win 7 GPO issues

[RabbieBurns]

Im currently working through the GP settings getting them set for a win7 deploy to staff..

 

One thing I cant figure out though, is trying to extract a zip file, the .exe gets blocked.. trying to download a .exe off the web it gets blocked (it says internet security settings blocked it), and even trying to run said .exe from a network share blocks it.

 

Ive not set anything to block like this.. is it enabled by default? How can I disable it

[RabbieBurns]

Seems I can right click the .exe and choose Unblock.. But how can I disable this permanently. My win7 machine withough a GPO doesnt have this effect, but the laptop im playing with does, even though nothing has been set.

[ZeroHour]

Hey,

hmm interesting, normally by default I thought it was not blocked as such you just got an extra warning when you launch the exe but I did know you could do blocking like this.

Try having a play with User Config->Admin Templates->Windows Components->Attachement Manager as I suspect that may be the GP place to control it but I have no idea tbh.

A useful tip for GP management with a W7 client, you can now right click on say Admin Templates and filter the polices based on a search term

[RabbieBurns]

I put the ( ) part in my original post in the wrong place, that error message actually occurs when trying to run a previously downloaded exe.. When downloading one it just gets cancelled. Theres no AV installed on this image as we're just gonna push out sophos from the EMC after the imaging so its definately not that..

 

Ill have a look into your suggestion in the morning. Thanks.

[RabbieBurns]

this is a right royal PITA. I really cant figure out what is causing these "Security Settings". Ive not set anything anywhere.

[SYNACK]

This should work:

Vista Blocked File Protection Control

 

In a GPO:

Navigate to User Configuration > Administrative Templates > Windows Components > Attachment Manager. Here you will find a couple of policies related to this feature, but to disable it you'll want to ENABLE the policy called "Do not preserve zone information in file attachments".

 

I think that this is a 'feature' that has been around for ages playing havoc as it usually does. I know it is in the forum somewhere but I think the integrated search only manages to go back about 3 months now. It is to do with IE security zones as above.

 

Edit: just read above, ZH beat me to it Dosen't sound like it worked though.

 

Edit2: Perhaps a screenshot may help

Edited February 9, 2010 by SYNACK

[RabbieBurns]

Even downloading through firefox just causes the download to halt immediately and a 0byte file to appear.

 

Screenshot coming up...

[RabbieBurns]

see attached

[SYNACK]

What are the security settings for the internet zone in the Tools > Internet Options : Security Tab. On mine these are set to medium, I suspect that yours are at max.

 

To test this try adding the download site to the local intranet zone temporarily and see if the download goes through then. If so it is something to do with the security levels in IE that are being set.

[RabbieBurns]

Ive set all security options to low and its still doing it. Also, I woudlnt have thought settings in IE would affect firefox as well?

[SYNACK]

If it is set as default in policy it will just override back to original settings hence the suggestion to add the site to local intranet zone. check to see if this is enabled:

Select Internet Options

Click on the Security tab

Click on the Custom Level button

Scroll down to Downloads: Automatic prompting for file downloads

Click on Enable

Click OK

 

Also I would not think that it should affect firefox but the goal of the internet control pannel applet was always to control the entire internet experience for the user, perhaps they have extended its reach in 7.

 

You could also try right clicking the IE icon and selecting run as administrator then try the security lowering as this is more likely to stick.

 

On the weird side someone suggested this issue could be combatted with this patch When you try to download a file from the Internet by using Internet Explorer, the download stops responding

 

Perhaps it might be a good idea to temporarily try the login with a fresh GPO and remove the other one to see if this is the cause.

 

Edit: http://en.kioskea.net/forum/affich-42286-can-t-download-program-from-internet

Edited February 9, 2010 by SYNACK

[RabbieBurns]

Right that was wierd.

 

Stripped it of all and every GPO and rebooted, multiple times.

 

It was still happening.

 

Deleted the profile (manually - had to follow the HOWTO to resolve that), and restarted.. problem gone..

 

Re-apply the policy, and viola.. Its working like a charm.

 

Question 1: Why didnt win7 reset itself after the policy was removed

Question 2: Why did it screw up in the first place?

 

Cheers Synack and ZH