none
Command-line disabling of specific IE add-ons? RRS feed

  • Question

  • Is it possible to disable a particular IE 8/9 add-on using a command, registry key, etc? Or even group policy. Do these settings live in HKCU somewhere?

    At the moment, I'm looking to disable an Adobe Reader plug-in added by their new XI (v11) product. I would take this to Adobe, but as more of a general question; if there is such a way to manipulate these types of browser settings, I'd have other uses for it too.

    I would like to include such a change as part of an SCCM package so that it targets only those users and does so silently. Running the No-Addons IE or "iexplore.exe -extoff" isn't an option.

    Friday, February 8, 2013 1:27 PM

Answers

  • Hi,

    Ie maintains a list of Addons in the registry to which it assigns a status flag (enabled/disabled) and also entries for statistics (load time, no of times the control has been blocked)... this is outside of the GPO registry entries and is no-user or Administrator maintainable....

    Adobe are incorrect.... re: http://helpx.adobe.com/acrobat/using/display-pdf-browser-acrobat-xi.html

    the Adobe PDF ActiveX control uses a satellite BHO.... Adobe PDF link helper.... it and not the ActiveX component is the 'broker' process that determines how the PDF link on a page is to be processed....the Adobe PDF Link Helper BHO is a broker process for the Adobe PDF Reader ActiveX.... both the PDF Link helper and the Adobe PDF reader ActiveX control need to have the same state.....enabled/disabled

    You are seeing inconsistent results on your network because different users have different status's for the ActiveX and BHO components, one enabled, one disabled....

    IE uses a holistic method of determining the satellite BHO's that may be dependent on other ActiveX or Toolbar components.... for example If a user disables the Google toolbar they will also be prompted to disable other Google branded addons (BHOs) they have installed....a look in HKCR will show the dependencies of the google toolbar.... quite a few...

    If you want to manage your users Addons on your network.... you have a white list of allowed controls in GPO, but to stop users enabling/disabling Addons at will (and making the wrong choice as to what components of an Addon need also to be enabled/disabled) you need to block access to the IE Addons Manager using GPO... it is not my intention here to explain fully, but I expect that also you need to deploy an ins file under the users profile that will reset the status of Addons in the registry. Normally when an Addon is first installed (using a Windows installer package), IE itself will create the Addons management registry entries... (users see an information bar.... your addon is now ready to use... enable/disable addon X.) so if deploying by slipstream you need to include an ins to establish the status of Addons for IE that you are also deploying).

    Another compounding problem is that most addons do not remove the registry entries for their status and statistics when they are uninstalled....so you may have the situation where a user has one or the other of the Adobe PDF components disabled when using the version X..it may be that under vX they have configured the Adobe Reader NOT to use the browser when opening PDF... they upgrade to version XI, but the Adobe updater does not reset the Addon(s) status flags in the registry.

    I don't have vXI installed to test.... it looks like though I will keep on using X and retain my preferences to NOT use a web browser to open PDF...


    Rob^_^

    Sunday, February 10, 2013 11:29 PM

All replies

  • Hi,

    gpedit.msc (allowed controls)

    or (my recommendation)

    Start>Adobe Reader>Edit>Preferences>Internet, uncheck "Display PDF in browser"

    at the Adobe support site you will find the admx files to enable you to do this with gpo.

    or

    Tools>Manage Addons>Show all addons.... locate the Adobe addons in the list and disable them.


    Rob^_^

    Saturday, February 9, 2013 12:43 AM
  • Hi Rob, thanks for answering ... "Display PDF in browser" had a revamp as of Adobe's version 11/XI products (at least Reader and/or Standard). It really doesn't exist anymore within Adobe's apps, as it did in v10 and previous releases (see http://helpx.adobe.com/acrobat/using/display-pdf-browser-acrobat-xi.html). It's now moved to being an IE plug-in. I've found that its very inconsistent; the plug-in sometimes appears in IE and other times doesn't- it can appear under "Run without permission" or "Add add-ons" or neither, even on similar workstations. I've been testing this on VMs and never seem to get the same result.

    So if there was a way to manage this by user or machine, that would help. I'm wondering about where settings for disabling an IE plug-in are stored. Even outside of Adobe's apps - being able to control browser plug-ins without user interaction, would be useful to sysadmins!

    Sunday, February 10, 2013 3:52 PM
  • Hi,

    Ie maintains a list of Addons in the registry to which it assigns a status flag (enabled/disabled) and also entries for statistics (load time, no of times the control has been blocked)... this is outside of the GPO registry entries and is no-user or Administrator maintainable....

    Adobe are incorrect.... re: http://helpx.adobe.com/acrobat/using/display-pdf-browser-acrobat-xi.html

    the Adobe PDF ActiveX control uses a satellite BHO.... Adobe PDF link helper.... it and not the ActiveX component is the 'broker' process that determines how the PDF link on a page is to be processed....the Adobe PDF Link Helper BHO is a broker process for the Adobe PDF Reader ActiveX.... both the PDF Link helper and the Adobe PDF reader ActiveX control need to have the same state.....enabled/disabled

    You are seeing inconsistent results on your network because different users have different status's for the ActiveX and BHO components, one enabled, one disabled....

    IE uses a holistic method of determining the satellite BHO's that may be dependent on other ActiveX or Toolbar components.... for example If a user disables the Google toolbar they will also be prompted to disable other Google branded addons (BHOs) they have installed....a look in HKCR will show the dependencies of the google toolbar.... quite a few...

    If you want to manage your users Addons on your network.... you have a white list of allowed controls in GPO, but to stop users enabling/disabling Addons at will (and making the wrong choice as to what components of an Addon need also to be enabled/disabled) you need to block access to the IE Addons Manager using GPO... it is not my intention here to explain fully, but I expect that also you need to deploy an ins file under the users profile that will reset the status of Addons in the registry. Normally when an Addon is first installed (using a Windows installer package), IE itself will create the Addons management registry entries... (users see an information bar.... your addon is now ready to use... enable/disable addon X.) so if deploying by slipstream you need to include an ins to establish the status of Addons for IE that you are also deploying).

    Another compounding problem is that most addons do not remove the registry entries for their status and statistics when they are uninstalled....so you may have the situation where a user has one or the other of the Adobe PDF components disabled when using the version X..it may be that under vX they have configured the Adobe Reader NOT to use the browser when opening PDF... they upgrade to version XI, but the Adobe updater does not reset the Addon(s) status flags in the registry.

    I don't have vXI installed to test.... it looks like though I will keep on using X and retain my preferences to NOT use a web browser to open PDF...


    Rob^_^

    Sunday, February 10, 2013 11:29 PM