Group Policy Central

I know a lot of people have asked for this third an final instalment on how to use Group Policy to manage home page settings and so I have finally been able to find some time to finish this series of posts.

Just to recap in Part 1 I showed you how to configure home page setting using the administrative templates native policy and in Part 2 I showed you how to do this using Group Policy Preferences.

In this post I will show you how to configured Internet Explorer home page settings using the Internet Explore Maintenance (IEM) group policy setting option. The IEM policy setting has been in Group Policy since the very beginning and is now a depracated setting as you can tell by the now various other methods of configuration home pages as outlined in Part 1 and Part 2. So if you are configuring this as a new setting definitely look at using the native Administrative Template or Group Policy Preferences first.

However the one advantage of using IEM is “Preferences Mode”…… Huh… I hear you… Well this is the OTHER Group Policy Preference (see below) and this option only applies to Internet Explorer Maintenance settings. The advantage of the Preferences Mode settings is that once the home page is configured the user will be able to change the home page to their own “Preference”.

(Now this might seem alright, however you need to wait till the end to find out why this is really cool…)

To configured the home page edit a Group Policy Object (GPO) that is targeted to the users you want to configured. Then navigate to User Configuration > Policies > Windows Settings > Internet Explorer Maintenance > URLs and double click on “Important URL”.

Now simply tick “Customize Home page URL” and type the URL you want configured as the home page in the “Home page URL:” text box.

Now the users home page will be configured to the URL you configured above.

Now this is the SUPER COOL thing about setting… If you have enabled Preferences Mode and you configured the “Disabled changing Secondary Home Pages setting” that I talked about in Part 1 your users will be able to make a change the Primary Home but you can still force the URL of any of the secondary home page tabs (see image below where the users has change the Primary home page to Yahoo but the Google Secondary page remains). AWESOME!

Note: If you already have a setting configured in IEM then you will first need to “Reset Browser Settings” before you can enabled “Preferences Mode” which you can do by following these instructions How to remove imported Internet Explorer Group Policy Settings

For more information on Preference Mode see http://support.microsoft.com/kb/274846

For more information on Internet Explorer Maintenance setting see  http://technet.microsoft.com/en-us/library/cc728150(WS.10).aspx

As you know Group Policy Preferences are these fantastic new settings that allow IT administrators perform any configuration they want on a users group using Group Policy… well almost..  In this tutorial I will show you how to configured one of the few settings that are not controlled by preferences but can be configured using a native Group Policy.

The Internet Explore site zone assignment is one of the few settings you specifically can’t configured using preferences, as you can see (image below) the User Interface to this options has been disabled.

There is a native Group Policy that allows you to control Internet Explorer site zone list is called “Site to Zone Assignment List” which I will go thought below how to use.

Step 1. Edit the Group Policy Object that is targeted to the users you whish this setting to be applied.

Step 2. Navigate to User Configuration > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page and double click on the “Site to Zone Assignment List” and check the “Enable” option then click on the “Show..” button.

Step 3.  Now type the URL in the “Value name” field with the >* on the far left and then type the zone number (see table below) you want to assign to that zone.

Internet Explorer Group Policy Zone Number Mapping

As soon as you start typing the URL a new line will appear for the next URL.

Step 4. One you have finished assigning adding the URL’s and site zone number click OK

Tip: If you want to delete a row click on the button on the far left to select the row you want to delete (see image below) and then press the “Delete” key.

(sites in above list are example only)

Now the Internet Explorer Site zone list will now be populated with the zone you configured above and as you can see in the images below the Internet Explorer status bar now show the correct zone based on the that the URL’s in the address bar.

Group Policy Preferences have been out for about 3 years now and so there have been a number web posts about what they are and how they are implemented. So I have created a list of links to other articles that from the Group Policy Team Blog and ohter places that help explain what Preference are and how you can use them in your environemtn.

Third Party Links

• MSServerAdmin: The One Reason You Should Use Group Policy Preferences – Printers
• GPO Guy: Group Policy Preferences Overview
• RDP Files: Group Policy Preferences aka GPPs

Microsoft Links

• Microsoft Support: Information about new Group Policy preferences in Windows Server 2008
• TechNet: Group Policy Preferences: Getting Started
• TechNet: Configure, Target, and Comment Preference Items
• TechNet: Preference Item-Level Targeting
• TechNet: Windows Settings
• TechNet: Control Panel Settings
• TechNet: Configure Common Options
• TechNet: Enable and Disable Settings
• TechNet: Variable in Preferences Items
• Group Policy Team Blog: GP Policy vs. Preference vs. GP preferences
• Group Policy Team Blog: Environment Variables in GP Preferences
• Group Policy Team Blog: Troubleshooting: Quick Fixes
• Group Policy Team Blog: GP Preferences Will Reduce Logon Scripts : Mapping Drives
• Group Policy Team Blog: Check a setting in all GPO’s continued (scripts, firewall, GP Preferences and more)
• Group Policy Team Blog: Security Filtering, WMI Filtering, and Item-level Targeting in Group Policy Preferences
• Group Policy Team Blog: How do I migrate PolicyMaker Items to Group Policy Preference Items?
• Group Policy Team Blog: Passwords in Group Policy Preferences (updated)
• Group Policy Team Blog: Red / Green Underlining continued: Using Preferences to set IE settings like preference, or like policy

My take…

Group Policy Preferences are a heap of new Group Policy settings that were released with Windows Server 2008 that allows IT administrators to pretty much do anything they want to configured computers in an corporate environmnet. Preferences only require a Windows 2000 Active Directory and they need to be manageded from a minumum of Windows Vista/2008 however they can be applied to Windows XP Service Pack 2 (or greater) workstations.

You can see all the articles on this site about Group Policy Preferences at http://www.grouppolicy.biz/tag/group-policy-preferences/

In part 2 of how to use Group Policy to configure a users home page I will be show you how to use Group Policy Preferences to configure a users home page. There really isn’t a right way you can set the users home pages setting it is really up to your requirements and how much control you want to have.

The advantage of using Group Policy Preferences is that it allows you to specify a default home page but still allow users to change it if they want.

Now there are three dialogue Internet Explorer setting that can be used to configured home pages in Group Policy Preferences.

Internet Explorer 8	Internet Explorer 7	Internet Explorer 5 and 6

However as you can see the IE7 and IE8 screens are exactly the same so I will only go thought it using IE8 and the IE5/6 screenshots. If you do want to configure the IE8 setting remember that you will need to use the Internet Explorer 7 screen option instead however all the steps and affects are the same.

Internet Explorer 5 & 6

Internet Explorer 5 & 6 does not support tabbed browsing so this makes it a lot simpler to setup as all you can specify a default home page. Also remember that the Group Policy Preferences Client Side Extensions are are not installed on Windows XP by default so you will need to make sure they are installed before these settings will work.

Step 1. Edit a GPO that targets the users that you want to apply the home page setting.

Step 2. Navigate to User Configuration > Preferences > Control Panel Settings > Internet Settings

Step 3. Click on the “Action” menu and click on “New” and then click on “Internet Explore 5 and 6”

Step 4. Press “F6”

Explanation: Pressing “F6” enables the individual settings for configuration. Notice this changes the red dotted line to a solid green line which means that only the “Home:” settings is enabled to be applied as a policy.

Step 5. Now type your home page URL in the “Home” text box and click “OK”

Your done.

Now as this is a preference this will not prevent you users from changing the home page however it will be reset at the next group policy refresh.

Internet Explorer 7 & 8

Internet Explorer 7 & 8 supports multiple tabs so you need can either configure a single default home page or a default home page with multiple secondary home page.

Step 1. Edit a GPO that targets the users that you want to apply the home page setting.

Step 2. Navigate to User Configuration > Preferences > Control Panel Settings > Internet Settings

Step 3. Click on the “Action” menu and click on “New” and then click on “Internet Explore 8” (or “Internet Explorer 7”)

Step 4. Press “F6”

Step 5. Now add the URL (or URL’s) for the pages you want to be displayed and click “OK”.

Note: If you only specify one home page then the user will be able to change the home page however it will reset after the next policy refresh.

Again… your done.

As you can see below your browser is configured with two default home pages.

Note: Native Group Policies always take precedence over Group Policy Preferences so if you have you home pages configured using a native Group Policy (see Part 1) then this settings will be overridden.

UPDATE: Since I published this article Microsoft published an new MSDN article showing a simple registry key that can turn this backup notification. Therefore please go to this article “How to use Group Policy to turn off Backup Notification in the Windows 7 Action Center – The Easier Way . ” for the best way to turn off this notification.

One of the new features in Windows 7 is called the Action Center which is now you one stop shop for all system notifications to the users. One of the alerts that you will get by default out of the box with Windows 7 is the “Set Up Backup” Maintenance notice (see below).

For home PC’s this is really important that this message be displayed as the data on the hard drive is usually the only copy. However in an networking environment a users should be configured with roaming profiles, redirections folders and a home drive to ensure all their personal data is store safely on a file servers. Therefore you dont really need to remind them to back up their PC’s so you probably don’t want them to get messages asking them to configure their backups.

The Action Center icon can be entirely removed from the Notification Area using the “Remove the Action Center icon” native group policy.

However this is a bit extreme as you may still want to enable this feature for other notification such as windows updates or if you have an out of date anti-virus definition. So the problem is there is no native way to use Group Policy to enable/disable specific notification events such as the backup notifications.

That’s ok… Thanks to the power of Group Policy Preferences and some help from the people on the Microsoft support forums I have figured out a way to control this via Group Policy.

Normally I will step you through the process of creating the Group Policy Preferences manually and then I sometimes provide you with the XML file that is already preconfigured with the settings. However in this case the value is a complicated Binary string that would be very hard to type out manually so I am just providing the preconfigured XML file for you. As this is an XML file feel free to open up with notepad and inspect the file before you apply it to your own systems.

Step 1. Edit a Group Policy Object (GPO) that is targeted to the users that you want to disabled the backup notification.

Step 2. Navigate to User Configuration > Preferences > Windows Settings > Registry

Step 3. Download the file below and then drag (or copy/paste) it into the pane on the right.

Now you are pretty much done and you should then see something like this (Image below).

Now the user should no longer get any backup notifications in the Action Center or in the Notification Icon.

Note: User will need to log off and on again for it to become affective.

(Sorry… no fix for the virus notification as you really need to install some sort of AV software)

More Information

This first item in the list will disable the Backup Notification in the Action Center and the second one will enabled it. Notice however how the second one is greyed out as it is disabled by default. These settings are also configured to “Apply once and do not reapply” as this may be some you want to enabled/disable manually on some computers. I have also put a description in each setting to keep track of what each setting does.

If you want to re-enabled the Backup Notification setting for all your users then highlight the enabled item and click on “disabled” in the toolbar.

Then highlight the original disabled item and click “enabled” in the tool bar.

It should then appear like this…

Registry Key Details

In case you were wondering I have put in the partial details of the registry key that control the backup notification however the value are WAY to long to fit in this page so the Data has been truncated (A LOT).

Key: HKCU\Software\Microsoft\Windows\CurrentVersion\Action Center\Checks\{01979c6a-42fa-414c-b8aa-eee2c8202018}.check.100 
Value: CheckSetting
Type: REG_BINARY 
Data Enabled: 1 (REG_DWORD) = Enabled
Data Disabled: 01000000D08C9DDF0115D1118C7A00C04….  (Way to long to fit in here)
Data Enabled: 23004100430042006C006F0062000000000…. (Way to long to fit in here)