Microsoft on Wednesday released a tool that will let enterprises indefinitely postpone upgrading to the new Internet Explorer 7 browser when it debuts later this year.

Although IE 7 for Windows XP remains in beta testing, the company wanted to offer the blocker now, said Gary Schare, director of product management for IE, because of lessons learned.

"We issued a blocker for Windows XP SP2 after the fact, but it was late in the game," Schare said, talking about a tool that Microsoft rushed into customer's hands in 2004. "With IE 7 we want to give enterprises ample time to deploy the blocker toolkit so that they can test IE 7 on their timeline."

A blocker was also issued in 2005 for Windows Server 2003 SP1 that let enterprises fend off the update until March of this year.

Microsoft's issuing the tool because it plans to distribute IE 7 using its Automatic Updates mechanism. The browser will be tagged as a "high priority" update, which means that everyone using Automatic Updates will receive a notification, no matter what settings they've applied. However, all users will also be given a clear opt-out opportunity, Schare stressed.

"We're certainly recommending that everyone update to IE 7, but it has new features and provides a new [browsing] experience, so we want to give everyone a chance to opt-out."

Users will see a dialog box before IE 7 installs that gives them three choices: Install, Don't Install, or Ask Me Later.

In earlier updates -- such as Windows XP SP2 -- Microsoft had been surprised by the number of corporate customers who had users running Automatic Updates, and was caught unprepared by demands for a download blocker. "We underestimated the demand with XP," Schare acknowledged.

"This is not the usual kind of update," Schare said, noting that Microsoft was trying to clarify how it decides whether to push out an upgrade via Automatic Updates. If an upgrade offers significant security enhancements, said Schare, Microsoft feels justified in pushing it out to everyone. Not surprisingly, he said IE 7 fits that bill. The browser has been touted by Microsoft as a much more secure than its five-year-old predecessor, IE 6, and includes new security features including anti-phishing protection, .

The Redmond, Wash. developer came under fire earlier when it used Automatic Update to deliver its Windows Genuine Advantage (WGA) anti-piracy software, and called it a "critical" update. Later, Microsoft reacted to pressure by changing the classification to "high priority," the same as IE 7 will use.

Unlike with previous blocking options, Microsoft won't set an expiration date for the IE 7 stopper, so enterprises can ward off the browser indefinitely. Support for IE 6 on Windows XP will abide by Microsoft's 5+5 rule, said Schare, so businesses can steer clear of IE 7 as long as they want. Microsoft guarantees that IE 6 will not leave mainstream support until September 2009 -- 5 years after its 2004 appearance as part of Windows XP SP2; after that it will continue in extended support for another 5 years.

Users who rely on Automatic Update -- generally consumers and small businesses -- will start seeing the IE 7 offer "a couple of weeks after" the browser is released and posted to download areas of Microsoft's Web site, Schare said. That will follow one -- and only one -- release candidate (RC in Microsoft nomenclature) that Microsoft's shooting to deliver sometime this quarter. The final is scheduled for 2006, but Schare would not get specific other than to put it into the fourth quarter.

"The release candidate won't look much different than Beta 3, but there will be some changes under the hood," Schare said.

He wasn't sure how the final posting of IE 7 through Automatic Update would be synchronized with the usual second-Tuesday-of-the-month patch release, but said the former may be timed to avoid the latter.

The blocking toolkit can be downloaded from the Microsoft Web site, and includes both a Group Policy template and an executable script enterprises can run to keep IE 7 off their PCs.