Policy problem

[localzuk]

I am now having a problem whereby a setting that was once in the group policy, but no longer is, still seems to be plaguing the machines.

The setting in particular is 'User Config -> Windows Settings -> Internet Explorer Maintenance -> Security ->Security Zones and Content Ratings'

The Content Ratings settings was enabled and the 'Users can see sites that have no rating' unticked. So all users were having issues getting to the majority of websites unless the supervisor password was entered. I have now selected the 'Do not customize Content Ratings' option. About 70% of users seem to be able to browse without being bugged by that box now, but the rest still get it.

I have tried forcing policy updates but this makes no difference.

What am I missing?

Cheers
Tony

[Geoff]

Upgraded to IE7?

[localzuk]

No. I am avoiding that until I am forced to.

[ChrisH]

I havent had any problems with IE 7 apart from getting rid of the annoying first run page.

[Heebeejeebee]

I havent had any problems with IE 7 apart from getting rid of the annoying first run page.

Did you get rid of it? If so how?

I managed to get around it by filling it in using my favourite "test" user profile, logging out and then saving the profle back as the default, but an easier way would be nice.

HBJB

[john]

GP has an option to get rid of it, they also have one for Media Player as well

[Heebeejeebee]

GP has an option to get rid of it, they also have one for Media Player as well

It must be well burried then. I'll do some digging.

HBJB

[GeeDee]

I can't picture the exact dialog you're using; but do make sure you are explicitly switching off the feature and not simply setting it back to the 'Not Set' default option.

Other than that, anything special about the machines that are not updating? They in a different organisational unit? Will any policy changes at all update on them? I assume you've run 'gpupdate /force' (although technically that shouldn't be necessary once the refresh internval has passed anyhow). Could it be somethig silly like a DNS issue?

Don't rush into an IE7 deployment just because of something like this. Always worth fully testing it, especially with any in-house stuff you run and to make sure your deployment strategy actually works properly.

[john]

HBJB the location of the one for IE7 is:
"Computer Config - Administrative Templates - Windows Components - Internet Explorer". Its the option to Prevent performance of First Run Customize Settings. I have mine set to go straight to the home page. Works like a chalm for me. Also in there you can turn off the blasted Customer Improvement Annoy the Hell out me program.

For Media Player, replaced the "Internet Explorer" with Media Player and that option is Do Not Show First Use Dialog Boxes, does the same thing but with WMP, again works like a chalm.

[Lee_K_81]

HBJB the location of the one for IE7 is:
"Computer Config - Administrative Templates - Windows Components - Internet Explorer". Its the option to Prevent performance of First Run Customize Settings. I have mine set to go straight to the home page. Works like a chalm for me. Also in there you can turn off the blasted Customer Improvement Annoy the Hell out me program.

For Media Player, replaced the "Internet Explorer" with Media Player and that option is Do Not Show First Use Dialog Boxes, does the same thing but with WMP, again works like a chalm.

You will probably find that these options wont appear on a vanilla install of server 2003. Instead you will need to either:

a) install the administrative tools package on a workstation that has ie7 / WMP installed (a la Windows XP SP2 firewall settings) then run group policy editor.

b) install ie7 /WMP on the server and then run the group policy editor.

Hope this helps

[Heebeejeebee]

Ta - I'll check it out when I get back from the BETT show.

HBJB

[localzuk]

I can't picture the exact dialog you're using; but do make sure you are explicitly switching off the feature and not simply setting it back to the 'Not Set' default option.

Other than that, anything special about the machines that are not updating? They in a different organisational unit? Will any policy changes at all update on them? I assume you've run 'gpupdate /force' (although technically that shouldn't be necessary once the refresh internval has passed anyhow). Could it be somethig silly like a DNS issue?

Don't rush into an IE7 deployment just because of something like this. Always worth fully testing it, especially with any in-house stuff you run and to make sure your deployment strategy actually works properly.

The only options for this particular setting are 'Customise settings' and 'don't customise settings'. The policy has been forced using gpupdate, so it isn't that. My guess at the moment is local profiles for individual users remembering it, so I am going to be looking at deleting them tomorrow.

Also, I have no intention of deploying IE7 as yet - our staff would scream blue murder if I did - 'It looks different!!'.

[localzuk]

Well it appears to be that most items in the GPO have 3 options: Enabled, Disabled, Not Configured. This particular setting appears to have only the equivalent of enabled and not configured. So when it was enabled, choosing the other option leaves those settings in place.

So the solution was to edit all the settings to allow anything to be accessed without a password and leave it enabled.

Stupid software.

[mortstar]

HBJB the location of the one for IE7 is:
"Computer Config - Administrative Templates - Windows Components - Internet Explorer". Its the option to Prevent performance of First Run Customize Settings. I have mine set to go straight to the home page. Works like a chalm for me. Also in there you can turn off the blasted Customer Improvement Annoy the Hell out me program.

For Media Player, replaced the "Internet Explorer" with Media Player and that option is Do Not Show First Use Dialog Boxes, does the same thing but with WMP, again works like a chalm.

Like you say John, works perfectly with IE7. But I just can't find that policy setting for WMP10. In fact there are very few settings available for Windows Media Player in GPO edit. Any chance of u/l your wmplayer.adm file?

Thanks

[john]

Are you opening the GP viewer on a machine with WMP11 installed on it? If not do it on one and you will see they magically appear