locked
IE11 install breaking local group policies RRS feed

  • Question

  • Running into an odd issue.  I have a Windows 7 x64 box running IE9.  When IE9 is install I can do Start > Run > gpedit.msc and get into local group policy.  I can then navigate to User Config > Admin Temp > Windows Components >  Internet Explorer.

    The issue happens once I install IE11 on that machine.  Once I install IE11 on that machine I wanted to go into group policy and enable enterprise mode for some testing purposes.  Once IE11 is installed if I do Start > Run > gpedit.msc I get:

    Encountered an error while parsing:

    Resource '$(string.BlockImmersiveBrowser)' reference in attribute displayName could not be found

    File C:\Windows\PolicyDefinitions\inetres.admx, line 34666, column 250

    Eventually the local GP will display after I click OK on the error above.  However, when I navigate to User Config > Admin Temp > Windows Components the Internet Explorer section is now gone.  I've done this on 3 separate boxes, all Windows 7 x64 going from IE9 to IE11 and they all exhibit this exact same issue.  Anyone have any ideas?

    Tuesday, December 29, 2015 6:39 PM

Answers

  • Hi DollaBillz217,

    Are all the machines up to date before we installed Internet Explorer 11? Is there anything unusual recorded in the C:\Windows\IE11_main.log?

    Since the issue would occur with all the machines, we could try to download the Administrative Templates (ADMX) for Windows Server 2008 R2 and Windows 7 .msi file then deploy it.
     Administrative Templates (ADMX) for Windows Server 2008 R2 and Windows 7
    https://www.microsoft.com/en-us/download/confirmation.aspx?id=6243

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Monday, January 4, 2016 7:38 AM

All replies

  • Hi DollaBillz217,

    Usually the IE template will be updated automatically when we installed Internet Explorer 11. It seems that there is something wrong during the install process.
    We could try to download the IE Administrative Templates manually here.
    Administrative Templates for Internet Explorer
    https://www.microsoft.com/en-us/download/confirmation.aspx?id=40905

    Unzip the downloaded file, then copy and paste the inetres.admx to that folder.

    If the issue persists, we could try the following command line to uninstall Internet Explorer 11 completely, restart and reinstall it.
    "FORFILES /P %WINDIR%\servicing\Packages /M Microsoft-Windows-InternetExplorer-*11.*.mum /c "cmd /c echo Uninstalling package @fname && start /w pkgmgr /up:@fname /quiet /norestart"

    We could get Internet Explorer 11 here.
    Internet Explorer 11 windows 7
    https://catalog.update.microsoft.com/v7/site/Search.aspx?q=internet%20explorer%2011%20windows%207

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.



    Wednesday, December 30, 2015 6:11 AM
  • I'm sure that could/would fix the problem, but the issue is that I have to upgrade over 100 computers and so far this issue has occurred on all three of my test PC's that I've tried.  So if this happens on every single PC I do not want to have to go to every single computer and replace these files.  I'm just afraid its going to break group policy inheritance for any admin template GPs coming from my domain controller.  But I have to go to IE11 because Microsoft is stopping support for everything except IE11 on Windows 7 SP1 machines.
    Wednesday, December 30, 2015 3:38 PM
  • Hi DollaBillz217,

    Where did you get the Internet Explorer 11 installation package and how did you do the upgrade? Are all the machines up to date before we deployed Internet Explorer 11?

    Since the issue would occur with all the machines, we could try to download the Administrative Templates (ADMX) for Windows Server 2008 R2 and Windows 7 .msi file then deploy it.
    Administrative Templates (ADMX) for Windows Server 2008 R2 and Windows 7
    https://www.microsoft.com/en-us/download/confirmation.aspx?id=6243

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Thursday, December 31, 2015 2:15 AM
  • Could it be, that the existing inetres.admx (and possible also .\en-us\inetres.adml) have been updated in some other prior method, and the security on those files is incorrect? If so, when the IE11 package attempts to replace the existin gfiles with new/updated files, this file-replace operation is failing, leading to this outcome you have?

    Is there any related errors recorded in the IE11_main.log file (this is the logfile created by IEsetup.exe during an IE upgrade)?

    Further, if you do have an incorrect inetrex.admx/adml, this will *not* affect any GP processing in any way at all - the Admin Templates are only used for reading/displaying policy via gpedit / gpresult (to visually categorise the many settings, and to control the authoring/changing of settings) - a computer can successfully process/apply a Group Policy without the Admin Templates at all.
    So, there is not need for concern about Domain GP inheritance at all.

    I found one other identical case, in the German-language forums. The solution was to replace the ADMX file.

    Is this affecting en-US computers? Are the computers multi-language? What IE11 package are you deploying, and via which method?
    (did you use WSUS to acquire and deploy? Did you use IEAK to build the IE11 package?)

    I suspect, either;

    a) your affected computers, were already affected by some earlier/previous action, and it has only now become apparent,or,
    b) your IE11 package is defective in some way and is not replacing the files.

    Depending upon your deployment method, you could consider deploying a second package/script which would correctly replace these files.

    Another consideration, might be if you are using a GP Central Store? If so, has the CS been updated yet?
    If you are not using CS, then there is no need to implement CS as a solution to this problem.


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Thursday, December 31, 2015 4:04 AM
  • Thanks for the replies.  I am NOT using GP central store.  I have tried just about every way possible to upgrade and the issue happens every single time.  I've downloaded the IE11 install directly from microsofts website and have had the issue.  I tried installing the IE11 update directly from Windows update and have had the issue and I've also the Internet Explorer 11 Customization Wizard to create my own package and have tried to push it out via SCCM and install it standalone and the issue happens with all of them.  I've even gone as far as removing all previous versions of IE all together and installing and it still continues to do it.  All of our machines on our domain were brand new fresh Windows 7 installations with IE9 being installed during Windows Updates.  This is the first time IE has been upgraded since then.  I've seen many posts online with people having this issue, some getting it after a brand new fresh install even, but the only solutions are to replace the admx/ml packages.  All of these are US language PC's and have not been modified previously. 
    Thursday, December 31, 2015 2:19 PM
  • Hi DollaBillz217,

    Are all the machines up to date before we installed Internet Explorer 11? Is there anything unusual recorded in the C:\Windows\IE11_main.log?

    Since the issue would occur with all the machines, we could try to download the Administrative Templates (ADMX) for Windows Server 2008 R2 and Windows 7 .msi file then deploy it.
     Administrative Templates (ADMX) for Windows Server 2008 R2 and Windows 7
    https://www.microsoft.com/en-us/download/confirmation.aspx?id=6243

    Best regards


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Monday, January 4, 2016 7:38 AM
  • *****SOLUTION*****

    Well after days of trial and error I finally found the resolution to this issue.  Once I installed KB3104002 (Cumulative Security update for internet explorer 11 for Windows 7 x64 based systems) the problem has gone away.  I've tested it on 5 of my machines and after installing that update I'm able to go into my local group policies and not get the error message and I now also see the Windows components > Internet Explorer, which I did not see before.  Thanks everyone for your help.

    Thursday, January 7, 2016 7:25 PM