Managing Users: Internet Explorer Administration Kit Profile Manager
The Internet Explorer Administration Kit Profile Manager can be used to create and maintain the automatic configuration files. With the Profile Manager, administrators can specify a wide range of browser, user, desktop, and system settings and restrictions. The Internet Explorer Administration Kit Profile Manager is used to maintain Internet Explorer 5 policies over time.
Sets of Policies and Restrictions are saved as an .ins file. These .ins files are created into two places for each package during the Internet Explorer Administration Kit Customization wizard. The first location is in the INS subdirectory, for instance, "c:\builds\Corporate\INS\Win32\En\Install.ins." The other location is the CD subdirectory. Different .ins files can be created to reflect different administration and configuration requirements for an organization. Different packages can be created to distribute to each group in an organization, or the .ins file can be manually specified on the browser.
The Profile Manager is organized into a left-hand pane showing a hierarchical tree of objects and a right-hand pane showing the options. After creating a new .ins file or opening one of the install.ins files created by the Internet Explorer Administration Kit, an object in the tree in the left-hand pane is selected and the options and settings for that object appear in the right-hand pane. Administrators can change options or specify settings as necessary to manage automatic browser configurations.
The Internet Explorer Administration Kit Profile Manger provides two categories of settings that can be specified: Wizard Settings and System Policies and Restrictions.
How Profile Manager Works
The Internet Explorer Administration Kit Profile Manager creates and edits instruction (.ins) files. These .ins files are then specified in the browser under View/Internet Options/Connections/Automatic Configuration. The .ins files can be locally stored, i.e., c:\config.ins, or they can be stored in a Web location, such as http://www.acmecorp.com/ie5/config/autoconfig.ins. The .ins file gets checked either at a specified interval, such as every 720 minutes, or every time the browser is started if no interval is specified.
Because the location of this file will have to be specified before it is actually created, it is a good idea to plan out the name(s) of the configuration files and their locations in advance. The Internet Explorer Administration Kit lets administrators pre-configure browsers with the URL of an .ins file, but this file is not created during the Internet Explorer Administration Kit process. A default install.ins file is created in the path c:\builds\<build_number>, but this file should be edited and renamed before distribution. As mentioned in earlier sections, it is a good idea to rename .ins files, as the Internet Explorer Administration Kit creates numerous instances of install.ins. Edits made to these files can easily get lost or confused unless the file is renamed. When the .ins file is edited, .cab files may also be created that will need to get copied to the Web distribution location.
Changing Wizard Settings
In the left-hand pane, the Wizard Settings object and its sub-objects correspond to settings that can also be specified using the Internet Explorer Administration Kit Customization wizard. An object can be selected and the corresponding options and settings can be changed. For example, the Browser Title object and Browser Title bar and Toolbar background bitmap options can be selected and changed.
Changing System Policies and Restrictions
In the left-hand pane, the Systems Policies and Restrictions object and its sub-objects correspond to the same settings available on the Internet Explorer Administration Kit Customization wizard System Policies and Restrictions page. Administrators can select an object and change the corresponding policies and restrictions. For example, the Web Desktop tree can be expanded, and the Desktop object can be selected to specify Desktop options such as Do not allow changes to Active Desktop.
The System Policies and Restrictions folder contains nine default policy template (.adm) files to specify policies and restrictions. These are saved to information (.inf) files, which are packaged into the automatic configuration companion cabinet (.cab) files for download to a user's system. When unpacked, the .inf files are used to change policies and restrictions on users' systems.
The first time either the Internet Explorer Administration Kit Profile Manager or the Internet Explorer Administration Kit Customization wizard is run, it creates the nine default policy template (.adm) files in the C:\Program Files\Ieak\Policies directory. When changes are saved to system policies and restrictions, the Internet Explorer Administration Kit Policy Manager saves the changes to the .inf files and packages them in cabinet (.cab) files. The two possible cabinet files are branding.cab and desktop.cab. If these .cab files are created, then they need to be copied to the Web distribution point where the automatic configuration .ins file resides.
Administrators can specify desktop, shell, and security settings across an organization. Numerous settings can be customized, ranging from whether users can delete printers to whether they can add items to the Windows Desktop Update.
Administrators can control or "lock down" features and functions. For example, use the System options under the Shell category to prevent Windows 95 users from restarting their systems in MS-DOS® mode, or use the Security option under Internet Properties to prevent users from changing any of the security settings on the Security property page in Internet Explorer. When features are locked down, they either don't appear or they appear in gray type on the user's desktop.
Before changing system policies and restrictions, administrators should understand the impact of the security settings on users, especially if roaming users will be sharing computers with other users. Consider for example, the implications of removing icons from the desktop, or not allowing users to change their security settings. These policies should be clearly communicated to the users before deploying any changes to the organization.
Using Custom Policy Templates
Administrators familiar with Windows policy template (.adm) files can create their own templates to define additional restrictions. Policies and restrictions, and policy template (.adm) files are a standard feature of Windows 95 and Windows NT operating systems. For more information, see the Windows documentation.
Administrators can choose Import on the Policy menu to import custom policy template (.adm) files. Choose Check Duplicate Keys on the Policy menu to check for duplicate registry keys in the templates and to delete any duplicates from the templates. Always test templates thoroughly in the lab before using them to make changes to users' systems.
When administrators use custom policy templates, the Internet Explorer Administration Kit Profile Manager generates an .inf file using the file prefix for the imported custom template. For example, when custom.adm is imported, a custom.inf file will be generated and added to the companion .cab files.
Maintaining Automatic Configuration Files
During the installation wizard, an Install.ins file was created in the c:\builds\<build_number>\Ins\Win32\En subdirectory. This file needs to be copied to the location specified during the Customization wizard and renamed to the name specified in the CW. In this example, the file was renamed to autoconfig.ins and copied to the path c:\inetpub\wwwroot\ie5\config.
To maintain automatic configuration files, administrators can open the .ins file in the Profile Manager, change settings, and save the .ins file. The Profile Manager keeps the companion files current each time the .ins file is saved.
Caution: Files should not be maintained on the production server. Administrators should copy the .ins file) and their companion files from the production location (such as c:\inetpub\wwwroot\ie5 to a working directory, modify the files as necessary, and test automatic configuration in a lab to verify that automatic configuration changes work as intended. After changes have been validated, update the automatic configuration files on the production server.
Setting Up Automatic Configuration in Previously Deployed Browsers
Clearly it is advantageous to use the Internet Explorer Administration Kit to customize Internet Explorer 5 so that automatic configuration is enabled before the browser is deployed. If that is not possible, users will have to perform a simple task to enable automatic configuration. Once these steps are performed, the Internet Explorer Administration Kit Profile Manager can be used to lock these settings down so users will not be able to change them.
To set up Internet Explorer 5 for automatic configuration, users need to do the following:
From the Internet Explorer window, choose Internet Options on the View menu.
Select the Connections property page, then select a connection (such as LAN or a Dial-up).
Select either LAN Settings or Settings.
Type the URL automatic configuration file name in the Autoconfiguration URL section.
Connections configuration tab in Internet Explorer.
Note: Some automatic configuration changes require the system to be restarted before changes to the system registry will take effect.