Internet Explorer Settings Via Group Policy: Not Working

[6Foot2]

OK.

 

So I now have an ongoing problem which refuses to be solved [been working on it since Thursday]

 

While trying to clear out some old GPOs [several GPOs] I have managed to put our network into a rather strange state:

 

1. Policies set in Active Directory/Group Policy are not observerd by the workstation
   
2. Examination of workstation registry reveals that only some of the GP settings have taken while others are ingored
   
3. Running a report of result of Group Policy Object Policy contradicts what we see in practice

 

I guess what I should do here is take the network apart and try to understand what is actually happening. However that is not actually possible because we are working on a live network and I need an answer as soon as possible [it was an Inset day today but staff and students are back tomorrow (Volcanic ash allowing) and we have an Ofsted pending soon...]

 

I have tried all I can think of and I am out of ideas. I have been talking to some members of Edugeek on a one-to-one basis (thanks for that guys) but I feel that we have exhausted all of the options we can all think of and I now need new input to make progress on this.

 

Any ideas welcome.

 

Student server OS: Windows Server 2008.

 

Staff server OS: Windows Server 2003.

 

Any ideas welcome.

[webman]

Which settings in particular? Is it consistently the same settings across all machines? We had an issue where the proxy settings appeared not to be applying, but it was actually bogus first-install .ins files over-writing applied GPOs.

[6Foot2]

Which settings in particular? Is it consistently the same settings across all machines? We had an issue where the proxy settings appeared not to be applying, but it was actually bogus first-install .ins files over-writing applied GPOs.

 

Hi Webman,

 

Thanks for your reply. The problem lies with the stations apparently not accepting the HTTP, HTTPS and FTP settings [or at least partially ignoring them! Stations will sometimes accept the HTTP and HTTPS but will always reject the FTP settings]

 

Also all of the preferences are rejected for the exceptions [proxy bypass]

 

HTTP, HTTPS FTP and Proxy bypass problems are seen at all stations [including servers] for staff and students: ie: across the whole domain.

 

Ideas please.

 

Thanks.

 

Edit: Resultant set of Group Policies report appears to show that tyhe required policies are applied successfully [What is that about?]

Edited April 19, 2010 by 6Foot2
Add detail to the post.

[webman]

I think we tracked down our problem with log files/event viewer - things to look out for could be to do with branding. Might be worth checking in IE's Program Files folder or %appdata% etc for IE-related log files. Also search user profile folders for .ins files.

[6Foot2]

I think we tracked down our problem with log files/event viewer - things to look out for could be to do with branding. Might be worth checking in IE's Program Files folder or %appdata% etc for IE-related log files. Also search user profile folders for .ins files.

 

OK. Thanks. That gives me something to work from tomorrow.

[6Foot2]

I can add some detail here although I don't know what it tells me yet.

 

We have had the Mozilla FireFox (3.5.5) package on the network for some time [as re-packaged by Logistix]

 

This works perfectly including seamless access to URLs that IE has trouble with when [even working when working 'normally']

 

The proxy is set independently of IE and the configuration is locked.

 

I have tried creating a separate policy to set JUST the proxy settings for the workstation. This does not set the proxy AND it fouls up the desktop redirection policy.

 

I cannot let FireFox go forward as the fix to this issue as The Head wants IE to work properly.

[ChrisH]

IE Settings and folder redirection in the same policy has always been an issue. Make sure you take out all the IE settings under the GPO that contains the folder redirection stuff.

[6Foot2]

I have had a chat to a fellow Network Manager at a nearby school [many thanks for that] and he has set me on a train of thought which is quite interesting.

 

His thoughts run along the lines that perhaps IE 8 is not full GP compliant on XP and that could explain my problems [we are running IE 8 throughout and although historically it has been a little flaky it has been manageable until now] I am investigating this idea now but I just wanted to ask:

 

1. What are your thoughts?
   
2. Bearing in mind that I cannot deploy IE 7 [without MAJOR work on the network] if this idea is correct what can I do to recover? [leaving IE 8 in place]

 

Many thanks.

[ChrisH]

My interim solution would be to try and find the relevant registry keys that these settings correspond to and use a Startup/Log (Depending if they were user or machine settings) on script to merge them or at least experiment with them to see if you can get it to work that way.

[DMcCoy]

Are the users using a mandatory profile? Incorrect permissions on the HKCU hive will stop IE policies from applying to the profile.

[6Foot2]

Are the users using a mandatory profile? Incorrect permissions on the HKCU hive will stop IE policies from applying to the profile.

 

Yes they do get a mandatory profile.

 

However I have made some progress on this issue and as a result the situation has changed [improved] somewhat.

 

I can now use Internet Explorer Customisation Wizard/IEAK Profile Manager to create customised settings for my stations. I can add these to Group Policy. All good.

 

Except that the setting are still not being applied?

 

Anyone help with this one?

[6Foot2]

A quick bump on this thread: Also a change in direction.

 

I think that most of the settings I currently cannot set, and need to set, In Internet Explorer 8 could be comfigured by automatically settings.

 

Does anyone have a working .JS, .JVS, or .PAC file which they currently use to set their proxies?

 

I know the values I need to set. They are proxies for:

 

HTTP

HTTPS

FTP

 

Gopher and Socks are not used.

 

I also have a longish string I want to specify in the exceptions box.

 

I am guessing that these files are plain text so that they are easy to edit and add to the server.

 

A big thank you to anyone who can solve this for me.

[6Foot2]

Hi all,

 

I have been sent a script [by another Tech who is trying to help but is not 100% clear on how this should work]

 

Here is what I have:

 

try

{

var sh = WScript.CreateObject("Wscript.Shell");

sh.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft1\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable", 1, "REG_DWORD");

sh.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft1\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer", "ftp=FTPProxy:FTPPort;http=HTTPProxy:HTTPPort;https=HTTPSProxy:HTTPSPort", "REG_SZ");

sh.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft1\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride", "Exeption1;Exeption2;Exeption3...", "REG_SZ");

}

catch(e){}

 

I am thinking what I shoul have is something like:

 

{

var sh = WScript.CreateObject("Wscript.Shell");

sh.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft1\\Windows\\CurrentVersion\\Internet Settings\\ProxyEnable", 1, "REG_DWORD");

sh.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft1\\Windows\\CurrentVersion\\Internet Settings\\ProxyServer", "ftp=FTPProxy:FTPPort;http=HTTPProxy:HTTPPort;https=HTTPSProxy:HTTPSPort", "REG_SZ");

sh.RegWrite("HKEY_CURRENT_USER\\Software\\Microsoft1\\Windows\\CurrentVersion\\Internet Settings\\ProxyOverride", "Exeption1;Exeption2;Exeption3...", "REG_SZ");

}

 

[Eliminate the 'try' at the beginning, the 'catch(e){}' at the end, plug in some real values for HTTPProxy and HTTPPorts etc and save the file as a VBS file.

 

Allocate that to the user as a logon script and allow the user to logon.

 

However my script errors out. Can anyone troubleshoot my script for me?

 

Many thanks.

Edited April 29, 2010 by 6Foot2

[danrhodes]

To change the proxy settings using the regsitry you can use this, just put this code into a .reg document, change it for your setup and import it at logon.

 

Windows Registry Editor Version 5.00

 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

"User Agent"="Mozilla/4.0 (compatible; MSIE 6.0; Win32)"

"IE5_UA_Backup_Flag"="5.0"

"NoNetAutodial"=dword:00000000

"MigrateProxy"=dword:00000001

"EnableNegotiate"=dword:00000001

"ProxyEnable"=dword:00000001

"EmailName"="IEUser@"

"AutoConfigProxy"="wininet.dll"

"MimeExclusionListForCache"="multipart/mixed multipart/x-mixed-replace multipart/x-byteranges "

"WarnOnPost"=hex:01,00,00,00

"UseSchannelDirectly"=hex:01,00,00,00

"EnableHttp1_1"=dword:00000001

"PrivacyAdvanced"=dword:00000000

"ProxyServer"="proxy.name.com:port"

"ProxyOverride"=""

"EnableAutodial"=dword:00000000

"PrivDiscUiShown"=dword:00000001

 

 

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]

"NoUpdateCheck"=dword:00000001

"NoJITSetup"=dword:00000001

"Disable Script Debugger"="yes"

"Show_ChannelBand"="No"

"Anchor Underline"="yes"

"Cache_Update_Frequency"="Once_Per_Session"

"Display Inline Images"="yes"

"Do404Search"=hex:01,00,00,00

"Local Page"="C:\\WINDOWS\\system32\\blank.htm"

"Save_Session_History_On_Exit"="no"

"Show_FullURL"="no"

"Show_StatusBar"="yes"

"Show_ToolBar"="yes"

"Show_URLinStatusBar"="yes"

"Show_URLToolBar"="yes"

"Start Page"="http://www.google.co.uk"

"Use_DlgBox_Colors"="yes"

"Search Page"="http://www.google.co.uk"

"NotifyDownloadComplete"="yes"

"FullScreen"="no"

"Window_Placement"=hex:2c,00,00,00,02,00,00,00,03,00,00,00,ff,ff,ff,ff,ff,ff,\

ff,ff,ff,ff,ff,ff,ff,ff,ff,ff,80,00,00,00,00,00,00,00,d8,02,00,00,94,01,00,\

00

"Use Search Asst"="no"

"Use FormSuggest"="yes"

"AddToFavoritesExpanded"=dword:00000000

 

You can use regedit /s and then the location of the reg file to import at logon.

 

D

[6Foot2]

@danrhodes: I tried your registry fragment [thank you BTW] adapting it to my own local needs and ran it locally as administrator [merging it by double clicking]

 

It only inserted the proxies for HTTP and HTTPS leaving out FTP and did not insert any of the exceptions I has specified [ProxyOverride]

[azrael78]

Open up the registry to the location in the .reg.

Deliberately change the setting inside it to match the .reg.

Fire up IE and see what you get.

 

Also you may want to check your group policy settings for 'Make proxy settings per machine rather than per user' - if this is set, it will ALWAYS use whatever the local machine has above and beyond anything the user may have.

 

HTH,

 

Az

[6Foot2]

We appear to have fixed this now [although it still has me baffled!]

 

The exceptions we have been using for absolutely ages appears to be the source of the problem.

 

I was sent a script by an engineer who works at our LEA [they have similar proxy and exceptions to us although not identical] When I ran his script it worked a treat. When I used his script with our exceptions the problem came back. I changed the string of characters which makes up the exceptions list so that it was completely re-written. Still no good.

 

I eventually decided to change the order that the exceptions were listed in and omit one value. That worked. I will leave it at that and retire hurt from this little skirmish.

 

At least we are up and running again.