Update: Now that I have installed the final version of IE9 on 6 computers 2 of them needed to rebook so it would seem that it may or may not require a reboot. This seems to be dependent on what application you are running at the time. Therefore it would still be prudent to plan for a reboot but not always expect it to happen.

I have just install IE9 on a Windows 7 and a Windows Server 2008 R2 computer running Service Pack 1 and I was very pleased to see that in both cases it does not required a reboot to install. Previously I have installed IE9 on 3 Windows 7 computers that were not running service pack 1 however they all required a reboot to install IE9. Therefore it seems that with Windows 7 / 2008 R2 Service Pack 1 installed it is now possible to install IE9 without a reboot. (see images below).

Disclaimer: I have only seem this behaviour on one computer so far but I am testing it one more really soon. I have now repeated this process on a Windows Server 2008 R2 SP1 and Windows 7 SP1. It looks more likely that this option to install IE9 without a reboot is a new feature of Service Pack 1.

One of the dialogue boxes (see below) on Windows Server 2008 R2 Service Pack 1 during the IE9 install asks if you want to the installer to close your running programs to install it without a reboot. So if you select the “Close programs for me (I already save my work)” opting the browser will be installed without a reboot.\

( FYI: The screenshots below are from a computer running Windows Server 2008 R2 Service Pack 1 with the Domain Controller role installed and running. )

The next screen is the dialogue box during install of IE9. As you can see IE8 and the Explorer shell has been closed during the install but the OS has NOT rebooted.

After IE9 is installed the Explorer Shell is launched again still without interruption to the OS.

This is a huge deal as it means that it is likely that updates to the browser will be able to be installed without having to require a reboot of the OS. Now this may be a nice have for end users however this is a much bigger deal for Windows Servers as IT administrators as they can now patch what is the most vulnerable part of the server OS (the browser) without any down time. This should hopefully mean that IT administrators will not need to revert to installed “Server Core” versions of the server OS’s just to ensure that they don’t have to reboot them every patch Tuesday to keep them secure.

I know this is not specifically a Group Policy topic however this is a really super cool find that I just had to share with everyone…

KB2379592 – "Object reference not set to an instance of an object" error message when you view the GPO backup settings in the Group Policy Management Console.

Description

Resolves an “Object reference not set to an instance of an object.” when you select the “View Settings” of a GPO that has an advanced audit policy setting configured that you have also backed up.

KB970840 – Some settings in Group Policy Preferences for Internet Explorer do not deploy correctly to computers that are running Windows Server 2008, Windows Vista, Windows 7 or Windows Server 2008 R2

Description

Resolves the following IE8 preference settings from not working:

• Check boxes under Accessibility
  • "Reset text size to medium while zooming"
  • "Reset Zoom level to 100% for new windows and tabs"
• Check boxes under Security
  • "Allow active content to run in files"
  • "Allow software to run or install even…"
• Check boxes under International
  • "Send IDN Server Names"
  • "Send UTF -8 URL"
  • "Show information bar for encoded address"

It also resolves a freeze/crash in the Group Policy Object Editor when you are editing an Internet Explorer Group Policy Preferences setting.

This policy will remove remove the search box from Internet Explorer (see image below).

But then when a user logs on to the computer for the first time they are prompted to setup their default IE setting and then they will get this error message (see image below).

It also looks like this hotfix is also probably not going to be in Windows 7 Service Pack 1 as it is not listed in the complete list of hotfixes.

To download the hotfix and to get more info visit Internet Explorer 8 restores the search provider settings when the “Prevent Internet Explorer Search box from displaying” Group Policy setting is enabled

Luckily there is an option in the Internet Explorer Maintenance group policy section that allows you to configured an allow/never list of URL’s for your users. If you are configuring this option I also suggest your also check out one of my other article How to configure AppLocker Group Policy in Windows 7 to block third-party browsers to prevent users from running non-IE browsers to get around this restriction as this is an IE only policy setting.

How to configure Internet Explorer to Allow and Block URL’s

Step 1. Edit a Group Policy Object (GPO) that applies to the users you want to configure URL blocking.

Step 2. Navigate to User Configuration > Policies > Windows Settings > Internet Explorer Maintenance > Security and then click on the “Security Zones and Content Ratings”

Step 3. Select “Import the current Content Ratings settings” and then click on the “Modify Settings” button

Step 4. Click on the “Approved Sites” tab

Step 5a (Black List). Type the name of the URL that you want to block in the “Allow this website” text field and then click “Never” then “OK”

Step 5b (White List). However if you are trying to maintain a white list of URL’s then type the name of the site you want to allow it the “Allow this website” text field and then click “Always” then “OK”

Note: You will probably want to add the internal domain name of your companies AD to the Allow list of as well to ensure users can access the intranet web sites. Also note that while wildcards are supported in the URL’s, but adding just the URL “*” does not work. While this would be very handy to configure a white list I will show you how to get around this restriction in further steps below.

Now we have to create a supervisor password that will be used for making any subsequent changes to the Allow/Never URL list. This password can also be used by the user (if they know it) to work around these URL restrictions. However as this password is applied by policy it will be the same password for all users so think about chancing the password often.

Step 6. Type the same password in both the “Password” and “Confirm Password” fields and type at hint in the “hint” field. You could also type something like “To get this password please contact the help desk on 5555-5555”.

By default when you enable the content advisor it will automatically block any web site that does not have a rating configured.  Therefore you will want to turn this blanket restriction off in step 8 if you all you are trying to do is block specific URL’s in a black list configuration.

Step 8 (Black List). Tick “User can see websites that have no rating” then click “OK”

Note: For white list configuration leave the “User can see websites that have no rating” un-ticked so that all web sites will be blocked.

Step 9. Click OK

Done.

If you configured a black list then a user will be allowed to go to all web sites except the URL that you specifically blocked. When the user does hit a web site that is blocked they will be presented with dialogue box explaining why they are not able to visit the web site and an option to visit the site only if they know the supervisor password.

If they click Cancel nothing will happen and if they press OK they will get presented with this dialogue box.

Below is another example message that is presented when visiting a site without a rating and you have configured the policy not load sites that do not have a rating which you will see if you have configured this as a white list.

If you are using a white list configured and a users will still be able to visiting as site so long as it is ICRA3 rated and it does not report as having content that falls into any of the rating categories. Therefore this method is not 100% affective for a white list strategy but you do find your users visiting a site that is not specifically allowed then you can simply added it as a blocked URL.

Related Resources:

If you have played with this setting and are looking for a way to remove this setting from the group policy then see my posting How to remove imported Internet Explorer Group Policy Settings

You will also find that the computer you have made these URL restrictions on will now have the supervisor password set (I assume its something about how IEM GPMC interacts with the local computer) so to Remove IE Supervisor Password just delete the HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\Current Version\Policies\Ratings key and it will reset the Content Advisor settings back to defaults.

Just to recap in Part 1 I showed you how to configure home page setting using the administrative templates native policy and in Part 2 I showed you how to do this using Group Policy Preferences.

In this post I will show you how to configured Internet Explorer home page settings using the Internet Explore Maintenance (IEM) group policy setting option. The IEM policy setting has been in Group Policy since the very beginning and is now a depracated setting as you can tell by the now various other methods of configuration home pages as outlined in Part 1 and Part 2. So if you are configuring this as a new setting definitely look at using the native Administrative Template or Group Policy Preferences first.

However the one advantage of using IEM is “Preferences Mode”…… Huh… I hear you… Well this is the OTHER Group Policy Preference (see below) and this option only applies to Internet Explorer Maintenance settings. The advantage of the Preferences Mode settings is that once the home page is configured the user will be able to change the home page to their own “Preference”.

(Now this might seem alright, however you need to wait till the end to find out why this is really cool…)

To configured the home page edit a Group Policy Object (GPO) that is targeted to the users you want to configured. Then navigate to User Configuration > Policies > Windows Settings > Internet Explorer Maintenance > URLs and double click on “Important URL”.

Now simply tick “Customize Home page URL” and type the URL you want configured as the home page in the “Home page URL:” text box.

Now the users home page will be configured to the URL you configured above.

Now this is the SUPER COOL thing about setting… If you have enabled Preferences Mode and you configured the “Disabled changing Secondary Home Pages setting” that I talked about in Part 1 your users will be able to make a change the Primary Home but you can still force the URL of any of the secondary home page tabs (see image below where the users has change the Primary home page to Yahoo but the Google Secondary page remains). AWESOME!

Note: If you already have a setting configured in IEM then you will first need to “Reset Browser Settings” before you can enabled “Preferences Mode” which you can do by following these instructions How to remove imported Internet Explorer Group Policy Settings

For more information on Preference Mode see http://support.microsoft.com/kb/274846

For more information on Internet Explorer Maintenance setting see  http://technet.microsoft.com/en-us/library/cc728150(WS.10).aspx

Step 1. Edit the Group Policy object that applies to all the user accounts you want to migrate this issue.

Note: If you want complete coverage of all users in your organisation then make this change the the default domain policy or another policy link to the top of the domain.

Step 2. Navigate to User Configuration > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Intranet Zone and enabled the “Turn on Cross-Site Scripting (XSS) Filter” then ensure you set the drop down menu to “Enabled” then press OK.

To confirm the setting is applied you should now see that the “Enable XSS filter” option is configured to “Enabled” and it is greyed out as the setting has now been configured by group policy.

Unfortunately this setting cannot be enabled via Group Policy Preferences as you can see if does not have the XSS filter option.

To keep up to date with this issue and for more information on this issues see http://blogs.technet.com/msrc/archive/2010/04/29/security-advisory-983438-released.aspx and http://www.microsoft.com/technet/security/advisory/983438.mspx

Method 1. Modify the Access Control List (ACL) on iepeers.dll

Step 1. Edit a Group Policy Object (GPO) that is targeted to the computer accounts you want to apply this setting. Then navigate to Computer Configurations > Windows Settings > Security Settings > File System.

Step 2. Click on “Action” in the menu and then “Add File…”

Step 3. Type “%WINDIR%\System32\iepeers.DLL” into the Folder: field then click “OK”

Step 4. Click “Add”and then add the “Everyone” group and click “OK”

Step 5. Tick the Full Control “Deny” tick box. This will then tick all the Deny tick boxes.

Step 6.  Click “Yes” to the Deny warning.

Step 7. Click “OK” to the permissions option.

Note: If you want to apply this to x64 version of Windows as well repeat step 2 thought 7 but type “%WINDIR%\SYSWOW64\iepeers.DLL” instead in the Folder: field.

You have now denied permissions to the file that has the issues.

Once you have applied the patch to fix this vulnerability be sure to go into each of file security settings and remove the “Everyone” deny permission from the setting.

Method 2: Configure Internet Explorer to prompt before running Active Scripting or to disable Active Scripting in the Internet and Local intranet security zone

Step 1. Edit a GPO that is targeted to the users accounts you want to apply security setting. Then Enabled both the “Allow active scripting” under User Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer > Security Page > Internet Zone and the Intranet Zone. Then configure the Options to either “Prompt” or “Disable”.

Once you have performed the above configuration changes be sure to add *.windowsupdate.microsoft.com, *.update.microsoft.com and any other site you require to run Active Scripting on to the trusted sites zone list. Instructions on how to do this can be found here How to use Group Policy to configure Internet Explorer security zone sites

Disclaimer: I do not guarantee that this information will work. All the above information is to be used at your own risk.

For more details on the security vulnerability and other ways to mitigate this issue see Microsoft Security Advisory (981374)

For details on getting the hot fix and to see the full article “The “Configure new tab page default behavior” Group Policy setting does not work on a computer that is running Windows 7 or Windows Server 2008 R2 and that has Internet Explorer 8 installed” here http://support.microsoft.com/?kbid=980959

Note: This does not prevent users from running Firefox or Chrome to get around this restriction (although they would have difficulty in downloading it) therefore you may also want to consider deploying AppLocker or Software Restriction Policies to prevent the running of those apps.

To enable this restriction you need to first “Enable” the policy and then set the Allow file downloads option to “Disable” . This setting can be found under Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page > Internet Zone. This setting can also be configured on the other zone’s under the Security Page section however the Internet Zone is what most web sites are classified as and therefore will have the largest affect.

When this policy is applied to a user and the user clicks on a hyperlink to a file to download they will then receive this dialogue box.

If you did enabled this setting and you wanted to let users download file from particular web sites you could add the site URL to the trusted sites zone list. I have previously blogged how to do here http://www.grouppolicy.biz/2010/03/how-to-use-group-policy-to-configure-internet-explorer-security-zone-sites/

P.S. Sorry i am a day late with this one… have been a bit busy lately. But don’t worry i will make sure that i always have time to do a setting of the week post each week.

The Internet Explore site zone assignment is one of the few settings you specifically can’t configured using preferences, as you can see (image below) the User Interface to this options has been disabled.

There is a native Group Policy that allows you to control Internet Explorer site zone list is called “Site to Zone Assignment List” which I will go thought below how to use.

Step 1. Edit the Group Policy Object that is targeted to the users you whish this setting to be applied.

Step 2. Navigate to User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page and double click on the “Site to Zone Assignment List” and check the “Enable” option then click on the “Show..” button.

Step 3.  Now type the URL in the “Value name” field with the >* on the far left and then type the zone number (see table below) you want to assign to that zone.

Internet Explorer Group Policy Zone Number Mapping

As soon as you start typing the URL a new line will appear for the next URL.

Step 4. One you have finished assigning adding the URL’s and site zone number click OK

Tip: If you want to delete a row click on the button on the far left to select the row you want to delete (see image below) and then press the “Delete” key.

(sites in above list are example only)

Now the Internet Explorer Site zone list will now be populated with the zone you configured above and as you can see in the images below the Internet Explorer status bar now show the correct zone based on the that the URL’s in the address bar.

The advantage of using Group Policy Preferences is that it allows you to specify a default home page but still allow users to change it if they want.

Now there are three dialogue Internet Explorer setting that can be used to configured home pages in Group Policy Preferences.

Internet Explorer 8	Internet Explorer 7	Internet Explorer 5 and 6

However as you can see the IE7 and IE8 screens are exactly the same so I will only go thought it using IE8 and the IE5/6 screenshots. If you do want to configure the IE8 setting remember that you will need to use the Internet Explorer 7 screen option instead however all the steps and affects are the same.

Internet Explorer 5 & 6

Internet Explorer 5 & 6 does not support tabbed browsing so this makes it a lot simpler to setup as all you can specify a default home page. Also remember that the Group Policy Preferences Client Side Extensions are are not installed on Windows XP by default so you will need to make sure they are installed before these settings will work.

Step 1. Edit a GPO that targets the users that you want to apply the home page setting.

Step 2. Navigate to User Configuration > Preferences > Control Panel Settings > Internet Settings

Step 3. Click on the “Action” menu and click on “New” and then click on “Internet Explore 5 and 6”

Step 4. Press “F6”

Explanation: Pressing “F6” enables the individual settings for configuration. Notice this changes the red dotted line to a solid green line which means that only the “Home:” settings is enabled to be applied as a policy.

Step 5. Now type your home page URL in the “Home” text box and click “OK”

Your done.

Now as this is a preference this will not prevent you users from changing the home page however it will be reset at the next group policy refresh.

Internet Explorer 7 & 8

Internet Explorer 7 & 8 supports multiple tabs so you need can either configure a single default home page or a default home page with multiple secondary home page.

Step 1. Edit a GPO that targets the users that you want to apply the home page setting.

Step 2. Navigate to User Configuration > Preferences > Control Panel Settings > Internet Settings

Step 3. Click on the “Action” menu and click on “New” and then click on “Internet Explore 8” (or “Internet Explorer 7”)

Step 4. Press “F6”

Step 5. Now add the URL (or URL’s) for the pages you want to be displayed and click “OK”.

Note: If you only specify one home page then the user will be able to change the home page however it will reset after the next policy refresh.

Again… your done.

As you can see below your browser is configured with two default home pages.

Note: Native Group Policies always take precedence over Group Policy Preferences so if you have you home pages configured using a native Group Policy (see Part 1) then this settings will be overridden.

In Part 2 I will explain how to configure home page setting using Group Policy Preferences and in Part 3 will explain how to configure home pages setting using the Windows Setting > Internet Explorer Maintenance option.

The advantage of using a native group policy setting is that they do not require the deployment of the Group Policy Preference client side extensions and the setting are enforced so the user cannot change the setting even temporarily.

Primary Home Page

This option allows the admin to configured a single home page for the user without the ability for the user to add any other secondary home pages if they are using IE7 or IE8. This setting will also work however if the users has IE5 and above installed.

Step 1. Edit a GPO that targets the users that you want to apply the home page setting.

Step 2. Navigate to User Configuration > Policies > Administrative Templates >Windows Components > Internet Explorer

Step 3. If you want to configure a single home for your users and/or you are using IE5 or IE6 edit the “Disable changing home page setting”

Step 4. Select “Enabled” and then type the URL you want as the home page in the “Home Page” text field.

Now the user browsers will be hardcoded to use only http://www.bing.com as the home page and the UI to make this change will be disabled.

Multiple Tabs

This option allows the admin to specify the users secondary home pages while still allowing them to configured the default home page.

Note 1: This policy setting will not work with IE7 that does support secondary home pages.

Note 2: This policy setting will not work if you have the “Disable changing home page settings” also enabled.

Step 1. Edit a GPO that targets the users that you want to apply the home page setting.

Step 2. Navigate to User Configuration > Policies > Administrative Templates >Windows Components > Internet Explorer

Step 3. If you want to configure a single home for your users and/or you are using IE5 or IE6 edit the “Disable changing secondary home page setting”

Step 4. Select “Enabled” and Click on “Show…”

Step 5. Click in the text field next the the * and type the URL that you want to add as a secondary home page. You can repeat this for as many secondary home pages that you want.

The user will now have http://www.yahoo.com and http://www.microsoft.com load as their secondary home pages and they will be able to change their default primary home page by using the”Add or Change Home Page…” option (see image below).

However They will not be able to add or change the secondary home pages which means that the “Add this webpage to your home page tabs” (see image below) option will NOT work.

This also means the UI under “Internet Option” for changing the “Home Page” will also be disabled.

I really like the secondary home page option as it allows users to customise their home pages setting why still ensuring they load the corporate home page each time they open their browser.

Even so if you are still running Internet Explorer 6.0 on Windows XP (yes there  are some corporations that do) it is STRONGLY recommended that you install this patch ASAP. Needless to say if you are still running IE6 on Windows XP then you also need to look at updated to IE7 or IE8. Besides the more compliant HTML rendering engine that the newer browsers offer they are also much more secure. If you happen to be running Vista (yeah for you!) then the risk is about 256 times less likely to affect you due to the extra protection the OS offers such as Protected Mode and Address Space Layout Randomisation (ASLR). Windows 7 users are even more secure as on top of Protected Mode and ASLR as Internet Explorer also has Data Execution Protection enabled by default.

So while your making yourself more secure installing this patch be sure to also check out my other article showing how to turn off JavaScript for Adobe Reader one of the other reported attack vectors for the Google Hack.

For more information about the http://www.microsoft.com/technet/security/bulletin/ms10-002.mspx

Update: This security issues was orignal posted as KB979352