Internet Security Settings....Automation Possible?

Element-Xero · Dec 7, 2005

Hey,

Basically what I am trying to do is create some sort of executable file that will autoconfigure Internet Explorer with the few settings necesary to allow it to work with our web application.

In the Advanced Tab I need to turn on:

Enable Install on Demand (Internet Explorer)
Enable Install on Demand (Other)
Empty Temp. Internet Files when Browser is Closed

I need to set all ActiveX settings in the Security Tab to "Enable".

and finally I need to add our website to a list of trusted sites.

Logically it would seem like a huge security flaw on M$'s part if this was possible. But if it was possible it would save us a lot of micromanagement on simple installs.

Any input/suggestions/discouragement?

-e-x-

su root · Dec 7, 2005

This is stretching my memory a bit, but I believe you can push down those settings via a domian group policy. Besides that, you could probably accomplish it via a registry file import.. just need to find where those settings are changed in the registry.

I would not recommend this on any system, in fact, I would highly suggest the opposite settings, and the complete switch to another browser.

Smokeys · Dec 7, 2005

Googling for internet explorer security settings registry

Finds this MSKB article: http://support.microsoft.com/?kbid=182569

I also highly suggest making these sort of changes to the trusted site zone and add in any sites to the list.

Element-Xero · Dec 8, 2005

su root said:
This is stretching my memory a bit, but I believe you can push down those settings via a domian group policy. Besides that, you could probably accomplish it via a registry file import.. just need to find where those settings are changed in the registry.

I would not recommend this on any system, in fact, I would highly suggest the opposite settings, and the complete switch to another browser.

I hate IE. I don't use it for anything. However, my company has chosen to develop a web application based around it, so the choice has already been made and I'm stuck with it

I thought about the group policy thing, but I doubt any of the businesses I'll be dealing with have IT people on-site, and would never give the end-users domain admin.

Thanks for the MS article though, I'm going to read it now.

Element-Xero · Dec 8, 2005

Ok that was great info, I found most of the registry entries that I needed to edit.

However, I can't seem to find the path to the entries that pertain to the "Advanced" tab in IE setup. I need to set the "Enable Install on Demand" values to 1 (enabled).

Also the "Settings" tab, to set the Space usage, etc.

Any ideas on where to find this?

Smokeys · Dec 8, 2005

For Install on Demand the key you want is HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\BROWSE\IOD I believe its CheckedValue.

I can't seem to find the key for the settings tab but use Regmon and change settings to see if you can capture what is being changed.

Element-Xero · Dec 8, 2005

Wow that tool is amazingly useful. Thanks so much for linking it.

I think I worked all of my problems out.

One more question, if you don't mind:

in this value

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Will the settings that I insert there pertain to ONLY trusted sites? As I understand the "3" zone is trusted site settings only. Is this true or is my logic convoluted?

Smokeys · Dec 8, 2005

No, here's the table from the MSKB article:

Code:

   Value    Setting
   ------------------------------
   0        My Computer
   1        Local Intranet Zone
   2        Trusted sites Zone
   3        Internet Zone
   4        Restricted Sites Zone

You want Zone 2, Zone 3 is for any site not listed in Local, Trusted or Restricted zones. Basically every page on the internet.

Element-Xero · Dec 8, 2005

Thanks for the sanity check, I saw the table but transposed the values.

I made a batch job that fires off my reg settings and copies/registers a bunch of files to %systemroot%/system32.

The fact that I can set these admittedly insecure settings to trusted sites only is actually a huge boost to our current method of installation.

Thanks much guys.

Smokeys · Dec 8, 2005

No problem, unfortunatly learned a bit of IE management on the way

Element-Xero · Dec 9, 2005

I'm gonna spam-bump this thread one more time for a question:

The key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Security_HKLM_only with DWORD = 1 is supposed to make HKLM settings override any HKCU settings.........

Any confirmation of this? Apparantly it doesn't show up as HKLM settings in IE's setup menus but it still works "below the surface".

Thanks for any assistance.

Smokeys · Dec 9, 2005

If the Security Zones: Use only machine settings setting in Group Policy is enabled, or if the Security_HKLM_only DWORD value is present and has a value of 1 in the following registry key, only local computer settings are used and all users have the same security settings:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

With the Security_HKLM_only policy enabled, HKLM values will be used by Internet Explorer, but the HKCU values will still be displayed in the zone settings on the Security tab in Internet Explorer. This is by design and there are no plans to change this functionality.

From: http://support.microsoft.com/?kbid=182569

Element-Xero · Dec 9, 2005

Great so that should work for creating global settings for all users.

Thanks

OCforums has literally answered every single question I've ever had in the last five years. Rock the eff on.

_\m/

Internet Security Settings....Automation Possible?

Element-Xero

Member

su root

Senior Member, --, I teach people how to read your

Smokeys

Member

Element-Xero

Member

Element-Xero

Member

Smokeys

Member

Element-Xero

Member

Smokeys

Member

Element-Xero

Member

Smokeys

Member

Element-Xero

Member

Smokeys

Member

Element-Xero

Member

Similar threads