Active Content In IE Policy

[ahunter]

Hi,

 

Wondering if anyone might be able to offer some much needed advise on this one.

 

Our Year 10 students are doing a web design project using Serif WebPlus X2. Part of their project is to include active content on their web sites like marquees/rollovers etc.

 

On our student Internet Explorer policy we have the option to "Allow active content to run files on my computer" unchecked. Whenever they preview their websites or go to any sites that have active content, the active content does not load nor do they get a prompt giving them the option to allow. We have this all disabled due to security.

 

I know the option to "Allow active content to run files on my computer" is a general setting but I was wondering is there anyway to have it disabled without prompt for Internet sites and enabled without prompt for local websites running from a local drive?

 

Also if we were to allow it with prompts what security implications does this have? for example students don't have read/write permissions to the C drive so even if some dodgy active content was allowed through would it be able to do any damage?

 

Thanks in advance.

Adam.

[dayzd]

Not sure if it'll help, but you could create a 'My Computer' security zone...

How to Enable the My Computer Security Zone in Internet Options

 

It should allow you to set the 'active content from this computer' rule for local content, then leave it off in your other internet zones. I think (I've only fiddled with this personally. I've never used it on a full network). Don't know if you can control the new zone from AD, though.

Edited January 13, 2010 by dayzd
Poor link formatting

[ahunter]

Gave it a go following the microsoft kb but the my computer zone doesn't want to appear. We are using IE7 and Microsoft don't mention you can do it on this version?

 

Could be wrong though......

[dayzd]

Ah... you're right. IE7 isn't on the list. Bummer.

 

In which case, I'm not sure if you can do what I suggested...

[SYNACK]

On our student Internet Explorer policy we have the option to "Allow active content to run files on my computer" unchecked. Whenever they preview their websites or go to any sites that have active content, the active content does not load nor do they get a prompt giving them the option to allow. We have this all disabled due to security.

 

I know the option to "Allow active content to run files on my computer" is a general setting but I was wondering is there anyway to have it disabled without prompt for Internet sites and enabled without prompt for local websites running from a local drive?

 

The "Allow active content to run files on my computer" setting only applies to files and sites directly loaded from the local computer and so excludeds all external internet sites, simply enabling this setting should allow the computers to run the local content as you require.

 

Also if we were to allow it with prompts what security implications does this have? for example students don't have read/write permissions to the C drive so even if some dodgy active content was allowed through would it be able to do any damage?

 

It depends on the threat, most stuff is well contained with user privilages and they would in general only be able to trash their own profiles but there are numerous security holes in IE and any other browser so the most malicious content can still cause havoc even on a locked down PC. This is where good filtering and AV come in to play along with a cost, benifit weigh up as to whether the active content is worth a little extra risk. We don't have to many issues with it as locked down accounts do prevent most things from getting through.

[ahunter]

Your right, I had allow active content to run files on my computer enabled at my last school and for the 4 years I was there I can't say we had any issues related back to any malicious active content causing damage, like you say good AV and filtering should stop 95% of most things.

 

I'll see what the boss thinks!

[ahunter]

Found this completely by accident while I was replying this morning:

 

http://www.edugeek.net/forums/windows/2863-run-active-content-my-computer-group-policy-fix.html

 

Going to roll with this fix I think does exactly what I want.

 

Thanks again!