locked
Local Policy Settings and SteadyState RRS feed

  • Question

  • I'm trying to set up a high-security stand alone PC and need to configure a lot of settings in the Local Group Policy Object.  I understand how to use gpedit and administrative templates.  I have installed the SCTSettings template.  What I can't seem to get a handle on is how SteadyState interacts with the LGPO.  To use this as an example:  say I set my homepage to Yahoo.com in Local Computer Policy\User Configuration\Windows Settings\Internet Explorer Maintenance\URLs\Important URLs\.  I can also set my homepage to MSN.com in Local Computer Policy\User Configuration\Administrative Templates\All Windows SteadyState Restrictions\Set Internet Homepage\.  I'm just using the homepage as an example- there are many fields in the SCTSettings template that are duplicated in other templates and in gpedit itself.  It certainly appears possible to configure conflicting settings.  How does the system know which settings take precedence?  Also, if I use gpedit to modify security settings, then subsequently configure security settings in SteadyState, does SteadyState overwrite the appropriate fields in the LGPO or does it directly modify the registry?  If there is a document somewhere that you can refer me to, I'd really like to read it.

     

    On a more specific note, I can't figure out how to turn off the Tools menu & button in Internet Explorer for a SteadyState user.  Currently, logged in as an Admin, Local Computer Policy\User Configuration\Administrative Templates\All Windows SteadyState Restrictions\Internet Explorer Restrictions\Prevent Access to some Internet Explorer menu choices ... and the corresponding ...\Prevent Access to some Internet Explorer toolbar buttons... options are both Enabled, and all the individual buttons and menu choices are checked.  Yet when I log in as a SteadyState user, these settings have no effect.  Perhaps there are other settings elsewhere in the LGPO that are taking precendence over the SteadyState settings.

     

    I would appreciate any advice and assistance.

     

    SHull, MCSE

    Friday, February 15, 2008 7:57 PM

Answers

  • Hi SHull,

     

    I understand that you have installed SCTsettings template and want to know which policy has high  priority comparing with local group policy. Meanwhile, tools menu and button in Internet Explorer cannot be turned off though SteadyState settings.

     

    Based on my test, the priority of Local Computer Policy is higher than the setting in SCTsettings template. Take IE as example, after setting the home page under Local Computer Policy\User Configuration\Windows Settings\Internet Explorer Maintenance\URLs\Important URLs\ and Windows SteadyState SCTSettings.adm, the home page is set based on the local computer policy setting.

     

    Regarding the second issue with IE and tool menu, unfortunately, Windows SteadyState currently doesn’t have the feature to disable/hide the IE Tools menu as a whole. In addition, there is no such a group policy to disable/hide the Tools menu of IE. The following link describes a way to hide IE menus; however, please understand that it is not supported and not recommended as it involves editing source file directly. Thank you for your understanding.

     

    http://wint.virtualplastic.net/showtweak.php?tweak_id=124

     

    Please Note: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

    As this forum focuses on SteadyState specific issues, I suggest that you post this inquiry to IE’s public newsgroup if you need any further assistance:

     

    http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.internetexplorer.general&cat=en_US_9b42b613-dfee-4b99-9378-839a15bef262&lang=en&cr=US

     

    The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other customers who read the newsgroups regularly can either share their knowledge or learn from your interaction with us. Thank you for your understanding.

    Monday, February 18, 2008 7:49 AM
  • Hi SHull,

     

    Thank you for your update. I completely understand your concerns. It seems that there are some misunderstandings here.

     

    1. The “Remove the tools button” group policy is defined in SteadyState administrative template to remove the buttons in Internet Explorer – View – Toolbars – Customize. SteadyState has set it properly. I understand that the description of the group policy is a little confusing and I will forward this feedback to our product group. Thank you for your suggestions.

     

    2. I also reviewed the KB article you mentioned, it does disable some IE options. However, when Tools menu is mentioned, it always tries to disable the options under the Tools menu, instead of hide the entire Tools menu.  Many related options have been provided with SteadyState & its SCTSettings.adm. 

     

    Based on the above explanation, we can see that SteadyState administrative template has made correct registry value changes; unfortunately, as IE does not provide a registry or group policy to hide the Tools menu as a whole, SteadyState cannot do it either as SteadyState needs IE’s support to achieve the goal. Thank you for your understanding.

     

    If you have any other question, please feel free to let me know.

     

    Best regards,

    Tuesday, February 19, 2008 9:40 AM

All replies

  • Hi SHull,

     

    I understand that you have installed SCTsettings template and want to know which policy has high  priority comparing with local group policy. Meanwhile, tools menu and button in Internet Explorer cannot be turned off though SteadyState settings.

     

    Based on my test, the priority of Local Computer Policy is higher than the setting in SCTsettings template. Take IE as example, after setting the home page under Local Computer Policy\User Configuration\Windows Settings\Internet Explorer Maintenance\URLs\Important URLs\ and Windows SteadyState SCTSettings.adm, the home page is set based on the local computer policy setting.

     

    Regarding the second issue with IE and tool menu, unfortunately, Windows SteadyState currently doesn’t have the feature to disable/hide the IE Tools menu as a whole. In addition, there is no such a group policy to disable/hide the Tools menu of IE. The following link describes a way to hide IE menus; however, please understand that it is not supported and not recommended as it involves editing source file directly. Thank you for your understanding.

     

    http://wint.virtualplastic.net/showtweak.php?tweak_id=124

     

    Please Note: Microsoft provides third-party contact information to help you find technical support. This contact information may change without notice. Microsoft does not guarantee the accuracy of this third-party contact information.

    As this forum focuses on SteadyState specific issues, I suggest that you post this inquiry to IE’s public newsgroup if you need any further assistance:

     

    http://www.microsoft.com/communities/newsgroups/en-us/default.aspx?dg=microsoft.public.internetexplorer.general&cat=en_US_9b42b613-dfee-4b99-9378-839a15bef262&lang=en&cr=US

     

    The reason why we recommend posting appropriately is you will get the most qualified pool of respondents, and other customers who read the newsgroups regularly can either share their knowledge or learn from your interaction with us. Thank you for your understanding.

    Monday, February 18, 2008 7:49 AM
  • Thank you for your reply.  I appreciate you taking the time to test and verify that LGPO setting take priority over Steady State configuration options.  I also appreciate the fact that you verified that the feature to disable/hide the IE Tools menu is not working.

     

    With respect to your comment that SteadyState doesn't have the feature to disable/hide the IE Tools menu as a whole, I call your attention to the following option in the SCTSettings template:

    [\Local Computer Policy\User Configuration\Administrative Templates\All Windows SteadyState Restrictions\Internet Explorer Restrictions\Prevent Access to some Internet Explorer toolbar buttons (such as Search)\Remove the tools button].  Clearly, the option is defined in the template.  It seems reasonable to conclude that the intention was there to provide control over this option from within SteadyState.

     

    I found the following article, which describes setting Internet Explorer Restrictions in the registry to prevent IE toolbars and menus from being displayed:  http://support.microsoft.com/kb/823057/en-us.  The article specifically mentions the Tools menu and toolbar.  The article also says the registry settings can be applied via group policy.

     

    So, it appears that there is an issue: settings in the SCTSettings template are not making their way to the registry.

     

    I'm not sure I agree with your suggestion that it would be more appropriate for me to repost my questions in the IE newsgroup.  The SCTSettings template is specific to SteadyState. It is installed with the default installation of SteadyState and is only available with this product.  If SteadyState fails to apply its configuration to the registry properly, it seems to me that this is the right place to be discussing those issues.

     

    Regards,

     

    SHull

     

     

    Monday, February 18, 2008 10:04 PM
  • Hi SHull,

     

    Thank you for your update. I completely understand your concerns. It seems that there are some misunderstandings here.

     

    1. The “Remove the tools button” group policy is defined in SteadyState administrative template to remove the buttons in Internet Explorer – View – Toolbars – Customize. SteadyState has set it properly. I understand that the description of the group policy is a little confusing and I will forward this feedback to our product group. Thank you for your suggestions.

     

    2. I also reviewed the KB article you mentioned, it does disable some IE options. However, when Tools menu is mentioned, it always tries to disable the options under the Tools menu, instead of hide the entire Tools menu.  Many related options have been provided with SteadyState & its SCTSettings.adm. 

     

    Based on the above explanation, we can see that SteadyState administrative template has made correct registry value changes; unfortunately, as IE does not provide a registry or group policy to hide the Tools menu as a whole, SteadyState cannot do it either as SteadyState needs IE’s support to achieve the goal. Thank you for your understanding.

     

    If you have any other question, please feel free to let me know.

     

    Best regards,

    Tuesday, February 19, 2008 9:40 AM