KB25303 - Group Policy Preferences do not apply to Internet Explorer 9 (Hotfix)

[Arthur]

What this hotfix basically does is add support for IE9 to Group Policy Preferences in a Windows Server 2008 R2 domain. For further details, please see this post on the Group Policy Center blog or the Microsoft KB article linked below.

 

KB2530309 - Internet Explorer Group Policy Preferences do not apply to Internet Explorer 9 in a Windows Server 2008 R2 domain environment

 

SYMPTOMS

Consider the following scenario on a Windows 7-based or Windows Server 2008 R2-based computer:

 

• You have a domain server that is running Windows Server 2008 R2.
  
• You use the Group Policy Administration Tools for Windows Server 2008 R2.
  

In this scenario, in the domain in which you are using Internet Explorer Group Policy Preferences, you encounter the following problems.

 

Problem 1

Microsoft Internet Explorer 6, Windows Internet Explorer 7, and Windows Internet Explorer 8 Group Policy Preference items do not apply to users who are running Windows Internet Explorer 9.

 

Group Policy Preferences logging shows the following...

 

Nonworking scenario

yyyy-mm-dd hh:mm:ss.ms [pid=0x3a0,tid=0xb18] {683F7AD7-E782-4232-8A6D-F22431F12DB5}
[b][color="#FF0000"]yyyy-mm-dd hh:mm:ss.ms [pid=0x3a0,tid=0xb18] Starting class  - Internet Explorer 8.[/color][/b]
yyyy-mm-dd hh:mm:ss.ms [pid=0x3a0,tid=0xb18] Starting filter [AND FilterFile].
yyyy-mm-dd hh:mm:ss.ms [pid=0x3a0,tid=0xb18] Adding child elements to RSOP.
yyyy-mm-dd hh:mm:ss.ms [pid=0x3a0,tid=0xb18] Set user security context.
yyyy-mm-dd hh:mm:ss.ms [pid=0x3a0,tid=0xb18] C:\Program Files\Internet Explorer\iexplore.exe
yyyy-mm-dd hh:mm:ss.ms [pid=0x3a0,tid=0xb18] apmGetFileVersionEx
yyyy-mm-dd hh:mm:ss.ms [pid=0x3a0,tid=0xb18] apmCompareVersionTokens [sUCCEEDED(S_FALSE)]
yyyy-mm-dd hh:mm:ss.ms [pid=0x3a0,tid=0xb18] Set system security context.
yyyy-mm-dd hh:mm:ss.ms [pid=0x3a0,tid=0xb18] Failed hidden filter [FilterFile].
[b][color="#FF0000"]yyyy-mm-dd hh:mm:ss.ms [pid=0x3a0,tid=0xb18] Filters not passed.[/color][/b]
yyyy-mm-dd hh:mm:ss.ms [pid=0x3a0,tid=0xb18] Completed class  - Internet Explorer 8.
yyyy-mm-dd hh:mm:ss.ms [pid=0x3a0,tid=0xb18] Completed class .

 

Working scenario

yyyy-mm-dd hh:mm:ss.ms [pid=0x398,tid=0x29c] {683F7AD7-E782-4232-8A6D-F22431F12DB5}
[b][color="#FF0000"]yyyy-mm-dd hh:mm:ss.ms [pid=0x398,tid=0x29c] Starting class  - Internet Explorer 8.[/color][/b]
yyyy-mm-dd hh:mm:ss.ms [pid=0x398,tid=0x29c] Starting filter [AND FilterFile].
yyyy-mm-dd hh:mm:ss.ms [pid=0x398,tid=0x29c] Adding child elements to RSOP.
yyyy-mm-dd hh:mm:ss.ms [pid=0x398,tid=0x29c] Set user security context.
yyyy-mm-dd hh:mm:ss.ms [pid=0x398,tid=0x29c] C:\Program Files\Internet Explorer\iexplore.exe
yyyy-mm-dd hh:mm:ss.ms [pid=0x398,tid=0x29c] apmGetFileVersionEx
yyyy-mm-dd hh:mm:ss.ms [pid=0x398,tid=0x29c] apmCompareVersionTokens
yyyy-mm-dd hh:mm:ss.ms [pid=0x398,tid=0x29c] Set system security context.
yyyy-mm-dd hh:mm:ss.ms [pid=0x398,tid=0x29c] Passed hidden filter [FilterFile].
[b][color="#FF0000"]yyyy-mm-dd hh:mm:ss.ms [pid=0x398,tid=0x29c] Filters passed.[/color][/b]

[Michael]

I've managed to get around the IE9 and Pop-up blocker issue as follows:

 

Scenario: Running 2008 R2 SP1, with Windows 7 SP1 + IE9 clients. Setting Pop-up exceptions on this GPO (even with the KB2530309 fix) does not work:

 

User Config > Policies > Admin Templates > Windows Components > Internet Explorer - Pop-up allow list - Enabled

 

To get around this problem, install KB2530309, then navigate to:

 

User Config > Preferences > Control Panel Settings - Internet Settings

 

Right click Internet Settings > New > Internet Explorer 8 (Note: With the KB2530309 fix, this applies to both IE8 and IE9).

 

Select the Privacy tab > Settings. Enter your Pop-up exceptions here and apply changes.

 

Now run gpupdate /force on your workstation or restart your workstation. Pop-up exceptions will now work correctly with IE9.

[Michael]

@tonyd - Have a read here. Despite Microsoft releasing this hotfix, it works, but it'll mess up IE8 and IE9 Zones!

 

It looks as though we'll have to wait until Windows 7 SP2 and 2008 R2 SP2 as clearly Microsoft have no intentions on fixing this problem!