windows 8 gpo issue

[sted]

being having a play with win 8 but whatever i do i seem to hit a small wall with gpos

 

i get this error in rsop

 

09 November 2012 10:38:33

 

Internet Explorer Branding failed due to the error listed below.

The specified procedure could not be found.

 

no i narrowed down the offending gpo to the user section of my default domain policy (yey) so i then shoved the pc and used in an ou to which i blocked inheritence and started applying gpos 1 by 1 (how i woked out if was the default domain policy). Since then i have copied the default domain policy and removed every ie setting from it and im still getting the error any ideas a quick screen grab of all settings is below

 

[sted]

bump

 

different school same issue

[Michael]

Have you updated the inetres.admx file on 2008 R2 so it supports IE10? You can normally tell by looking at its timestamp in: C:\Windows\PolicyDefinitions

[sted]

nope but it dosent appear to be the internet explorer bits under -admin templates(i even removed the template from my policy). Ive just been fiddling and setting the homepage in maintanance section with no other gpo setting (well ok ive got a create desktop shortcut to check its worked) that -bombs out so looks like you cant feed it homepage / proxy/favorites the same was as every version of ie from v5

 

and once a setting has been made even if you remove it you have to delete the policy before the error goes away (just disassociating gpupdate and reasociate with the offending setting gone still errors)

 

looks may i may have to wmi filter my default domain gpos to not apply to win8

 

who thought up /tested this damn you microsoft

 

for reference this school its an 08r1 server and inet res is dated 19-12-2009

Edited November 20, 2012 by sted

[Michael]

You could try deploying proxy settings and exceptions via a GPP and see if this works. I presume the registry entry is the same as Windows 7? I would double check this!

[sted]

You could try deploying proxy settings and exceptions via a GPP and see if this works. I presume the registry entry is the same as Windows 7? I would double check this!

might have to (or use a wpad as i did in t'other school) it seems silly that they depreciated a simple way of deploying settings in favour of a complex one

[Michael]

I agree - it's not something I've had to do yet! I'm sure someone else on this forum has posted the exact same problem.

[sted]

I agree - it's not something I've had to do yet! I'm sure someone else on this forum has posted the exact same problem.

 

cant say id noticed

 

atm im torn wether to default my default domain policy settings and add the changes ive made to a new win7< policy or wmi filter it not to apply to win 8 neither strikes me as clever on a working system

[Michael]

I'd create a new OU, move all Win 8 computer objects then link your GPO as required. I wouldn't touch the default domain policy for this purpose.

[Michael]

Just thought - have you tried a proxy.pac file with Win 8?

[sted]

Just thought - have you tried a proxy.pac file with Win 8?

 

tried wpad which is much the same thing

 

the problem is its user settings not pc so block inheritance would be akward

[Michael]

Surely you'd want proxy settings based on user (pupil vs adult) rather than computer.

[AngryTechnician]

This is by design.

 

Internet Explorer Maintenance Replacements

 

Windows 8 with Internet Explorer 10 deprecates IEM in favor of a more robust tool called Group Policy Preferences.

 

The comedy element here is that they regard GPP as more robust, when anyone here who has tried deploying printers with GPP will tell you it is anything but.

 

EDIT: Even better, you actually can't specify the "Automatically detect settings" box to be ticked using GPP, that setting is greyed out.

 

 

The above article says to use IEAK for this, but also says right at the top that "IEAK for Internet Explorer 10 isn't currently available."

Edited November 20, 2012 by AngryTechnician

[sted]

Surely you'd want proxy settings based on user (pupil vs adult) rather than computer.

 

when its the same server for everyone makes no real odds

[sted]

after some thought ive decided the way i think is best to go forwards is to basically copy all the setting in default domain policy (bar ie ones) to a new default domain policy 2 apply that in the same place and disable default domain policy then write an ie policy that ignores win8 and one that only targets win8

 

any reason why this is a dumb idea? Granted disabling the default domain policy isnt ideal but a lot of the sources ive seen about restoring it say basically its a last resort dont do it

 

infact if i set up a new domain on a vm and gust export a std policy could i just import it over the modified one wiping out all settings?

Edited November 21, 2012 by sted

[AngryTechnician]

I would just remove the one setting from Default Domain Policy that is causing problems and then have the targeted GPOs as you describe just for that setting.

[sted]

I would just remove the one setting from Default Domain Policy that is causing problems and then have the targeted GPOs as you describe just for that setting.

 

removing it dosent fix it the pc still knows that it was there and errors

[sted]

just had a thought.

 

disable user portion of default domain policy for everyone

 

copy default domain policy and just enable user settings but tag it with a not win8 wmi

 

that SHOULD to my mind work all the important stuff in ddp is pc there is naff all in user section apart from some old ris stuff 08 cant see the proxy and some odds and ends that hide ie first run etc

 

opinions please

[Michael]

It's not something I've done, but personally I'd leave the Default Domain Policy alone but link another a GPO in the same place.

[psydii]

removing it dosent fix it the pc still knows that it was there and errors

Solution:

Group Policy Internet Explorer Branding reports errorcode 127