IE Issues

[nathan]

We had a crash on our server earlier today, it booted up fine but looked like there was a problem in the GPO settings (redirect for the students my documents). We deleted those settings and entered some new ones and that side of things were working fine.

 

We now have a problem that when any student logs onto any computer IE won't start. I could be on the same computer logged in as a teacher or administrator and it works fine. But when logged in as a student you double click it and nothing happens. I've tested to make sure it isn't the shortcut. i can right-click the icon and get to internet options or run without addons (still doesnt open).

 

I'm stuck, i have no idea whats going on. We've also tried disabling the GPO to test and it still didn't work.

[free780]

Process monitor? See whats going on.

Reset ie if possible.

[nathan]

looking at the task manager the process appears and then buggers off! I've tried resetting ie, registering the dlls. Nothing in the event logs. this is the same on all computers in the school when we log in as a student.

[nathan]

I'm still having the same issue with IE, Word won't start either. Word does give me an error in the event log though.

 

"Detection of product '{90120000-0011-0000-0000-0000000FF1CE}', feature 'WORDFiles' failed during request for component '{0638C49D-BB8B-4CD1-B191-051E8F325736}'

 

The strange thing is, if i add this user to a staff group it works fine.

[3s-gtech]

What type of profiles do you use for students?

[nathan]

Well i've just been checking that out, they were configured to use mandatory and they had there app data folder roaming. I have a created just a bog standard user with no mandatory profile, out of the scope of any GPO's and the problem still exists.

 

I should add that these students are part of a students group, the students group has the correct permissions to the shared appdata folder.

Edited December 18, 2013 by nathan

[nathan]

Certainly think this is profile related, something along the lines of these programs unable to read app data.

 

As far as i can't see everything looks ok permissions wise.

[3s-gtech]

I have a feeling it's an issue with the access level of the user on the PCs - there are various mentions of UAC, incorrect permissions and problems with installers. When you move the user to the staff group it works - is your student user Group working properly? Perhaps try creating a new Group for them, it may have been damaged.

[nathan]

problem with that though is if i create a new user with no profile redirection etc, no gpo they have the issues. if i add the staff group to the new user it works.

 

It's a 2008 server with XP clients so i don't think UAC would be a problem. On the computers i can log in as a staff member or as an admin and it works fine.

[3s-gtech]

It sounds like it's permissions based - without any user group or with the students user group, no dice - but in the staff group it works. I'm just wondering if some ACLs have got damaged when your server crashed, and something that IE and Office is looking for cannot be accessed due to this. Do your staff have any level of admin rights?

[nathan]

staff haven't any extra rights (at both a domain or local pc level)

[nathan]

I think i've found the problem, it was in a GPO inside a workstations OU. Not 100% why the previous folk put it there. I'm guessing the S-1..... was a student group, said student group is still in AD so i'm guessing thats where the corruption is.

 

I don't like that everyone can write to the program files, if i delete these GPO entries i'm guessing the default permissions won't be replaced. Does anyone know what the defaults should be so i can put it right.

 

Thanks

 

[nathan]

To start with i've put domain users in as read/execute. At least that will get all users working correctly. I'll then work on reducing the staff permissions. If they need to alter anything on there own laptops i'll make them a local admin on it.

 

Just can't help but feel i've been left with a cowboy job!

[free780]

Local Admins. Yeeehaaaw! Hello malware and worse itunes.

[3s-gtech]

That totally looks like the issue. The SID is no longer attached to the students group, that'll stuff it right up. Well found!

 

You should have, as standard:

 

CREATOR OWNER - Special (i.e. everything allowed)

SYSTEM - Full Control

Administrators (local group) - Full Control

Users (local group) - Read and execute

TrustedInstaller - Special

 

Special permissions may have been added to allow updates to your MIS or similar - you don't need to change the permissions on the whole folder like this to enable that though.

[nathan]

nice.....

 

Not had any instances of malware yet, or massive installs of itunes. Perhaps we're just better at educating our teachers than you are...