Mandatory Profiles and IE8

[leco]

I'd just nicely got all my mandatory profiles set, deployed and working when along came IE8. Without thinking I deployed that, silly me, I forgot that the profiles contained settings for IE. I'd like to reset the profiles - I know about changing .man to .dat but exactly which bit or where can I find the settings for IE8?

 

Currently nothing is set, so users have to either click the "Set Later" button or wade through the settings for IE8 (all to no avail of course since it's a mandatory profile). We use a number of online services that I don't want the pupils to have to enter details for each time. Their Favourites are still in place but not the necessary info for automatic log-in, pop-up settings etc.

[sted]

you can set all the odds and ends up via gpo without fiddling with the profiles

[Michael]

If you set the up the relevant IE8 GPOs this should avoid the need to update the mandatory profile.

 

Once you've updated the inetres.adm file, navigate to:

 

User Config > Admin Templates > Windows Components > Internet Explorer

 

Look for a policy called 'Prevent performance of First Run Customize settings Properties' - Enabled - Go directly to home page

 

Other settings I recommend are:

Turn on menu bar by default - Enabled

Turn off Favorites bar - Enabled

Turn off tabbed browsing - Disabled

Disable changing default browser check - Enabled

Prevent Bypassing SmartScreen Filter Warnings - Enabled

[leco]

You see I knew there'd be a simple way of doing it, thanks. Just need to find the relevant .adm I don't remember actually setting that before. If I haven't is it easy to find?

[FN-GM]

You see I knew there'd be a simple way of doing it, thanks. Just need to find the relevant .adm I don't remember actually setting that before. If I haven't is it easy to find?

 

Install IE8 on your DC. Then on the DC edit the group policy. Then there is no need to import anything

[gshaw]

Pretty much a carbon copy of my IE policies there

 

The main thing I use the mandatory profiles for is toolbar locations, removing Tip of the day helpscreens and other little things along those lines that GPOs can't control

[leco]

... all of the settings as per Michael are already set in the User GPO. So how come my users are getting the Welcome to IE8 Please take a moment .. screen?

[Michael]

If you have GPMC installed, have a look to make sure what policies are being applied.

[leco]

If you have GPMC installed, have a look to make sure what policies are being applied.

 

Sorry to be dim - can you explain how I do that please?

 

edit - OK had a look - is this Group Policy Results, if so then the correct User Policy is being applied. However, I'm logged in to a PC as said User (otherwise the GP Result doesn't work) and the Welcome to Internet Explorer 8 - Thank you tab is open as well as the homepage tab.

Edited February 16, 2010 by leco
after further research

[Michael]

Out of curiosity did you create the profile with or without IE8 installed?

[leco]

Out of curiosity did you create the profile with or without IE8 installed?

 

Profiles were created with IE7 installed sorry my op was possibly not very clearly explained.

[direct]

"Disable changing default browser check - Enabled" does it mean that the notification about default browser won't be shown?

[leco]

"Disable changing default browser check - Enabled" does it mean that the notification about default browser won't be shown?

Not necessarily, just that whatever the setting is cannot be changed

[Michael]

Well in addition to setting up those policies, I would either create a new profile or update the existing profile. I can't see what else is creating the problem, unless workstations are not picking up policies. You could try logging on as an admin, running gpupdate /force, then rebooting and logging on as a user with the mandatory profile.

 

"Disable changing default browser check - Enabled" does it mean that the notification about default browser won't be shown?

 

That's correct. It means if you install FF on the same machine IE won't ask to be the default browser anymore.

[leco]

Well in addition to setting up those policies, I would either create a new profile or update the existing profile. I can't see what else is creating the problem, unless workstations are not picking up policies. You could try logging on as an admin, running gpupdate /force, then rebooting and logging on as a user with the mandatory profile.

 

The workstations are picking up the policy and I have done gpupdate. So what do I need to do to update the profile?

 

I have changed the ntuser.man to ntuser.dat then on a workstation logged in as the user, made all the changes necessary, logged out and shut down. Waited for the profile to update on the servers, changed the ntuser.dat to ntuser.man. logged on using the same workstation. The profile won't load I get a TEMP one. Left it a bit longer before logging on with the same result. What am I doing wrong or not doing?

[sted]

by using the profile as 1 user you have locked it to them. You need to export it and add authenticated users (or whatever group) on the export process

[leco]

by using the profile as 1 user you have locked it to them. You need to export it and add authenticated users (or whatever group) on the export process

 

Sorry but I don't understand could you explain this a little more please.

[Michael]

Well I am thinking logon with the profile, run IE8, then close it. Now logoff. In theory if you named it differently, you'll need to update the profile name in AD for that particular user.

 

You may also find if you named the profile differently and you have two DCs it can take a small amount of time to replicate that information. By default it's 4 times per hour.

[sted]

Sorry but I don't understand could you explain this a little more please.

 

if you just load a profile as user x then as far as im aware it becomes their profile rather than shared (permissions get iffy which is why when creating them you have to export and add appropriate groups access to it). by exporting it from the computer it resides on (or is cached on) it sets all the permissions correctly. I re-found this the hard way trying to do a ts profile i just logged in as a test user and created a profile then just assigned it to test user 2 and basically it said sod off this profile aint right. Im not sure editing it would have the same effect but i wouldnt bet against it

[leco]

sted: I now understand what you mean, but that's just for newly created profiles. This isn't a newly created profile/user but one that is already there and has been for some time.

 

If the only way to change IE settings is to make a new profile then I'm leaving it until summer. I usually do all user profile changes then, just thought I could "tweak" this one for a bit of peace from the teacher.

 

Thanks for the help guys, much appreciated.

[sted]

ypou could always use regmon and see what changes then apply that to the mandatory profiles user hive

[INeedAUsername]

 

been banging our heads on this one

 

every setting is good (well what we can see anyway) but each time you login with the newly created profile we get the Internet Explorer settings bit come again

 

login as an admin and its ok

 

Any ideas?

 

Thanks in advanced

 

STariq

[Michael]

I would probably recommend you start a new profile, seeing as you now have IE8 installed. Make sure you run IE8 (once logged on) and any other application, then logoff and rename NTUSER.DAT.

[INeedAUsername]

thanks for the reply mate

 

already done this with a new profile

 

issue still persists