User Group Policy – Internet Explorer (#2)

Group Policy – Internet Explorer for Users (#2)

This section is mainly about Group Policies for tying down the user rather than being ‘Mr Nice’.  If you like wearing the ‘Mr Nasty’ hat, then there are lots of Group Policies here for you to screw down the user settings.

There are three places where you can configure Internet Explorer policies.

1. User Configuration, Windows Settings, Internet Explorer Maintenance (Best)
2. User Configuration, Administrative Templates, Windows Components, Internet Explorer (Here)
3. Computer Configuration, Administrative Templates, Windows Components, Internet Explorer

  ‡

Group Policy Topics

Administrative Templates

     Windows Components

      Internet Explorer Root

• Internet Control Panel

• Offline Pages

• Browser menus

• Toolbars

• Persistent behaviour

• Administrator Approved Controls

3. Computer Configuration for Internet Explorer

* Guy’s Top Three Internet Explorer Group Policies

1. Group Policy Internet Explorer Autocomplete
2. Disable Save Program To Disk
3. Administrator Approved Controls

Root – User Settings

Put blinkers on the users, is the theme of this section.  For example, force users to concentrate on their jobs by stopping them from changing the Proxy addresses, Ratings, Connections and many similar areas.

Companies with Internet Browsing policies will love this section.  Alternatively, you could turn the situation on its head and design your office paper based policy using ideas copied from these Group Policy settings.

* Disable Attachment Download from Outlook Express could be worth considering.

Group Policy Internet Explorer Autocomplete

Be careful with ‘Disable AutoComplete forms’, this is designed to stop forms saving passwords and usernames that people use regularly.  I say be careful, because I really like being able to save my username and password, that way, I do not having to keep typing it in every time I visit a site.

Manual steps to ‘walk through’ IE AutoComplete

1. Launch Internet Explorer.
2. Seek the Tools menu / button and click on Internet Options.
3. In the Internet Options window click the Content tab.
4. Click the AutoComplete button.
5. Check or uncheck the options you wish have or not have AutoComplete.

• Web page addresses – AutoComplete refers to the address you type in the address bar.
• Forms – Fill out fields that are commonly completed such as email, phone number and address
• User names and passwords on forms – The main Internet Explorer AutoComplete setting: Any forms that require usernames.  

Guy Recommends: Permissions Analyzer – Free Active Directory Tool

I like thePermissions Monitor because it enables me to see quickly WHO has permissions to do WHAT.  When you launch this tool it analyzes a users effective NTFS permissions for a specific file or folder, takes into account network share access, then displays the results in a nifty desktop dashboard!

Think of all the frustration that this free utility saves when you are troubleshooting authorization problems for users access to a resource.  Give this permissions monitor a try – it’s free!

Download Permissions Analyser – Free Active Directory Tool

Internet Control Panel

Once again ‘Disable’ is the theme.  You can prevent the users from even seeing tabs like security and content in Internet Explorer.  In addition, you can even control what the users can do thought the Computer Configuration settings.

Offline Pages

Do you really want to disable users from saving pages?  Probably, if the machine is a kiosk or in a public area.

Browser Menus

If you are serious about security, then you will need to disable the ability to *Save Program To Disk.  As for the rest of the Group Policies, they seem pretty harmless to me and, I cannot make a good case for disabling many of these settings.

Toolbars

I like the Alexa and Google toolbars so I would be dismayed if a policy denied me these useful aids.

Persistent Behaviour

Here is where you can set limits on files saved from various zones.  Useful when short of disk space.  Worth setting if you are going to restrict the internet temporary files in general.

* Administrator Approved Controls

Here we are talking ActiveX.  The danger is that rogue ActiveX code could cripple a machine.  What these policies will do is help you Approve Zones where users can run Chat, Shockwave, Media Player and similar ‘Real Time’ programs.

Summary of GPO Internet Settings

There are about a dozen places to check the IE Group Policy settings, the main settings located in these three areas:

• User Configuration, Windows Settings, Internet Explorer Maintenance (Best)
• User Configuration, Administrative Templates, Windows Components, Internet Explorer
• Computer Configuration, Administrative Templates, Windows Components, Internet Explorer

3. Computer Configuration, Administrative Templates, Windows Components, Internet Explorer

Only employ these user settings if you wish to ‘fine tune’ the Internet Control Panel in the above User Configuration, Administrative Templates.  90% of the IE policies are taken care of in the User Settings.

‘Make Proxy Server per machine’ – may be worth considering.

See more user Group Policies for Windows

• GPO Tips  •Troubleshooting Group Policies   •Windows Components   •GPMC

• Group Policies   •Windows Settings  •Logon Script Policies  •IE Autocomplete

• Security Options   • Group Policy Overview   •GPO WMI Filter Examples