Use of Group Policy Objects to Administer Internet Explorer
Published: March 20, 2003
Please note: Portions of this transcript have been edited for clarity
Hosts:
- Brad Aiken, Test Manager for IE Sustained Engineering
- Gene, Test lead for Internet Explorer Sustained Engineering
Moderator: Eddy M (Microsoft)
Hello and welcome to today's Chat. Our topic is Use of Group Policy Objects To Administer Internet Explorer. Before we get started, just a few things to note so this chat will go smoothly
Moderator: Eddy M (Microsoft)
We've got a couple of great experts to tackle your questions. Let's introduce our hosts for today
Host: Brad (Microsoft)
Hi, Brad Aiken here, I'm currently the Test Manager for IE Sustained Engineering. Both Gene and I have worked with the IEAK and IEM within GP since the beginning.
Host: Gene (Microsoft)
Hi, I'm Gene, a test lead for Internet Explorer Sustained Engineering.
Moderator: Eddy M (Microsoft)
Excellent! Thanks everyone for joining us today and let's get started! Please feel free to begin posting your questions in the room below.
Host: Gene (Microsoft)
Q: I have a network of 150 machines with varying versions of IE. Can I use GP to update all of them to a current version and then apply new patches when they come out?
A:For corporations, we've released a QFE to distribute Internet Explorer 6 Service Pack 1 through the Software Installation feature of Group Policy. It's called the Internet Explorer Service Pack 1 Setup MSI Wrapper. It's distributed to corporate customers through our Product Service and Support but is not generally available.
Host: Gene (Microsoft)
Q: Is it possible to set a GP that disables user's abilities to alter the IE security settings?
A:While editing a Group Policy, navigate to User Configuration\Administrative Templates\Internet Explorer\Internet Control Panel. There's a policy there you can use to disable the entire Security page in the InetCPL.
Host: Gene (Microsoft)
Q: Regarding the IE6sp1 upgrade package, I used IEAK to deploy IE55sp2 with custom settings and have supplemented that with a GPO for security and proxy settings. Will the upgrade package bring the old settings over? I am wanting to administer IE6 completely through GPOs.
Host: Gene (Microsoft)
A: If you install a new IE package, it will only change the settings previously branded if you customize those settings within the new package. Exceptions to this include browser titlebar, static logos, animated bitmaps, toolbar background bitmap, search bar, online support page, and user agent string, which are always rolled back to defaults.
Host: Brad (Microsoft)
Q: I've set the defaults for some of the programs, like default mail client, to Outlook Express, however the users machines still say Outlook. I have to login to each of them as an administrator, change them to Outlook Express and then they will be okay.
A:Clarifying Q: Are we talking a mix of client OS's? This problem sounds very familiar to me - I'm looking for more.
Host: Gene (Microsoft)
Q: Then how would you recommend the upgrade while resetting all options?
A:When creating the new package, be sure to customize all the features that were previously branded, but customize them to the defaults (or whatever it is you'd like them to be.) Afterward, you should be able to make changes through GP. There are two places where the mail preference could be set. One is through Group Policy, and the other is through the Set Program Access and Defaults option in the Add/Remove programs control panel. I don't know for sure which takes precedence, but it may be possible that this is interfering with branding.
Host: Gene (Microsoft)
Q: Which group policies allow control over which sites a user can access? Is there a way to block all but certain sites?
A:You can do this by setting Approved Sites through Content Advisor by importing the Content Ratings settings in User Configuration\Internet Explorer Maintenance\Security and adding a list of approved sites.
Host: Brad (Microsoft)
Q: Which group policies would I need to set to make sure my users cannot customize their browser look?
A:Administrative Templates - You'd need to do a combination in Admin Templates and then lock down the control panel so users can't change your setting
Host: Brad (Microsoft)
Thanks for the great questions, well do this again soon.
Host: Gene (Microsoft)
Thank you everyone! Bye.
Moderator: Eddy M (Microsoft)
Be sure to visit the Windows Server Community portal for newsgroup information, future chats, and answers to frequently asked questions: http://www.microsoft.com/windowsserver2003/community/
Moderator: Eddy M (Microsoft)
Thanks for joining us today and thanks for the questions. You'll be able to find the transcript of this chat soon on http://www.microsoft.com/technet/itcommunity/chats/trans/default.asp
Moderator: Eddy M (Microsoft)
Bye everyone!
For further information on this topic please visit the following:
Newsgroups: http://www.microsoft.com/technet/community/newsgroups/desktoppt/ie.mspx
IE Transcripts: Read the archive
Website: Visit the home page for Internet Explorer