Group Policy Question, Can anyone help?

[ad_sb]

Hi everyone

 

In our school we use a software called Impero as an administration console for the teachers to use to block the students from certain websites or to disable Internet Explorer altogether, the students have found a way of accessing this even though its blocked

 

they right click internet explorer and select "start without add ons", this enables them to use the internet with full access it even though its been blocked by the teacher on the impero console

 

do any of you guys have a GPO that we could set in AD to combat this and remove the button when they right click?

[HarryMonkey]

Wrong thread methinks.

[ad_sb]

give me a break, im new to this

[pantscat]

I'm sure a mod will be along in a mo to move this to the right forum.

 

But in the meantime - create a new GPO - navigate to User Configuration > Administrative Templates > Windows Components > Internet Explorer > Browser menus - then look for a setting on the right hand side called "Disable Context Menu" and enable that.

 

That should do the trick.

[fairm010]

^ That, however that will disable the entire right click Menu in IE. I have seen some ways of removing individual items from Menus using the registry but I can't find my notes :/

[DrPerceptron]

Can you no turn off the "Only filter Internet Explorer traffic" option in Impero? Group > Properties > Workstation setting

[LansITGuy]

If there is a reason you still only want to filter IE traffic you could enable the following with a group policy:

 

User Configuration > Policies > Administration Templates > Windows Components > Internet Explorer > Do not allow users to enable or disable add-ons

 

Seems to work for us.

[ad_sb]

Thanks a lot pantscat but that disables the context menu once internet explorer is open, so they cant right click, we want to disable the right click button before theyve opened internet explorer (e.g. when they right click the icon on ther desktop)

[fairm010]

Then use Windows Components > Windows Explorer > Disable windows explorers default context menu. Note that this only applies to Windows Explorer and not IE or other applications.

[ad_sb]

Unfortunately we still havnt found a solution to this, if we block the windows explorer context menu via GPO then users cant right click at all.

 

this is not what we need because then they cant right click and make new folders in there my documents e.t.c.

 

we just want to remove the button "start without addons" from IE right click context menu

 

As said, this is deffinately a registry DWORD edit, but for the life of us we cant find where.

[russdev]

You can follow this KB article Impero - Network and Lab Management Software or turn off IE only filtering.

 

Russell

[ad_sb]

You can follow this KB article Impero - Network and Lab Management Software or turn off IE only filtering.

 

Russell

 

Thanks for the reply russell although im not sure how disabling Filter only IE traffic would help us combat this on our network, can you elaborate?

 

I was under the assumption that if that option is ticked in impero then the software wouldnt filter other browsers e.g. Chrome and firefox

[harriuk]

Disabling the IE only filter changes how impero filters. It stops using the ie add on and feeds all traffic through a proxy on the client itself (or at least thats how I understand it). This means that all internet traffic is monitored/blocked by impero rules regardless of browser used. So if a student opens IE without add ons the web is still monitored/blocked as the IE add on is no longer used.

 

I hope this makes sense.

[markwilfan]

What harri said. Careful if you already proxy web traffic though as through forefront tmg. Could you not use impero to detect the IE session without add ons? What does is log it as in the window captions?

[markwilfan]

Meant to say turning impero proxy on caused a few wierdy interweb issues for us as we use forefront tmg to proxy web traffic, so using impero proxy too double proxies it

[Arthur]

we just want to remove the button "Start without add-ons" from IE right click context menu

It isn't possible to completely remove the "Start without add-ons" option from the context menu on the IE desktop shortcut, but it is possible to make it do something else. All you need to do is change the parameter highlighted in red.

 

From

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30301D}\shell\NoAddOns\Command]
@="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" -[color="#FF0000"]extoff[/color]"

 

To

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{871C5380-42A0-1069-A2EA-08002B30301D}\shell\NoAddOns\Command]
@="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" -[color="#FF0000"]framemerging[/color]"