Koldov Posted January 16, 2015 Posted January 16, 2015 (edited) Hi All, I have two DC's one 2008 (not R2) and one 2012R2. Before I had the 2012R2 running I had made some attempts to control IE10 and 11 even using GPMC from a Win7 IE11 machine, now with the new server I have had more luck, but it seems that other settings are now applying by themselves. I have kept the 2008 server running IE9 as I've heard you cannot reconfigure some of the settings made like this (GPO/User Configuration/Policies/Windows Settings/Internet Explorer Maintenance) from a server running IE11 and yet they may still apply... However they seem to be arguing a little over who has control and I'm not sure who's winning. Anyhow, now I'm using the GPP to control IE11 my machine has all of a sudden started prompting me for an OK when changing secure connection modes! It didn't do this before, so I presumed it was the new GPP and trawled through it to find the culprit eventually finding 'Warn if changing between secure and not secure modes'. Now on my test user account it does not ask for confirmation, but on the screenshot below the left hand is from the new 2012R2 server and the right hand is the old 2008 server, it would appear as I am not being asked that the 2008 servers GPP is taking priority. I thought they should have synced themselves and both have the same settings? I have NOT changed this setting manually on either server. Any ideas? Kol. Edited January 16, 2015 by Koldov
Michael Posted January 16, 2015 Posted January 16, 2015 If it's just proxy settings you wish to deploy, have a look here In my experience some parts of GPP work (such as printer or drive mapping), but Internet Explorer not so much as you're finding.
3s-gtech Posted January 16, 2015 Posted January 16, 2015 How are you viewing the IE 10 GPP in Server 2008? By default, this shouldn't even show up. Is it a modified IE8/9 policy?
Koldov Posted January 16, 2015 Author Posted January 16, 2015 Yeah I think it maybe a modified 8/9 policy from when I tried to use GPMC from a Win7 client. When I open that now it says 'An invalid or out of place element was detected and will be ignored' You can see that it is showing some (but not all of the preferences) from the 2012 server, but it does give the name of the 2012 server in the GP window after the GPO name... I cannot see why the SERVER 2008 preference is overriding the 2012 when the box for 'warn if changing between secure and not secure modes' is unticked in 2008 but ticked on the 2012 box! How do I 'undo' the changes made in that and have 'one true policy to rule them all'? Kol.
3s-gtech Posted January 16, 2015 Posted January 16, 2015 My recommendation would be to delete both and recreate it from scratch on Server 2012 R2 as a native IE10-and-up policy. Make sure you clear any settings from IEM in Group Policy too. If you still have machines running IE9, you can make a separate entry for them or even a new GP with a WMI filter. My experiences of IE GPP have been very positive - started using it when we first got Windows 8 machines, via Server 2008 R2 with an XML modified policy. We're still using that same policy two years later, for every user.
DavetheITguy Posted January 20, 2015 Posted January 20, 2015 IE11 cannot be controlled via the GPP for IE9, it takes the settings from the Internet explorer on the server. This is what was said on the Microsoft website, the alternative is to change your settings via the registry. I've not bothered upgrading to IE10 or IE11 yet, IE9 still works fine and it's still secure.
localzuk Posted January 20, 2015 Posted January 20, 2015 (edited) IE11 cannot be controlled via the GPP for IE9, it takes the settings from the Internet explorer on the server. This is what was said on the Microsoft website, the alternative is to change your settings via the registry. I've not bothered upgrading to IE10 or IE11 yet, IE9 still works fine and it's still secure. Google Apps no longer support IE9. Also, support for IE9 ends January 2016. So, you're going to face an increasing number of sites that don't work properly on IE9. As far as I know, the way to manage IE10/11 properly (ie. officially) is to have a device with Windows 8/8.1 or Server 2012/2012 R2 and have the Group Policy Management tools installed - then you'll get access to the IE10/11 GPO on those machines only. Edited January 20, 2015 by localzuk
3s-gtech Posted January 20, 2015 Posted January 20, 2015 It can be controlled via the IE9 GPP; you just use the same method as this, substituting 9.1.0.0 to 99.0.0.0. How to enable Group Policy Preferences support for IE9
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now