE into a container means you are encapsulating part of Windows into the container. That’s why the application virtualization providers won’t provide you a virtualized version of IE themselves. They’ll tell you how to do it, but won’t provide the bits themselves. That’s shifts the legal responsibility to you. It’s a fuzzy area and I’m not a lawyer, so this is at least something that needs to be considered. Do I believe Microsoft would have an issue with one of its customers virtualzing IE? I doubt it, but that doesn’t mean they officially support or endorse this approach either.

Apparently, Microsoft is now explicitly telling some customers that, indeed, using application virtualization to virtualize IE6 violates the end user license agreement of Windows, even if they do it themselves. Here’s an excerpt from a letter that Microsoft sent to some of its customers:

Microsoft does not support the use of Microsoft Application Virtualization (App-V) or similar third-party application virtualization products to virtualize IE6 as an “application” enabling multiple versions of Internet Explorer on a single operating system.  These unsupported approaches may potentially stop working when customers patch or update the underlying operating system, introducing technical incompatibilities and business continuity issues. In addition, the terms under which Windows and IE6 are licensed do not permit IE6 “application” virtualization.  Microsoft supports and licenses IE6 only for use as part of the Windows operating system, not as a standalone application.

Microsoft supports IE6 being virtualized, but only using terminal services, VDI/HDV or running XP in a VM locally. Running essentially a full copy of XP just to get an IE6 browser is overkill for most customers and increases the cost and complexity of their migration. And, as I pointed out in the previous post, application virtualization solution vendors already tell their customers how to virtualize IE — Symantec tells its customers how to do this here and VMware tells its ThinApp customers how to do this here. Technically, it can and is being done.

I think Microsoft is making a huge mistake in not allowing its customers to use application virtualization technologies to virtualize IE. The customer wants to move to IE8, Microsoft wants them to move to IE8. It’s a better and more secure browser. Everyone is better for it.

However, by sending messages like the one above and taking a strong stance against the application virtualization of IE6, Microsoft risks upsetting its customers and pushing them to consider alternative browsers which aren’t tied inexorably to the OS underneath and which can be virtualized using application virtualization so they don’t run into this problem during their next migration.

Microsoft, please allow your customers to virtualize IE6 using application virtualization technologies if they choose to do so and accept the possible technical risk. Better yet, design IE9 and future releases so it can be virtualized using application virtualization technologies if and when a customer wants to do this.

If you’ve been impacted by Microsoft’s stance, I’d be interested in hearing from you. Here’s a strategy to consider moving forward – don’t standardize on a single browser. We outline this strategy in detail in this research for clients.

11 Comments »

Category: Microsoft Microsoft Security Virtualization     Tags: , , ,

11 responses so far ↓

  • 1 Ruben Spruijt   September 23, 2010 at 4:37 am

    Thanks for the bridge to the ‘Application Virtualization Streaming Smackdown’; In this free whitepaper this topic is explained as well.
    I think (little biased) this whitepaper is worth reader is aswell..

    http://www.brianmadden.com/blogs/rubenspruijt/archive/2010/09/23/application-virtualization-smackdown-head-to-head-analysis-of-endeavors-citrix-installfree-microsoft-spoon-symantec-and-vmware.aspx

  • 2 Daniel Feller   September 23, 2010 at 7:02 am

    Allowing one to virtualized IE6 can only help to push the migration to Win7 faster. Denying ie6 virtualization will make migrations slow way down

  • 3 Neil MacDonald   September 23, 2010 at 7:22 am

    @Daniel,

    Agreed. That’s why Microsoft’s hard stance doesn’t make a lot of sense. Why potentially slow adoption of Windows 7? Why risk defections to alternative browsers?

    If a customer wants to do this themselves and accept the possible technical risk, let ‘em.

  • 4 Paul Obst   September 23, 2010 at 6:19 pm

    Microsoft have recently told the organisation I work for that if we virtualised IE6 with ThinApp that we will be in violation of our EULA. Their answer is to either run Med-V (which is clucky and memory hogging) or remediate our apps to IE8 (which is a costly exercise for us). Our architecture group is so annoyed with Microsoft that they are considering an alternative strategy of using either Mozilla or Firefox.

  • 5 Neil MacDonald   September 23, 2010 at 9:00 pm

    @Paul,

    Thanks for confirming what we expected. Organizations are being told that virtualizing IE6 using application virtualization violates their EULA.

    Before giving up and switching to Firefox or another alternative browser, I’d ask specifically what part of the EULA is being violated. It’s not clear to me what exactly, if anything, in the existing EULA prohibits the application virtualization of IE6 – but, ask Microsoft for specifics and ask your legal counsel to take a look as well.

    Like I said in the post, if Microsoft risks upsetting its customers to the extent it forces them to look at an alternative browser, Microsoft wins the battle, but loses the war (so to speak).

  • 6 Alon Yaffe   September 24, 2010 at 8:04 am

    InstallFree has been providing the ability to virtualize IE6 for a couple of years now, and fully supports the execution of this browser on Windows 7. Customers have been using our solution because they wanted to move to Windows 7 as soon as possible and didn’t want to continue getting stuck with XP, either as their primary OS or a VM running under XP Mode or MED-V. While it’s difficult for us to argue with Microsoft when it comes to their licensing terms (although I agree that they are being very vague), we can and certainly will dispute their technical claims regarding the stability and reliability or the solution. Their argument that the virtual browser will “potentially stop working when customers patch or update the underlying operating system” does not apply to our technology, as we completely isolate the browser from the underlying OS and it will be unaffected by service pack updates, etc. We have proven this time and time again with our customers. By continuing to thwart customer efforts to *efficiently* virtualize IE6, Microsoft is shooting itself in the foot and slowing down migrations to Windows 7.

  • 7 Kevin Kelling (Blue Shift)   September 27, 2010 at 10:00 am

    I know of a large Global 1000 company that for various reasons is running older ERP/CRM/HRMS systems for which the only supported browser is IE6.

    This company wants to purchase and roll out Windows 7, but they can not do so until they have a solution for IE6. They had concerns about the “XP Mode” feature and wanted to use application virtualization as the mechanizsm for IE6 support with Windows 7.

    I undertand that Microsoft has concerns (rightfully so) about being able to support an EOL browser with security concerns. But this also places maddening restrictions on companies who want to roll out Windows 7. Companies do want to move away from IE6, but in many cases it’s not that easy and major applications have to be upgraded before this can be done. MSFT should offer more flexibility here if they want companies to upgrade to Windows 7 also.

  • 8 Louw Pretorius   September 27, 2010 at 1:57 pm

    We are looking at App-Virtualisation and Virtual Desktops as our future but if MS is going to start acting this way what will happen in the future with IE8 ? We would rather make sure our apps work properly with “compatible” browsers than worry forever about an EULA that could be interpreted any which way that profits Microsoft.

    App Virtualisation is here to stay maybe Microsoft is not.

  • 9 Neil MacDonald   September 28, 2010 at 1:48 pm

    @Louw,

    You are correct. This is not just an IE6 issue.

    Microsoft takes the same position on IE8 (and the upcoming IE9) and, unless there is sufficient customer demand and negative feedback to make them reconsider, nothing changes.

    At this point, I would not plan on Microsoft changing this policy.

    The best I would hope for would be for Microsoft to not go after (actively or passively) customers that choose to use application virtualization to package IE.

    One strategy to consider implementing now would be a multi-browser “standard” (ie not limiting users to a single browser). This will provide the most flexibility in options moving forward (more details on this in the RN I referenced in the blog post)

  • 10 David   October 6, 2010 at 1:12 am

    How about turning this around? Why are companies still using EOL products or applications that lock them down to a specific product release?
    In our organization of over 50000 employees, we follow technological developments evaluating new products and releases. For example, Windows 7 has been available since beta1 and everyone had the opportunity to evaluate the product and test the application compatibility of their business applications.
    It is very expensive to evaluate and migrate once every four years or so. Staying with the old legacy applications by virtualizing them through either application or hardware virtualization does not solve anything! It only leads to more legacy applications which may never be migrated for as long as technology allows.

  • 11 Matt Heller   October 6, 2010 at 2:57 pm

    Hi Neil:
    I read your post on the issues surrounding IE6 virtualization. We have an IE8 Add-on in beta that might interest your readers who are looking for a simplified migration to IE8 (we work with all supported platforms – XP/Vista/Win7). Our solution requires no virtualization and isn’t a standalone solution. Our UniBrows™ IE8 Add-on simplifies migrations and allows organizations to upgrade to modern technologies like IE8 and Win7 while maintaining compatibility with existing IE6 web applications—all without changing a single line of code. Unlike any existing solution on the market, we integrate specific IE6 rendering and scripting components into our add-on so the entire solution is integrated with IE8.

    I’d love a chance to discuss our solution in more detail and give you a demo of UniBrows in action if you’re interested. We currently have several large customers beta testing UniBrows and the feedback has been positive.

    Regards,
    Matthew Heller, CEO
    http://www.browsium.com