Internet Explorer Branding Policy Hang

[Duke]

Hi all,

 

I'm normally over in the hardware + virtualisation forums so hello to everyone here.

 

Quick question which some of you may be familiar with - if you configure Internet Explorer through group policy and/or have folder redirection, you may experience a 20 second hang during logon during with the logon screen saying 'Applying Internet Explorer Branding Policy'. There was a fix for IE6 and MS admit the issue, but it's still a problem on IE7 (and IE8 to my knowledge).

 

There are a couple of old threads about this on here and a few topics on various websites, but there's no definitive solution to the problem. IE6 could be fixed with a hotfix and registry edit, and I think you can fix IE7 by copying over the IE6 branding DLL and doing a registry hack.

 

However, we've got 800+ PCs here and this 20 second hang is by far the slowest part of the logon, even if people have large roaming profiles. Does anyone know of an easy to deploy fix for IE7 or IE8 for this issue?

 

Many thanks in advance for any help anyone can provide!

Chris

[Potato-Peeler]

At the moment we have a group policy that sends out the old ie6 brandingdll into ie7. its just a simple batch file but it seems to work well enough.

 

 

COPY \\server\lfoldername\iedkcs32.dll c:\windows\system32 /V

[Duke]

Cheers, I might have to give that a try! I've just installed a SAN with flash accelerators and it's a bit rubbish to see the nice fast logons being killed by an IE bug...

[apeo]

At the moment we have a group policy that sends out the old ie6 brandingdll into ie7. its just a simple batch file but it seems to work well enough.

 

 

COPY \\server\lfoldername\iedkcs32.dll c:\windows\system32 /V

 

Could you make the dll file available could you?

[Potato-Peeler]

PM me your email account and ill send it to you if you want.

[Duke]

Could you make the dll file available could you?

 

You mean you haven't got an IE6 machine hidden away somewhere!

 

Just tested it here and it does seem to resolve the issue. Hopefully IE9 might actually fix it properly...

 

Much appreciated,

Chris

[Potato-Peeler]

To be honest im just hoping our network manager will let us bin IE and get firefox

I live but in hope.

[gshaw]

To be honest im just hoping our network manager will let us bin IE and get firefox

I live but in hope.

 

Not if it's Firefox 3.5... biggest pile of junk I've had the displeasure of using, so bad it's sent me back into the gloating arms of IE

 

Btw that IE bug, does it slow down the User Settings or Computer Settings? I've got something that's bogging down the logon times in Computer Settings and wondering if this may be it... haven't got the policy settings to hand as it's on the other network so thought I'd ask

[Duke]

To be honest im just hoping our network manager will let us bin IE and get firefox

 

No MSI deployment or ADM templates so that you can configure the settings and then lock it down. I must admit that as far as business, enterprise and educational use goes, Mozilla really haven't done themselves any favours here. It's a great browser but until I can deploy and manage it (including updates) across the site it's not going on there.

 

Not if it's Firefox 3.5... biggest pile of junk I've had the displeasure of using, so bad it's sent me back into the gloating arms of IE

 

I wouldn't go that far! I must admit I don't particularly like it compared to 3.0 either, it's got a few features I had to immediately turn off through about:config, and there's some that you just can't change back to the old behaviour, very annoying.

 

Btw that IE bug, does it slow down the User Settings or Computer Settings? I've got something that's bogging down the logon times in Computer Settings and wondering if this may be it... haven't got the policy settings to hand as it's on the other network so thought I'd ask

 

If you've got this bug then you'll know about it. When you log on as a user that gets IE settings through GPO, it'll go past all the usual logon stuff then get to 'Applying Internet Explorer Branding Policy' and hang there for exactly 20 seconds. The most annoying things is MS know it's a bug and won't deploy a fix.

 

Chris

[ZeroHour]

Is there anything logged in the event log?

[Duke]

I don't think so, but if you go to:

 

%UserProfile%\Local Settings\Application Data\Microsoft\Internet Explorer\Brndlog.txt

 

You'll see something like:

 

10/20/2008 11:36:37 Refreshing browser settings...
10/20/2008 11:36:37 Broadcasting "Windows settings change" to all top level windows...
10/20/2008 11:36:57 Done.

 

Note the 20 second gap at the end.

[gshaw]

 

 

I wouldn't go that far! I must admit I don't particularly like it compared to 3.0 either, it's got a few features I had to immediately turn off through about:config, and there's some that you just can't change back to the old behaviour, very annoying.

 

 

It's the crashing that's been driving me crazy, back in the day it used to be super quick and rock solid... now crashes every day and slower than IE... Firefox developer fail!

[apeo]

You mean you haven't got an IE6 machine hidden away somewhere!

 

Just tested it here and it does seem to resolve the issue. Hopefully IE9 might actually fix it properly...

 

Much appreciated,

Chris

 

Yeah, im just being lazy.. its 'Somewhere' much easier if i can just get it.

 

To be fair i dont think this is the IE branding problem for us but i do get a 20 sec delay on a test profile i've been working with. The branding log shows no delay and its not the file redirection issue either as nothing has been redirected. Dunno what it is.

[Ric_]

I thought that the problem only affected terminal services. I 'bypassed' the problem by not performing IE branding. The only thing I really need to do is insert the proxy settings anyway.

[Duke]

Sorry to bring back a bit of an old thread but I felt this deserved an update:

 

We've been using this fix to get around the branding policy hang and it's been working fine. However, newly-created user accounts are now experiencing problems where the proxy settings aren't applied properly and as such they can't get any internet access beyond the Intranet. Reverting the GPO script to copy back the IE7 DLL appears to resolve the issue, but obviously reintroduces the hang.

 

This is likely a problem with our default profile so may not affect anyone else, but do be aware it has caused issues here.

 

Cheers,

Chris

[PRicho]

We've had the same problem with deploying IE7, only for Staff accounts randomly... proxy gpo doesn't get applied.

[Duke]

We've had the same problem with deploying IE7, only for Staff accounts randomly... proxy gpo doesn't get applied.

 

Have you got the IE7 ADM templates set up? I had no problems with proxy settings until I altered that dll. If I use the standard IE7 dll then proxy settings and everything else work fine, I just get the branding policy hang.

[ZeroHour]

Hmm you could try:

http://www.edugeek.net/forums/windows/34632-xp-sp3-internet-explorer-branding-gpo-failing.html

[Duke]

Hmm you could try:

http://www.edugeek.net/forums/windows/34632-xp-sp3-internet-explorer-branding-gpo-failing.html

 

Thanks, no joy with that one though. I have an SP3/IE7 machine that's got the standard IE7 DLL on it and after doing that regedit then reboot I still get the 20 second hang. Do you need a specific version of Iedkcs32.dll too?

 

Cheers,

Chris

[ZeroHour]

Can you go into the GPMC and run a group policy results task on a machine with the problem using an account that has the issue. When you get that report switch to the settings tab and right click save report. Stick it in a zip with a pass and post it here with the pass (thus preventing google indexing the contents of the zip)

[Duke]

Can you go into the GPMC and run a group policy results task on a machine with the problem using an account that has the issue. When you get that report switch to the settings tab and right click save report. Stick it in a zip with a pass and post it here with the pass (thus preventing google indexing the contents of the zip)

 

There's a LOT of stuff we apply via GPO so I'd rather not stick an RSOP on a forum... Anything in particular I should be looking for? I'm pretty sure the problem came up with SP3 as we'd had IE7 deployed a while before that with no issues. Going back to the IE6 DLL definitely fixed it but caused this proxy settings problem. Just wondering if I might need to re-look at how we set up the IE ADM settings.

 

Cheers,

Chris

[ZeroHour]

Your not using loopback policy mode or anything like that?

I know what your saying about the RSOP but its hard to see if it happens here without it.

A test would be to remove ALL policies to a test OU and just apply the proxy settings to that account and see if the delay still occurs. Then add domain admin to that account and reset the profile and see if the same delay applies.

Are you applying on machine or user account ou's?

[PRicho]

Have you got the IE7 ADM templates set up? I had no problems with proxy settings until I altered that dll. If I use the standard IE7 dll then proxy settings and everything else work fine, I just get the branding policy hang.

 

Just using the default IE Maintenance template to apply proxy and homepage within User Config - Windows Settings - IE Maintenance...

 

Works for students but not for staff, however if the staff run gpupdate it then applies the homepage but still no proxy. No luck with the dll either for us. Back to IE6!

[Duke]

Are you applying on machine or user account ou's?

 

Well here's the thing... All our GPOs set the IE7 proxy settings as a user policy under User Configuration > Windows Settings > IE Maintenance > Connection/Proxy Settings. However, if you look at this KB it says:

 

Standard users can not change proxy settings after Internet Explorer 7 installation.

 

This is happening because the Internet Explorer 7 sets the proxy settings per machine (rather than per-user) by default for desktop computers.

 

Now that KB isn't directly related to this problem, but does that quote mean I need to be setting IE7 proxy settings as a Computer Configuration item? If so then where is that setting as under User Configuration > Windows Settings I only get Scripts and Security Settings!

 

Cheers,

Chris

[ZeroHour]

Well here's the thing... All our GPOs set the IE7 proxy settings as a user policy under User Configuration > Windows Settings > IE Maintenance > Connection/Proxy Settings. However, if you look at this KB it says:

 

Standard users can not change proxy settings after Internet Explorer 7 installation.

 

 

 

Now that KB isn't directly related to this problem, but does that quote mean I need to be setting IE7 proxy settings as a Computer Configuration item? If so then where is that setting as under User Configuration > Windows Settings I only get Scripts and Security Settings!

 

Cheers,

Chris

 

So I take it your applying the gp to a users OU rather then a machine OU (otherwise loopback would be required)?

 

Not sure about where you can do it in the computer policy setting but you could deploy the group policy preferences windows update and try using it (you must edit GP from vista/w7/2008 to see preference options) to set the proxy as it can do it too for users as a workaround for now.

 

EDIT:

I just read the KB, does that not say just to ensure that its not applied per machine?

In order to resolve this issue you must disable the following Local Computer Policy setting - Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Make proxy settings per-machine (rather than per-user). You must set this policy setting to disabled even if Group Policy console (gpedit.msc) shows this as Not Configured.

Edited September 10, 2009 by ZeroHour