Network PCs automatically updating to IE7 & I don't want them to do so!!!

[Athlona]

Hi All

This one is bugging me!!! Some PCs around my school have just started receiving IE7 update which is causing some problems with roaming profiles. The PCs in question have become slow, some are getting active desktop warning which I can't seem to revert back to school back ground picture always popsup with debug errors... I have tried deleting the users DESKTOP.* file from there roaming profile but still no joy. Apart from me re-ghosting the PCs in question, has anyone any ideas how windows upgrading could get past a netpilot proxy??? and why IE7 could mess things up so much??? I am one that believes in windows updates I know not many people are

Any advise would be greatful...

[MikW]

How are you getting updates?
Is it per machine or do you have WSUS?

[srochford]

If you look in the file %windir%\windowsupdate.log you'll find blocks starting:
2008-10-10 12:53:02:001 1144 708 AU ########### AU: Initializing Automatic Updates ###########
2008-10-10 12:53:02:001 1144 708 AU # WSUS server: http://<update server name>
and this will tell you which server is being used for the updates. If that's an internal server then someone must have configured windows update to push out IE7 - it definitely won't happen automatically but I think it is flagged as a high priority update.

If the server is the MS server then it looks as if your netpilot is not blocking access to that site.

The Microsoft website has details of the IE7 blocker toolkit to prevent it being installed and it might be worth installing this.

Unless you have particular software which needs IE6 I would recommend that you try and get IE7 working properly; support for IE6 will end before long and it would be better to not get forced into IE7 (although that is kind of what's happening ...)

You can uninstall IE7 (although not sure about doing it after updates have been installed) and I think it happens silently.

[Athlona]

Thanks for the advise looking into just upgrading all the PCs just hope theres a .msi of IE7 out there somewhere???

Thanks

[Michael]

Thanks for the advise looking into just upgrading all the PCs just hope theres a .msi of IE7 out there somewhere???

There isn't, but if you download IE7 you can use the following command:

IE7-WindowsXP-x86-enu.exe /quiet /passive /norestart

It is highly recommended you restart your computer after installing IE7 and any other updates.

[srochford]

It doesn't come as an MSI (don't ask why - it's just one of the things Microsoft do to make your life a misery :-)) but it's very easy to push it out with WSUS.

If you don't want to use WSUS then download the Internet Explorer Administration Kit - this gives you the tools to prepare an unattended install. You should also be able to get the full download of IE7; its setup can then be run as ie7setup /quiet /restart (run silently; restart at end)

[SYNACK]

There is an MSI option, which you can fully customise with the free MS tool Internet Explorer 7 Administration Kit

There is a KB article about how to do it here: You can use .msi files to deploy Internet Explorer 7 in Active Directory environments

I have done this at several schools and it works really well.

[Athlona]

Hi I have never used Windows Server Update Services i'v deployed using group policy. I take it WSUS can deploy most .exe??? If so I which I switched onto this alot earlier on

Thanks srochford

[Michael]

WSUS downloads various updates for products you specify, giving you full control of what is deployed and what isn't deployed to your workstatios. It also gives you a lot of information of what updates are installed and what are needed keeping you fully informed

[Chrish5]

And how does one go about setting up WSUS - do you need Server 2003 R2 or 2008?

[srochford]

WSUS is detailed here - the bit on the left has "getting started"

You need Server 2003 or 2008 - it can go on an existing server because it's very low impact.

You can't deploy any old .exe file from it, only the updates that MS deploys (and a few other things but that's much harder work - stick with just updates for now!)

It really is worth installing it - it will make the windows update process pretty much painless and gives you complete control (a group policy tells machines to use your update server; once a month you choose which updates get deployed and that's about it!)

[Michael]

Windows 2000 Server supports upto WSUS 2.0. 2003 and 2008 Server support both WSUS 2.0 and 3.0.

I agree with other comments, WSUS is definitely worth it. I use it primarily to update Windows and MS Office.