locked
App-V Software Policy Restrictions for IE RRS feed

  • Question

  • I am not sure if this is even possible, but in a particular package we are deploying for our company, one of the last steps is to create a desktop shortcut to Internet Explorer.

    We want it so when the user opens this specific IE icon, the "Connections" tab and Proxy settings are disabled in IE (but not if they launch the non-appv shortcut of IE). I know you can add these settings via the virtual registry, but they don't seem to take effect. Is there a way to do this? Or somehow apply some GPO to hide those items in the Internet Options when they launch the IE icon?


    • Edited by jrmoat Friday, May 9, 2014 7:27 PM
    Friday, May 9, 2014 7:24 PM

Answers

  • It appears that it may not work in the latest hotfix version of AppV. Is there any other possible way to disable the proxy settings so that when they launch the IE shortcut created in the Appv package, they can't browse to the internet? 

    Primarily, this package runs an older version of Java 6 to be compatible with the software our company uses. IE 9 or 10 also must be used, as IE 11 is not compatible either.

    Because it's using an older version of Java 6, we want to prevent IE from being able to connect to anything other than our local intranet when they launch the AppV IE shortcut. I've verified that launching the shortcut does enable Java 6 (whereas when you run the regular Internet Explorer icon, Java isn't installed). But I'm not sure how to disable proxy settings other than registry keys.

    Tuesday, May 13, 2014 3:55 PM
  • Only other route I could think of is a group policy... or possibly a policy being set by something like AppSense or RES for when the application is launched 

    PLEASE MARK ANY ANSWERS TO HELP OTHERS Blog: rorymon.com Twitter: @Rorymon

    Tuesday, May 13, 2014 11:10 PM

All replies

  • Dan blogged about sequencing policies, check it out: http://packageology.com/2014/02/overriding-group-policy-settings-app-v/
    Friday, May 9, 2014 8:46 PM
  • That's a very good post. Thank you. Don't know if it worked for me. It's possible that the domain policy is overriding it, but I am not sure.

    I deleted HKEY_LOCAL_MACHINE\SOFTWARE\Policies

    And then added the following entries into the following registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Control Panel

    "Connection Settings"=dword:00000000 "Connwiz Admin Lock"=dword:00000000 "Autoconfig"=dword:00000000 "Proxy"=dword:00000000 "ConnectionsTab"=dword:00000000

    But, it didn't seem to work. I checked the registry after launching the virtual app/package (not sure if the virtual registry settings would show up on the local machine), I didn't see those DWORD values there. I also tried both MERGE and OVERRIDE, but no luck. Hmm...



    • Edited by jrmoat Friday, May 9, 2014 10:52 PM
    Friday, May 9, 2014 10:51 PM
  • Did you checked if those registry keys are present inside the bubble?

    What App-V version are you using?

    Sunday, May 11, 2014 6:56 PM
  • Hello,

    This registry keys will not be visible in _that_ location if they are part of the package.

    Check via virtual instance of registry, or the redirected location. Use App-V Manage to start regedit virtualized;

    http://www.tmurgent.com/Tools/AppV_Manage/Default.aspx


    Nicke Källén | The Knack| Twitter: @Znackattack

    Sunday, May 11, 2014 7:09 PM
  • Hello Ben and Nicke,

    I believe I'm using the latest version.

    AppV Server 5.0 SP1 (Hotfix 4)
    AppV Client 5.0 SP2 (Hotfix 4 - KB2956985)
    AppV Sequencer 5.0 SP2 (KB2956985)


    I launched regedit (32-bit) under the Debug Packages in the App-V manage program. I don't see my registry keys there. Seems like the keys weren't kept in my package. 

    Edit:

    I think I misunderstood the article. I must remove the HKLM\Software\Policies from the PassThroughPaths registry string. I'll try it again.

    • Edited by jrmoat Monday, May 12, 2014 4:34 PM
    Monday, May 12, 2014 3:06 PM
  • Still no luck. So, do I need to edit the string and remove HKEY_LOCAL_MACHINE\SOFTWARE\Policies? Or do I need to actually delete the actual HKEY_LOCAL_MACHINE\SOFTWARE\Policies registry key, and then add my IE Control Panel restrictions via the Virtual Registry?

    [HKEY_LOCAL_MACHINE \SOFTWARE\Microsoft\AppV\Subsystem\VirtualRegistry]
    PassThroughPaths = REG_MULTI_SZ :
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WINEVT
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\eventlog\Application
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\WMI\Autologger
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Perflib
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies
    HKEY_CURRENT_USER\SOFTWARE\Policies

    I'm looking at that Appv-Manage registry function, and still don't see any of my keys. So it's got to be getting erased during sequencing, or when I save the package.

    Monday, May 12, 2014 10:19 PM
  • The article appears to state that you should delete the hive. If I was you, I'd first backup the registry just incase, just do an export. Delete the reg hive you have highlighted. Then try out your package with the Policies registry key you want merged with the registry in the virtual bubble...Honestly, I know Dan has suggested it's a work-around but I wouldn't get in the habit of including any policies in a package like that unless you really have to.

    PLEASE MARK ANY ANSWERS TO HELP OTHERS Blog: rorymon.com Twitter: @Rorymon

    Monday, May 12, 2014 11:35 PM
  • It appears that it may not work in the latest hotfix version of AppV. Is there any other possible way to disable the proxy settings so that when they launch the IE shortcut created in the Appv package, they can't browse to the internet? 

    Primarily, this package runs an older version of Java 6 to be compatible with the software our company uses. IE 9 or 10 also must be used, as IE 11 is not compatible either.

    Because it's using an older version of Java 6, we want to prevent IE from being able to connect to anything other than our local intranet when they launch the AppV IE shortcut. I've verified that launching the shortcut does enable Java 6 (whereas when you run the regular Internet Explorer icon, Java isn't installed). But I'm not sure how to disable proxy settings other than registry keys.

    Tuesday, May 13, 2014 3:55 PM
  • Only other route I could think of is a group policy... or possibly a policy being set by something like AppSense or RES for when the application is launched 

    PLEASE MARK ANY ANSWERS TO HELP OTHERS Blog: rorymon.com Twitter: @Rorymon

    Tuesday, May 13, 2014 11:10 PM