locked
GPO Internet explorer 11 RRS feed

  • Question

  • Hi all I have copied the lastest inetres.admx and inetres.adml to their respective folders under my PolicyDefinitions folder in SYSVOL. I am using a windows 7 workstation with internet explorer 11 installed along with RSAT SP1 + Group Policy editor. Upon opening a policy to edit under User Configuration - Control Panel Settings - Internet Settings, Internet Explorer 10 is missing, only see (5,6,7,8) I've been reading that if I want to use these internet preferences with the new ADMX files I'll have to use a Windows 8 or Windows 2012 machine to do so.  I got that information here . Can anyone confirm that? Seems awfully odd that I couldn't edit internet preferences from my console without WIN8 / 2012

    TIA

    Monday, March 3, 2014 8:52 PM

Answers

  • Hi TIA,

    As I know, the option to manage IE 9/10 is missing in Windows Server 2008 and Windows 7.

    You can creat a Windows Server 2012 VM in your environment to strictly do GPO management.

    Hope it helps.

    Regards,

    Blair Deng


    Blair Deng
    TechNet Community Support

    • Marked as answer by Mike_Kubi Tuesday, March 4, 2014 5:39 PM
    Tuesday, March 4, 2014 8:35 AM

All replies

  • Hi TIA,

    As I know, the option to manage IE 9/10 is missing in Windows Server 2008 and Windows 7.

    You can creat a Windows Server 2012 VM in your environment to strictly do GPO management.

    Hope it helps.

    Regards,

    Blair Deng


    Blair Deng
    TechNet Community Support

    • Marked as answer by Mike_Kubi Tuesday, March 4, 2014 5:39 PM
    Tuesday, March 4, 2014 8:35 AM
  • I'm not sure that you've interpreted the information on Alan's IE10 grouppolicy.biz article correctly.

    His article is dealing with Group Policy Preferences, and also he recommends using the latest OS to best handle GP settings (which are both good bits of advice), but, GPP has some differences when it comes to authoring/editing browser settings, and those differences for GPP aren't related to ADM/ADMX/ADML at all (since Admin templates are not relevant to GPP at all).

    GPP uses specific DLLs which are part of the OS (well, post-VistaSP1, they are OS components).

    The introduction of IE10/IE11, deprecates IEM (a very old/early method of implementing "preferences").

    There are also some traps about using GPP for browser-version-specific settings, because the GPP DLLs reference a "hidden" XML file, and as Alan's older article mentions, you might need to "hack" that XML (or, grab the relevant hotfix), to honour the browser version. Also note that in the GPP administrative UI, you will not see IE11 listed, but, with the correct hotfix or on a later OS (Win8 or WS2012) regardless of the browser version targeting in the admin UI, the IE10 GPP *will* apply to IE11.

    Based on what you're describing, it sounds like you are actually trying to use GPP (preferences), and not "classic GPO / admin templates"?  (or have I misunderstood?)

    Take a look in the GP forum, this topic comes up very frequently there.


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)


    • Edited by DonPick Tuesday, March 4, 2014 9:22 AM
    Tuesday, March 4, 2014 9:22 AM
  • TO manage newer IEs I have created the policy that applies to IE8 and the gone to \\domain\sysvol\policies\policyGUID and find the relevant xml (user or computer)

    to find the correct GUID i usually make an insignificant change in the policy and then sort after date, to find the latest edited folder :-)

    edit the xml and set "max" to a higher version. I have only tested this with IE10 but might work with IE11

    EDIT:Of course this also depends on which specific elements you are trying to manage. I only have 2008R2 DCs and this was the quickest way to set some basic options in peoples' IE

    <IE8 clsid="{683F7AD7-E782-4232-8A6D-F22431F12DB5}" name="Internet Explorer 8" status="Internet Explorer 8" changed="2014-03-04 09:24:14" uid="{46EC1FA5-26E6-4B8B-9084-4D2A2C050EDE}"><Filters><FilterFile hidden="1" not="0" bool="AND" path="%ProgramFilesDir%\Internet Explorer\iexplore.exe" type="VERSION" gte="1" min="8.0.0.0" max="10.9.0.0" lte="0"/></Filters><Properties><Reg id="Homepage" type="REG_SZ" hive="HKEY_CURRENT_USER" key="Software\Microsoft\Internet Explorer\Main" name="Start Page" value="http://intranet/"/><Reg id="SecondaryStartPages" type="REG_MULTI_SZ" hive="HKEY_CURRENT_USER" key="Software\Microsoft\Internet Explorer\Main" name="Secondary Start Pages" value=""/></Properties></IE8>


    • Edited by csteinDK Tuesday, March 4, 2014 9:37 AM
    Tuesday, March 4, 2014 9:30 AM
  • I'm not sure that you've interpreted the information on Alan's IE10 grouppolicy.biz article correctly.

    His article is dealing with Group Policy Preferences, and also he recommends using the latest OS to best handle GP settings (which are both good bits of advice), but, GPP has some differences when it comes to authoring/editing browser settings, and those differences for GPP aren't related to ADM/ADMX/ADML at all (since Admin templates are not relevant to GPP at all).

    GPP uses specific DLLs which are part of the OS (well, post-VistaSP1, they are OS components).

    The introduction of IE10/IE11, deprecates IEM (a very old/early method of implementing "preferences").

    There are also some traps about using GPP for browser-version-specific settings, because the GPP DLLs reference a "hidden" XML file, and as Alan's older article mentions, you might need to "hack" that XML (or, grab the relevant hotfix), to honour the browser version. Also note that in the GPP administrative UI, you will not see IE11 listed, but, with the correct hotfix or on a later OS (Win8 or WS2012) regardless of the browser version targeting in the admin UI, the IE10 GPP *will* apply to IE11.

    Based on what you're describing, it sounds like you are actually trying to use GPP (preferences), and not "classic GPO / admin templates"?  (or have I misunderstood?)

    Take a look in the GP forum, this topic comes up very frequently there.


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)


    Hi I think I've read it correctly, if you look at his last statement "However the Internet Explorer Group Policy preference are not as easily updated and you will still need to using a Windows 8/2012 computer to edit the IE 10 Preferences settings." that explains it all. I've included a screen grab to clear up any confusions. I'm well aware that GPP IE 10 will work with any version of IE > 10. Please see screen grab.
    Tuesday, March 4, 2014 2:34 PM
  • TO manage newer IEs I have created the policy that applies to IE8 and the gone to \\domain\sysvol\policies\policyGUID and find the relevant xml (user or computer)

    to find the correct GUID i usually make an insignificant change in the policy and then sort after date, to find the latest edited folder :-)

    edit the xml and set "max" to a higher version. I have only tested this with IE10 but might work with IE11

    EDIT:Of course this also depends on which specific elements you are trying to manage. I only have 2008R2 DCs and this was the quickest way to set some basic options in peoples' IE

    <IE8 clsid="{683F7AD7-E782-4232-8A6D-F22431F12DB5}" name="Internet Explorer 8" status="Internet Explorer 8" changed="2014-03-04 09:24:14" uid="{46EC1FA5-26E6-4B8B-9084-4D2A2C050EDE}"><Filters><FilterFile hidden="1" not="0" bool="AND" path="%ProgramFilesDir%\Internet Explorer\iexplore.exe" type="VERSION" gte="1" min="8.0.0.0" max="10.9.0.0" lte="0"/></Filters><Properties><Reg id="Homepage" type="REG_SZ" hive="HKEY_CURRENT_USER" key="Software\Microsoft\Internet Explorer\Main" name="Start Page" value="http://intranet/"/><Reg id="SecondaryStartPages" type="REG_MULTI_SZ" hive="HKEY_CURRENT_USER" key="Software\Microsoft\Internet Explorer\Main" name="Secondary Start Pages" value=""/></Properties></IE8>


    Thanks I'd prefer not to rig it.
    Tuesday, March 4, 2014 2:36 PM
  • Thanks, I think I'm slowly coming to that conclusion. Why Microsoft has done this is beyond me. Seems a bit silly to force someone into a newer operating system.
    Tuesday, March 4, 2014 2:43 PM
  • Hi TIA,

    As I know, the option to manage IE 9/10 is missing in Windows Server 2008 and Windows 7.

    You can creat a Windows Server 2012 VM in your environment to strictly do GPO management.

    Hope it helps.

    Regards,

    Blair Deng


    Blair Deng
    TechNet Community Support

    I'd just like yo say, you're right . see screen shot this is from windows 8 pro with RSAT tools installed. I can't believe you can't manage this from Windows 7 or server 2008 R2!
    Tuesday, March 4, 2014 5:38 PM
  • Hi I think I've read it correctly

    It was your mention of PolicyDefinitions/admin templates (ADMX), which threw me. :)
    You mentioned ADMX, then switched to the topic of preferences. They are not related.
    The "full" policy path in GPMC that you're referring to, is this (GPP) path?
    User Configuration\Preferences\Control Panel Settings\Internet Settings.

    http://support.microsoft.com/kb/2530309/en-us can help, but read the KB carefully, since it "fixes" the problem of GPP not being able to author IE9 settings via GPP when using GPMC on Win7/WS2008R2, but, it doesn't change the GPP GPMC UI (it still only offers IE8 and below, but will work for IE9).
    Alan and others have also commented that because it changes the filtering clause in the XML that it also allows the settings to apply to later IE versions too (but I haven't tested that myself).

    I use Win8 to manage my GP these days, so don't have the constraint myself.


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

    Tuesday, March 4, 2014 8:14 PM
  • Hi I think I've read it correctly

    It was your mention of PolicyDefinitions/admin templates (ADMX), which threw me. :)
    You mentioned ADMX, then switched to the topic of preferences. They are not related.
    The "full" policy path in GPMC that you're referring to, is this (GPP) path?
    User Configuration\Preferences\Control Panel Settings\Internet Settings.

    http://support.microsoft.com/kb/2530309/en-us can help, but read the KB carefully, since it "fixes" the problem of GPP not being able to author IE9 settings via GPP when using GPMC on Win7/WS2008R2, but, it doesn't change the GPP GPMC UI (it still only offers IE8 and below, but will work for IE9).
    Alan and others have also commented that because it changes the filtering clause in the XML that it also allows the settings to apply to later IE versions too (but I haven't tested that myself).

    I use Win8 to manage my GP these days, so don't have the constraint myself.


    Don
    (Please take a moment to "Vote as Helpful" and/or "Mark as Answer", where applicable.
    This helps the community, keeps the forums tidy, and recognises useful contributions. Thanks!)

    Thanks sorry I figured the picture would help out and it seems it did. I won't apply the hotfix, I probably would have found that hotfix if they added more keywords like Internet explorer 10 or something. Thanks again
    • Proposed as answer by JasonProos Wednesday, September 2, 2015 3:10 PM
    Tuesday, March 4, 2014 8:31 PM