none
GPO Internet Explorer Maintenance missing in WS 2008 R2

    Pregunta

  • Hi all

    suddenly I missed the  Internet Explorer Maintenance in WS 2008 R2, when I show the settings tab on the GPO it self its showing properly, but I cant find it when I try to edit.

    any assistance on that ?


    martes, 26 de marzo de 2013 12:27

Respuestas

  • Create a new set of GPOs that does not use IE Maintenance (all of its features are available through Administrative Templates or Group Policy Preferences).  Apply this GPO set in addition to your current one, maybe with a WMI filter on the file version of iexplore.exe:

    select * from CIM_Datafile where name="C:\\Program Files\\Internet Explorer\\iexplore.exe" and version>10

    To test this query, open PowerShell and run

    get-wmiobject -Query 'select * from CIM_Datafile where name="C:\\Program Files\\Internet Explorer\\iexplore.exe" and version>10'

    regards, Martin


    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!

    miércoles, 03 de abril de 2013 12:26
  • This option has now been deprecated and is no longer editable from a Windows 8 /2012 computer. However I do believe it still should be then in Windows 2008 R2. Is there any chance the GPO was made on a Windows 8 /2012 computer?


    Alan Burchill (MVP)
    http://www.grouppolicy.biz

    @alanburchill

    miércoles, 27 de marzo de 2013 0:49
  • Am 01.04.2013 09:35, schrieb Khalid Ibrahim:
    > I just uninstalled IE 10 from my DC and BINGO the GPO settings
    > appeared back, but I am sure that's not healthy for my environment, am
    > I correct?
     
    Unfortunatley "no, you are not correct". As soon as you install IE10,
    you cannot edit IE Maintenance anymore. The required mmc snapin is
    removed with IE10 installation, and this is "by design".
     
    regards, Martin
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    lunes, 01 de abril de 2013 21:22

Todas las respuestas

  • This option has now been deprecated and is no longer editable from a Windows 8 /2012 computer. However I do believe it still should be then in Windows 2008 R2. Is there any chance the GPO was made on a Windows 8 /2012 computer?


    Alan Burchill (MVP)
    http://www.grouppolicy.biz

    @alanburchill

    miércoles, 27 de marzo de 2013 0:49
  • Hi Alan

    my sever have 2008 R2 all clients working on Windows 7 except 5 machines working on Windows 8, should this 5 machine effect on GPO ?

    thanks for your response  

    miércoles, 27 de marzo de 2013 4:57
  •  
    > suddenly I missed the  Internet Explorer Maintenance in WS 2008 R2,
    > when I show the settings tab on the GPO it self its showing properly,
    > but I cant find it when I try to edit.
     
    Did you install IE10? Then - fortunately - it is gone...
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    jueves, 28 de marzo de 2013 23:01
  • Martin

    never I didn't nothing was installed


    Waiting My Destiny

    sábado, 30 de marzo de 2013 13:27
  •  
    > never I didn't nothing was installed
    > ------------------------------------------------------------------------
    >
     
    So, what IE version do you have installed?
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    sábado, 30 de marzo de 2013 17:55
  • Martin good day

    I meant I didn't installed the IE 10 manually, everything going through automatic update, the IE is 10 that's correct, and from update history its updated in 13 march 2013 witch is before the problem by 1 day. and there is tow Failed IE 10 update then it success, I hope this help.

    waiting for you, and ample thanks in advance


    Waiting My Destiny

    domingo, 31 de marzo de 2013 5:22
  • Martin

    I just uninstalled IE 10 from my DC and BINGO the GPO settings appeared back, but I am sure that's not healthy for my environment, am I correct?

    there is should be something I missed from Microsoft, I mean why this GPO disappeared when IE updated to IE 10, its mean there is something new and I don't know it, so please tell me what is going around, why this happened with this update what's new with IE 10 for proxy settings ?

    thanks in advance and really appreciated.


    Waiting My Destiny

    lunes, 01 de abril de 2013 7:35
  • Am 01.04.2013 09:35, schrieb Khalid Ibrahim:
    > I just uninstalled IE 10 from my DC and BINGO the GPO settings
    > appeared back, but I am sure that's not healthy for my environment, am
    > I correct?
     
    Unfortunatley "no, you are not correct". As soon as you install IE10,
    you cannot edit IE Maintenance anymore. The required mmc snapin is
    removed with IE10 installation, and this is "by design".
     
    regards, Martin
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    lunes, 01 de abril de 2013 21:22
  • Thanks martin

    yesterday I removed IE10 and I get back the GPO, that's happened already, what I am confused about is should I keep it like this?? and if I reinstalled IE10 so what I should do regarding IE Maintenance  settings??

    please help 


    Waiting My Destiny

    martes, 02 de abril de 2013 5:22
  • Create a new set of GPOs that does not use IE Maintenance (all of its features are available through Administrative Templates or Group Policy Preferences).  Apply this GPO set in addition to your current one, maybe with a WMI filter on the file version of iexplore.exe:

    select * from CIM_Datafile where name="C:\\Program Files\\Internet Explorer\\iexplore.exe" and version>10

    To test this query, open PowerShell and run

    get-wmiobject -Query 'select * from CIM_Datafile where name="C:\\Program Files\\Internet Explorer\\iexplore.exe" and version>10'

    regards, Martin


    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!

    miércoles, 03 de abril de 2013 12:26
  • Apparently, when you install IE10 it removes IE Maintenance from your system. We are trying to get clarification on the expected behavior for Win7 / Win2008 r2 machines which I suspect is the same as described in the TechNet article below:

    miércoles, 24 de abril de 2013 21:43
  • Alex-

    Sadly, the expected behavior is you are out of luck.

    Don't upgrade to IE 10 on Win7/2008-R2 if you need to continue to edit OR process IE Maintenance Policy. This has been confirmed internal and external to MS.

    Darren


    Darren Mar-Elia MS-MVP, Group Policy
    www.gpoguy.com
    www.sdmsoftware.com - "The Group Policy Experts"

    miércoles, 24 de abril de 2013 22:33
  • Alex-

    Sadly, the expected behavior is you are out of luck.

    Don't upgrade to IE 10 on Win7/2008-R2 if you need to continue to edit OR process IE Maintenance Policy. This has been confirmed internal and external to MS.

    Darren


    Darren Mar-Elia MS-MVP, Group Policy
    www.gpoguy.com
    www.sdmsoftware.com - "The Group Policy Experts"

    Seriously this latest generation of Microsoft makes me shake my head more and more.  What was the point of removing this?  Now those of us who use pac files to guide some of our net traffic through are going to have much harder times.  It wouldn't be bad if there was an alternate way to set the auto configuration to the pac file a different way but I have yet to find it...

    viernes, 10 de mayo de 2013 18:12
  •  Now those of us who use pac files to guide some of our net traffic through are going to have much harder times.  It wouldn't be bad if there was an alternate way to set the auto configuration to the pac file a different way but I have yet to find it...

    GPP can do that. we've been using that to set our pac file, for years on Win7 with IE8, and IE9 and now IE10/Win8

    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

    viernes, 10 de mayo de 2013 20:58
  • Am 10.05.2013 20:12, schrieb aoverman295:
    > if there was an alternate way to set the auto configuration to the pac
    > file a different way but I have yet to find it...
     
    I agree with Don - we use GPP Internet settings to provide different pac
    files based on whether the computer is a RDS server or not, whether Fast
    User Switching is enabled or not (Item Level Targeting on registry
    values) and so on... Works perfectly without a hassle ;-)
     

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    Wenn meine Antwort hilfreich war, freue ich mich über eine Bewertung! If my answer was helpful, I'm glad about a rating!
    sábado, 11 de mayo de 2013 20:36
  • this morning I installed on one domain controller (running 2008 r2 sp1) Administrative Templates (.admx) for Windows 8 and Windows Server 2012  and now under user configuration -  policies  - windows settings i don't have internet explorer maintenance ...

    What is the problem ?

    I need to manage both policies for i.e. 8 and i.e. 10 ...

    miércoles, 11 de septiembre de 2013 10:57
  • Any search engine will tell you this: You are using IE10 -> no IE Maintenance anymore.

    Martin

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))

    Restore the forum design - my user defined Cascading Style Sheet!

    miércoles, 11 de septiembre de 2013 16:29
  • I found myself in the same seemingly leaky MS lifeboat.

    I have a group pf XP, IE8 and 9 and 10 and 11. On these we had a simple GPO managing the proxy setting for ALL users.

    After reading Martin Binder's answer things became clearer but still induced a headache.

    The simple answer seems to be as follows: Create a new GPO. Expand User Configuration > Preferences > Control Panel Settings.

    Right Click "Internet Settings", Select "New" and select your version of IE.

    The Properties dialogue appears. Makes changes as needed. (Why do we need a different GPO for each version I have no idea!)

    Now to find out how to create a GPO to control the proxy for IE10, 11 ..............  (Panado time again)


    • Editado Clyde Wynter miércoles, 18 de diciembre de 2013 14:41
    miércoles, 18 de diciembre de 2013 14:40
  • > The Properties dialogue appears. Makes changes as needed. (Why do we
    > need a different GPO for each version I have no idea!)
     
    You do not. Simply edit the XML and change the hidden version filter for
    iexplore.exe to max="99.0.0".
     

    Martin

    Mal ein GUTES Buch über GPOs lesen?

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))
    jueves, 19 de diciembre de 2013 9:53
  • I feel like I'm missing something obvious here...

    I need to add to my list of "Trusted Sites".  We're in the same boat; "IE Maintenance Policy" is gone.

    When I follow these instructions, e.g.

    "Create a new GPO. Expand User Configuration > Preferences > Control Panel Settings.

    Right Click "Internet Settings", Select "New" and select your version of IE.

    The Properties dialogue appears. Makes changes as needed."

    I find that Trusted Sites is grayed out.

    Obviously I'm doing something goofy and can't see it.  Any ideas?

    Thanks in advance!

    jueves, 02 de enero de 2014 18:06
  • Hello all,

    I am not understanding the solutions offered here, as they do not seem to jive with what I am seeing.

    I have a windows 2008r2 Active Directory server.  I use to be able to set the proxy settings in the user configuration, policies, windows settings.  I understand that this has been deprecated with the installation of IE10.  Yet, when I click on the settings tab across the top of the screen, to view the settings in the group Policy without going into the actual policy, I see my settings.  I can not modify or delete them, as I do not see them anywhere in the actual policy anymore.

    Fine....I have no problem deleting this policy and starting from scratch. 

    What I see we have been told is that we should now do this in preferences, control panel settings, Internet Settings.  I would have no problem here either, except everything I see doesn't jive with what others are seeing.  I right click, and all I see is IE5 and 6, IE7, and IE8.  I do not see IE9 or IE10 as an option.

    I have downloaded and installed that Windows 8 and windows 2012 administrative template msi.

    Am I still missing something? I don't like the answer I got someplace else, which said....Upgrade Windows 2008r2 to 2012r2 and suddenly everything will work. If IE10 policies don't work in Windows 2008r2, why were we forced to upgrade IE?

    Tom

    miércoles, 22 de enero de 2014 19:13
  • > others are seeing.  I right click, and all I see is IE5 and 6, IE7, and
    > IE8.  I do not see IE9 or IE10 as an option.
     
    Yes, that's right. As I posted above, you need to edit the XML.
     
     
     

    Martin

    Mal ein GUTES Buch über GPOs lesen?

    NO THEY ARE NOT EVIL, if you know what you are doing: Good or bad GPOs?
    And if IT bothers me - coke bottle design refreshment :))
    jueves, 23 de enero de 2014 7:42
  • Am 01.04.2013 09:35, schrieb Khalid Ibrahim:
    > I just uninstalled IE 10 from my DC and BINGO the GPO settings
    > appeared back, but I am sure that's not healthy for my environment, am
    > I correct?
     
    Unfortunatley "no, you are not correct". As soon as you install IE10,
    you cannot edit IE Maintenance anymore. The required mmc snapin is
    removed with IE10 installation, and this is "by design".
     
    regards, Martin
    The Internet Explorer Maintenance option allowed a policy to add URL's to the security zone, but still allowed users the discretion of adding their own sites. This scenario can be very desirable in many enterprise scenarios. Subsequent security zone policy configurations, on the other hand, would overwrite individually-defined zones and effectively lock the zones down. Do later implementations allow for both scenarios?
    miércoles, 12 de marzo de 2014 20:34
  • The Internet Explorer Maintenance option allowed a policy to add URL's to the security zone, but still allowed users the discretion of adding their own sites. This scenario can be very desirable in many enterprise scenarios. Subsequent security zone policy configurations, on the other hand, would overwrite individually-defined zones and effectively lock the zones down. Do later implementations allow for both scenarios?

    You can use GPP to populate the Site-to-Zone data in the registry:
    http://www.grouppolicy.biz/2012/07/how-to-configuring-ie-site-zone-mapping-using-group-policy-without-locking-out-the-user/

    http://www.grouppolicy.biz/2010/03/how-to-use-group-policy-to-configure-internet-explorer-security-zone-sites/

    http://blogs.msdn.com/b/asiatech/archive/2013/01/04/how-to-add-trust-sites-into-ie-before-ie10-through-group-policy.aspx


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)



    • Editado DonPick jueves, 13 de marzo de 2014 0:52
    jueves, 13 de marzo de 2014 0:35