none
Setting Up Personalized settings command line RRS feed

  • Question

  • I have created a package to deploy IE 10 in our environment. All works well as far as deployment goes. That is until a user with the command line restricted.

    After IE10 is installed, a locked down user logs in and a window shows up titled "Personalized Settings": Setting up personalized settings for: Internet Explorer  A command line opens saying: The command prompt has been disabled by your administrator. Press any key to continue...

    I would love to know what IE is doing and how to stop this message from happening for each locked down user. Thanks!

    Tuesday, September 24, 2013 6:00 PM

Answers

  • We have found that those registry keys in question did not resolve our problem. Our problem was still in ActiveSetup but the StubPath value in

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2D46B6DC-2207-486B-B523-A557E6D54B47}

    AND

    SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D46B6DC-2207-486B-B523-A557E6D54B47}

    Where the executed command was:

    C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe –ClearIconCache

    We found by deleting both of these keys IE works and the issue was resolved.


    • Edited by Nutshell30 Tuesday, October 15, 2013 5:10 AM
    • Proposed as answer by Nutshell30 Tuesday, October 15, 2013 5:11 AM
    • Marked as answer by spidey24 Tuesday, November 5, 2013 4:37 PM
    Tuesday, October 15, 2013 5:10 AM
  • I believe I have fixed my issue...

    There are 2 registry keys that are created by this command line.

    HKCU\Software\Microsoft\Active Setup\Installed Components\

    2D46B6DC-2207-486B-B523-A557E6D54B47
    89820200-EcBD-11cf-8B85-00AA005B4383

    By deploying these keys via Group policy, the command line doesn't run for the locked down users, and ie 10 works just fine. Frustrating, but it works. 

    • Marked as answer by spidey24 Wednesday, October 2, 2013 8:20 PM
    Wednesday, October 2, 2013 8:20 PM

All replies

  • Hi,

    How did you create the ie 10 package and deploy it to your environment?

    Have you ever disabled the command prompt in Group Policy?

    This policy prevents users from running the interactive command prompt, Cmd.exe. It also determines whether batch files (.cmd and .bat) can run on the computer.

    (Note: Do not prevent the computer from running batch files if the computer uses logon, logoff, startup, or shutdown batch file scripts, or for users that use Terminal Services.)

    Please go to Run ->  type "gpedit.msc” -> User Configuration\Administrative Templates\System-> open "prevent access to the command prompt" -> select Disable or Not Configured.

    Regards,

    Yolanda

    Wednesday, September 25, 2013 9:23 AM
    Moderator
  • We deployed the package via Configuration Manager 2012 as shown here:

    http://technet.microsoft.com/en-us/library/jj822329.aspx

    using the command: ie10_package.exe /quiet /norestart /update-no

    We have intentionally disabled the command line in our environment as we are a school district and don't want students to have access to the command line.

    We have previously updated from ie7 to ie8, and ie8 to ie9 without any issues or need for students to have access to the command line.

    Wednesday, September 25, 2013 1:41 PM
  • HI,

    Since this issue only occurred in IE10, I’d like to know how did you deploy ie7, ie8 and ie9? Maybe something is different this time, as you described, the policy of “prevent access to the command prompt” is not the culprit, perhaps you can just disable it for a test.

    Regards,

    Yolanda

    Friday, September 27, 2013 2:23 AM
    Moderator
  • Disabling the "Prevent access to the command prompt" does eliminate the cmd line opening with the message that "The command prompt has been disabled by your administrator." 

    But then the user has access to the command prompt obviously. Not a viable option for us.

    Previous deployments of IE7-9 were deployed as a software update using SCCM 2007. IE10 isn't available in the same manner, so we used the recommended deployment method as stated, (http://technet.microsoft.com/en-us/library/jj822329.aspx)

    Just to clarify. IE10 does deploy as it should. This message happens 1x on the machine for a locked down user. It has to do with updating their profile. After the locked down user logs in, closes out the failed command line window, they can then log out and back in that same machine without any message... The problem is that these locked down users use different computers every day. So unless they are logging into the same machine as they have after ie10 was deployed, they will get this command line window again. It's an annoyance issue more than a functionality issue.

    In testing, I have deleted files from the users profile, logged out and back in to see what part of the profile modification process may be causing the cmd line to open. I have found that the ntuser.dat is the culprit. I'm going to try and update the default domain profile to a default profile that is created with ie10 to see if that makes any difference.

    Friday, September 27, 2013 1:11 PM
  • I believe I have fixed my issue...

    There are 2 registry keys that are created by this command line.

    HKCU\Software\Microsoft\Active Setup\Installed Components\

    2D46B6DC-2207-486B-B523-A557E6D54B47
    89820200-EcBD-11cf-8B85-00AA005B4383

    By deploying these keys via Group policy, the command line doesn't run for the locked down users, and ie 10 works just fine. Frustrating, but it works. 

    • Marked as answer by spidey24 Wednesday, October 2, 2013 8:20 PM
    Wednesday, October 2, 2013 8:20 PM
  • We have just had this error appear today. I have tried adding these keys via gpo, however it still fails. How did you implement it? I can verify that the keys get created in the registry however the restriction still appears.

    Tuesday, October 15, 2013 1:32 AM
  • We have found that those registry keys in question did not resolve our problem. Our problem was still in ActiveSetup but the StubPath value in

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{2D46B6DC-2207-486B-B523-A557E6D54B47}

    AND

    SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{2D46B6DC-2207-486B-B523-A557E6D54B47}

    Where the executed command was:

    C:\Windows\system32\cmd.exe /D /C start C:\Windows\system32\ie4uinit.exe –ClearIconCache

    We found by deleting both of these keys IE works and the issue was resolved.


    • Edited by Nutshell30 Tuesday, October 15, 2013 5:10 AM
    • Proposed as answer by Nutshell30 Tuesday, October 15, 2013 5:11 AM
    • Marked as answer by spidey24 Tuesday, November 5, 2013 4:37 PM
    Tuesday, October 15, 2013 5:10 AM
  • Thanks Nutshell,

    I found that my fix also didn't work when running on a Windows 7 x64 OS. Make sense since I didn't include the Wow6432Node key in my original solution. I decided to try your solution of just removing the key altogether, and it works here too. Thanks! 

    Tuesday, November 5, 2013 4:38 PM