none
IE7 in a SteadyState World RRS feed

  • Question

  •  

    I’m trying out SS on a test PC and overall it works great. I have a problem though with IE7 and that is, some of the options to the public are wide open.  Below is a list of features that I'd like to lock down:

     

    • The "Favorites Center" Icon (gold star) and "Add to Favorites" Icon (Green plus sign with gold star).
      Why?  If public profile session has not been logged off for a while, a patron can easily go to the Favorites Center, click on history and have it list all the sites within that session.
    • Home Icon Drop menu.
      Once the drop down menu is pressed, the patron has the option to add or remove a website. Yes, I know these changes will reset once logged off. Still I so no reason why this open for public users to use.
    • Hide the Menu Bar.
      I configured my public profile this way in unlocked mode. Why does it default to "show menu bar" while in locked mode?
    • Several options available using the Menu Bar such as:
      • Work Offline in File menu - the obvious
      • Send Page by email in File Menu - don’t want patron playing around with outlook or OE.
      • Import Export Wizard in File Menu - nice to have it locked down
      • Explorer Bar in View Menu - nice to have it locked down
      • Encoding in View Menu - nice to have it locked down
      • Pop-up Blocker, Phishing Filter, Manage Add-Ons in Tools Menu - these features can be enabled or disabled except for Manage Add-Ons.
      • Disabling these above options would prevent someone from just press the ALT button to show the menu bar and then having access to enable or disable these features.

    I know this is quite a bit and some of this may not be covered by SS. Can someone point out which options can be restricted by SteadyState? I was also thinking of using IEAK for IE7 and perhaps search for more GP's that may apply to these settings.  Does anyone else have this same experience? I would like to hear from those folks who are using IE7 in public library/kiosk environment. Thanks

     

    Kenji-D
    Brevard County Library Systems
    Cocoa, FL

    Tuesday, October 16, 2007 5:08 PM

Answers

  • Hi Kenji-D,

     

    Please understand that SteadyState IE restrictions are based on group policy: [User Configuration\Administrative Templates\Windows Components\Internet Explorer]. Thus, if some options cannot be configure through group policies, SteadyState will not have related options either. I think you have tested that the above options cannot be configured through SteadyState. As this forum focuses on SteadyState specific issues, you may post to Windows XP General newsgroup to see whether they have any suggestions:

     

    http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.windowsxp.general

     

    The reason why we recommend posting appropriately is that you will get the most qualified pool of respondents, and other customers who read the newsgroups regularly can either share their knowledge or learn from your interaction with us.  Thank you for your understanding.

     

    As to IE7's Menu Bar, based on my test, if you have configured the following restriction, the tab feature of IE7 will be disabled and IE will be restored to classic(IE6) mode. Under this mode, IE's menu bar cannot be hid.

     

    [Windows Restrictions\General Restrictions\Prevent access to Windows Explorer features: Folder Options, Customize Toolbar, and the My Documents folder]

     

    You can also refer to the following thread for more information about this issue:

     

    Disable access to additional items in IE

    http://forums.microsoft.com/WindowsToolsandUtilities/ShowPost.aspx?PostID=2126232&SiteID=69

     

     

    For your information, you can start IE in Kiosk Mode to disable all of the above options. Please refer to the following article.

     

    How to use Kiosk Mode in Microsoft Internet Explorer

    http://support.microsoft.com/kb/154780

     

    Best Regards,

    Wednesday, October 17, 2007 8:06 AM

All replies

  • Hi Kenji-D,

     

    Please understand that SteadyState IE restrictions are based on group policy: [User Configuration\Administrative Templates\Windows Components\Internet Explorer]. Thus, if some options cannot be configure through group policies, SteadyState will not have related options either. I think you have tested that the above options cannot be configured through SteadyState. As this forum focuses on SteadyState specific issues, you may post to Windows XP General newsgroup to see whether they have any suggestions:

     

    http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.windowsxp.general

     

    The reason why we recommend posting appropriately is that you will get the most qualified pool of respondents, and other customers who read the newsgroups regularly can either share their knowledge or learn from your interaction with us.  Thank you for your understanding.

     

    As to IE7's Menu Bar, based on my test, if you have configured the following restriction, the tab feature of IE7 will be disabled and IE will be restored to classic(IE6) mode. Under this mode, IE's menu bar cannot be hid.

     

    [Windows Restrictions\General Restrictions\Prevent access to Windows Explorer features: Folder Options, Customize Toolbar, and the My Documents folder]

     

    You can also refer to the following thread for more information about this issue:

     

    Disable access to additional items in IE

    http://forums.microsoft.com/WindowsToolsandUtilities/ShowPost.aspx?PostID=2126232&SiteID=69

     

     

    For your information, you can start IE in Kiosk Mode to disable all of the above options. Please refer to the following article.

     

    How to use Kiosk Mode in Microsoft Internet Explorer

    http://support.microsoft.com/kb/154780

     

    Best Regards,

    Wednesday, October 17, 2007 8:06 AM
  • Hi,

    I work for a library system and we are looking into upgrading to steady state from the SCT.  I have made it a point to stay away from IE7.  SS along with other lock down programs are not designed for use with IE7 becasue there isn't much in the way of Group Policy to limit how IE7 works.  Was there a compelling reason for you to go to IE7?  We have decided to stay with IE6 for now and when IE7 can be fully tested for patron use well will move to it.  As you know the interface is much different but the one thing that REALLY prevented me from going to IE7 is that there is no print preview button avaliable for the toolbar...it's just gone.  We have problems with patrons printing a ton of pages and the print preview button saves us alot of time and paper.

    Thursday, October 18, 2007 3:18 PM
  • Hi,

     

    There is no compelling reason to install IE7 now. However, IE7 is more secure than IE6. As you know IE7 also provide more useful features. Based on my test, if you would like to allow the print preview button in IE7, you may need to uncheck the following restrictions:

     

    Feature Restrictions\Internet Explorer Restrictions\Prevent Printing

    Feature Restrictions\Internet Explorer Restrictions\Toolbar Options\Print

     

    Regards,

    Friday, October 19, 2007 6:08 AM
  •  

    Thanks for your input Shawn.  I managed to get some works around with the IE7 issues I posted earlier. As Shawn stated earlier, most of these configurations are found in group policy and not in SS. This is what I got so far and hopefully this will help some admins out there experiencing the same issue.

     

    ·  Home Icon Drop menu.

    • Local Computer Policy>User Configuration>Administrative Templates>Windows Components>Internet Explorer. Set "DISABLE CHANGING HOME PAGE SETTINGS" to enabled.

    ·  Hide the Menu Bar.

    • Local Computer Policy>User Configuration>Administrative Templates>Windows Components>Internet Explorer. Set "TURN ON MENU BAR BY DEFAULT" to disabled.

    ·  Several options available using the Menu Bar such as:

    • Work Offline in File menu

    ·         Send Page by email in File Menu

    ·         Import Export Wizard in File Menu

    ·         Explorer Bar in View Menu

    ·         Encoding in View Menu

    ·         Pop-up Blocker, Phishing Filter, Manage Add-Ons in Tools Menu

    ·         Disabling these above options would prevent someone from just press the ALT button to show the menu bar and then having access to enable or disable these features.

      • All of these options become unavailable once the Menu bar is hidden.

     

    The one feature I was unable to control is the Favorites Center & Add to Favorites Icons. I googled just about everywhere including the MSDN IE7 site and was unable to find a workaround that would disable this two features. My concern here is not so much as being able to view favorites ( that can be disabled using the Hide Favorites Menu in the local group policy settings: Local Computer Policy>User Configuration>Administrative Templates>Windows Components>Internet Explorer>Browser Menu.) but it’s the History tab within the favorites center that has no restrictions whatsoever.  This is the only feature here that is preventing us from deploying this image to the public.

     

    Other options that may be helpful to restrict are:

    • Restrict changing the default search providers (enabled)
    • Disable importing & exporting of favorites and feeds. (enabled)
    • Search: Disable find files via F3 (enabled)
    • Search: Disable search customization (enabled)
    • Turn off help menu. (enabled)

    To answer SCA Admin's question on why we are deploying IE7, I'd say it's because the Security has improved over IE6, built in Search Bar (no need to deal with Google Bar's nagging update features), clean and simple GUI, and well it's almost a year and half old. I do admit though that I was under the impression that SS had built in features to lock down IE7. BTW in IE7's command bar, there is a print button that has an option for Print preview. I did read somewhere that you can add a customized print preview button to your command bar, but that would involve some programming on your part. Thanks again Shawn for your help.

     

    Kenji-D
    Brevard County Library Systems
    Cocoa, FL

    Monday, October 22, 2007 4:28 PM
  • Hi Kenji-D,

     

    I have a thought, although we cannot remove the Favorites Center icon, we can configure permissions to the Favorites folder.

     

    You can locate the Favorites folder under C:\Documents and Settings\<username>. Open the properties of the folder and then remove all the permission from the Security tab.

     

    Note: If the Security tab is not available, you may need to disable simple file sharing from Control Panel\Folder Options\View tab.

     

    After that, users can only view the items we added. Adding new websites to the Favorites folder will be disallowed.

     

    Regards,

    Tuesday, October 23, 2007 3:22 AM
  • Shawn, thats a great idea. I completely forgot about the security permissions issue. However, I do not have a problem with the favorites folder per say. I have that locked down. The problem Im having is with the History folder inside the Favorites Center explorer bar. I'll try removing the security permissions from the history folder instead of the favorites folder. I'll let y'all know who it goes. Thanks again.

     

    Kenji-D
    Brevard County Library Systems
    Cocoa, FL

    Tuesday, October 23, 2007 12:33 PM
  •  Kenji-D wrote:

     

    Thanks for your input Shawn.  I managed to get some works around with the IE7 issues I posted earlier. As Shawn stated earlier, most of these configurations are found in group policy and not in SS. This is what I got so far and hopefully this will help some admins out there experiencing the same issue.

     

    ·  Home Icon Drop menu.

    • Local Computer Policy>User Configuration>Administrative Templates>Windows Components>Internet Explorer. Set "DISABLE CHANGING HOME PAGE SETTINGS" to enabled.

    ·  Hide the Menu Bar.

    • Local Computer Policy>User Configuration>Administrative Templates>Windows Components>Internet Explorer. Set "TURN ON MENU BAR BY DEFAULT" to disabled.

     

    Kenji-D
    Brevard County Library Systems
    Cocoa, FL



    Kenji, Do I have to run GP within the user account for IE7 that i'm trying to lock down, or can it be done from another admin account? Will it affect IE in all accounts or just the one I want to lock down? 

    Thanks,

    Phil
    Saturday, October 27, 2007 3:10 PM
  • Hello Phil,  you would have to run GP from the account that you'd want to restrict. I'd suggest that from your admin account you unlock the public profile in question and then give that user account admin rights. Log off and log into your public profile. Once you finish editing the GPs, log off and log back in to your admin account. Remember now to remove admin rights from that user account and then lock down the account with SS.

     

    Hope this helps...

     

    Saturday, October 27, 2007 4:04 PM