strange effect of editing IE settings in server 2012 gpo editor.

[evasion]

Our system is a mix of 2008R2 and 2012 R2 servers/DC-s and recently we had to edit a setting for IE11, by using server 2012R2 gpo editor.

I have added the IE 10 and above in this section (User Configuration\Preferences\Control Panel Settings\Internet Settings) as per:

https://support.microsoft.com/en-gb/kb/2898604

Settings were for browsing history, temporary internet files, check for newer version of stored pages = every time I visit the webpage (due to a request by custom site developer).

Previously all gpo settings were edited in server 2008R2 gpo editor, so this was the first time that we used server 2012 method, apparently this is "recommended" because IE settings are readily available (although this particular setting can be changed using registry fragment).

And now for the strange effect:

Changing this setting under 2012 editor has immediately backfired, with all users on the network affected by this gpo, being unable to use Office software. Error was to do with absence of %temp% location as we quickly found googling for error text.

Literally a can of worms was opened, unbeknown to us.

Because this method of gpo editing in Server 2012, wipes all previous customisations for IE browser including home page, location of users temp folder, several clicks away, deep in the IE control panel.

Everyone had to log off and log back on to be able to use Office software, after settings were put right.

Now, I have never seen such strange behaviour of gpo editing, which resets previous customisations to detriment of all users. One could say, test it first but who would expect such consequences i.e. use of Office 2013 software).

And, still no safeguard exists, so that this method can adversely affect anyone using gpo editor in this particular context.

What has also happened is that power shell scripts security warning is persistently annoying anyone trying to run a ps1 script. When this gpo is unlinked, the warning disappears. Nothing will remove the warning, including policy bypass command or adding unc path of the script to intranet/trusted zones.

Well, it seems that server 2012 method of gpo edits of IE settings also changes some power shell security context, that no one has been able to undo (rewriting the gpo is last resort).

Any similar experiences or advice how to deal with this unforeseen gpo fuss?

Edited June 3, 2016 by evasion

[evasion]

As for the powershell security prompts, here's what helped:

https://absolute-sharepoint.com/2014/03/change-powershell-machinepolicy-execution-policy-windows-server-2012r2.html

 

still need to understand why modifying IE settings in server 2012 editor, results in unwanted side effects such as these described above?