none
Set homepage and default search scope in an environment with dynamic local user profiles RRS feed

  • Question

  • Hi guys

    I already posted my question on Microsoft answers (http://answers.microsoft.com/en-us/ie/forum/ie11-windows_7/choose-your-homepage-and-search-settings/2966bcb3-3ddb-4a26-8c51-07b5aa40e4ef), it was suggested there that I post it here as well:

    Since the latest update to Microsoft Internet Explorer 11 (KB3148198), my users experience the following message (on Win7, Win 8.1 and Win 10):

    http://www.sevenforums.com/browsers-mail/394764-anybody-else-get-notification-ie.html

    Of course, this is disturbing for many of my users, and, what's worse, since we use dynamic local profiles in our company (i.e. the user profile is created from the DEFAULT profile on each and every login), this message shows up after each and every login which normally happens once a day.

    My colleagues (and my boss!) have asked me to get rid of this message.

    I have monitored what happens in the registry when you choose "Your current settings", it writes quite some strange registry entries (HEX-values) which all have something to do with "SyncHomePage Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy". Windows insiders will know which registry settings I mean.

    Specifically, I'm talking about what's written in

    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\EUPP Protected - It is a violation of Windows Policy to modify. See aka.ms/browserpolicy

    and the respective subkeys. Those contain binary values, and I suppose those are user specific, and that's the problem - if they are user-specific, I cannot deploy them to all network computers for all users.

    If I export those regkeys and deploy them to users, there will be an error message on the first start of IE, stating that settings had to be reset as they were corrupt.

    The default homepage and search providers at our company are set via regkeys (or have been, until now).

    Is there any way to still set default search provider and start page in IE 11 WITHOUT users seeing ANY popups? Even for dynamic local users?

    I'm not sure if uninstalling KB3148198 is an option, it looks like this update does more than just add this "feature" I don't want, and maybe it's even required in order to get further updates.

    So what can I do? Any help would be greatly appreciated.

    Kind regards,

    Peter

    Tuesday, April 19, 2016 8:38 AM

All replies

  • Add another vote to the chorus of users who need to get rid of this prompt.
    Tuesday, April 19, 2016 4:20 PM
  • Hi Peter,

     

    Based on your description, I want to confirm that have you made any changes before the issue occurred?

     

    You mentioned that after installing KB3148198, the problem occurred. Have you tried to uninstall the update and check the result? If not, please try it.

     

    We could also try popup blocker and see if it helps, please refer to the link:

     

    Internet Explorer Pop-up Blocker: frequently asked questions:

    http://windows.microsoft.com/en-US/windows7/Internet-Explorer-Pop-up-Blocker-frequently-asked-questions?1353591705

     

    Best Regards,

    Tao


    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Wednesday, April 20, 2016 12:01 PM
    Moderator
  • Hi Tao

    Thanks for taking the time to reply. I can confirm that uninstalling KB3148198 "solves" the problem, the message does not appear anymore. However, I don't think this is a real solution, because this update contains a lot more security updates than just the annoying message, and I would like to have IE11 as secure as possible.

    I'm looking for a way to get rid of the annoying popup, but I would like to have the rest of the security and other fixes which come with KB3148198 installed.

    Popup blocker won't help here, as the popup is not an ordinary popup triggered by a webpage, but a popup triggered by some sort of mechanism in Internet Explorer which detects that homepage is not MSN and the default search provider is not Bing. Have a look at the picture again please:

    http://www.sevenforums.com/browsers-mail/394764-anybody-else-get-notification-ie.html

    As you can see, the popup we are talking about here has nothing whatsoever to do with the popups the popup blocker of IE deals with.

    What I need is some sort of way to tell IE that it should NOT check whether the homepage and default search has been changed. While this makes sense for home users, it does not make sense in a business environment where computers are centrally managed.

    Regards, Peter



    Saturday, April 23, 2016 12:32 PM
  • Hi,<o:p></o:p>

    We haven't heard from you in a couple of days, have you solved the problem? We are looking forward to your good news.<o:p></o:p>

    Best Regards,<o:p></o:p>

    Tao<o:p></o:p>



    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Wednesday, April 27, 2016 7:49 AM
    Moderator
  • Hi,

    sorry to tell you, but I still don't have any good news.

    I tried setting the default search provider and the homepage with local group policy, but even then I get the annoying popup. Where could I ask how Internet Explorer works on this? What would be especially useful would be the algorithm used to calculate the binary regkeys, if I at least knew that, I could maybe script something....

    At the moment, I have solved the problem by making Firefox the default browser for my users, but that feels like giving up somehow...

    Kind regards,

    Peter


    Wednesday, April 27, 2016 7:12 PM
  • We don't use dynamic users but we still have the same problem in our environment. In the past we had forced the search provider to Google, which I'm assuming is why the issue is arising. I think we might also have to look at moving to Firefox. While removing KB3148198 does solve the issue, it isn't a "fix". 
    Thursday, April 28, 2016 2:24 PM
  • Still no luck on my side either, nor in the Microsoft community:

    http://answers.microsoft.com/en-us/ie/forum/ie11-windows_7/choose-your-homepage-and-search-settings/2966bcb3-3ddb-4a26-8c51-07b5aa40e4ef

    I guess unless one of the guys who programmed this into IE tells us how it works and how to turn it off, going with Firefox (or Chrome for that matter, Chrome is really admin-friendly, they even provide a very good .admx file to centrally manage Chrome, and, unlike Firefox, an .msi installer, which is way easier to deploy) is the only option left for us admins.

    On the downside, depending on what your boss is like, having to say "Sorry, I can't fix this, we have to switch browsers." might not sched a good light on us admins, even though it's absolutely not our fault. Please, Microsoft, whenever you make changes in the future, think of all the admins out there who have to live with them!


    Sunday, May 1, 2016 3:32 PM
  • OK, I will help you feedback this issue.

    Please remember to mark the replies as answers if they help, and unmark the answers if they provide no help. If you have feedback for TechNet Support, contact tnmff@microsoft.com.

    Tuesday, May 3, 2016 1:23 AM
    Moderator
  • Thanks Tao, I appreciate that!
    Tuesday, May 3, 2016 4:21 AM
  • After uninstalling KB3148198 last month to resolve the issue, now this month we get KB3154070 which reintroduces the issue.

    Note that we are receiving the prompts with Windows 7 Professional, though the PCs are not domain-joined.

    Unfortunately, because we can't be making it a matter of practice to not install major security patches, we will likely have to move to Chrome or Firefox as our primary browser until Microsoft fixes this for enterprise users running Windows 7 Pro in non-domain-joined environments. Microsoft, if you are listening, please help us. 


    • Edited by WallScratch Wednesday, May 11, 2016 3:59 PM
    Wednesday, May 11, 2016 3:58 PM
  • Is there any way to still set default search provider and start page in IE 11 WITHOUT users seeing ANY popups? Even for dynamic local users?

    I think that is the sort of thing that IEAK is made for.  E.g. perhaps this feature would satisfy your requirement

    https://technet.microsoft.com/en-us/itpro/internet-explorer/ie11-ieak/user-experience-ieak11-wizard

    <quote>
    Completely silent installation. Lets you make all of the decisions for your employees
    </quote>



    Robert Aldwinckle
    ---

    Thursday, May 12, 2016 11:01 PM
    Answerer
  • I've been following this post closely on this forum & your other post on Windows Community for any sign of an answer.  I'm in the exact same boat as far as trying to get rid of this new IE11 pop-up.  A quick update.  

    There was another IE patch KB3154070 that came out a few days ago, but this update still contains the pop-up.  As a quick test I did the following:

    I built 2 identical machines (make, model, OS (Win7 6xbit)) got all Windows Updates up to date, changed each machine's Home Page to an alternate from the default MSN site. & then installed IE11.
    Both machine now got offered the update KB3154070 instead of KB3148198.
    I joined 1 device to our domain & left one in a Workgroup, Rebooted each, installed the KB3154070, Rebooted.

    Upon launching IE, the non-domain machine was prompted with the pop-up.  The domain joined machine did not receive the pop-up.
    I'm trying to compare registry hives between the 2 devices to see if I can find anything that may point to some other location other then those mentioned in previous posts (Since modifying, deleting etc. of the EUPP entries in HKCU and/or HKLM doesn't seem to do anything other then corrupt the search provider settings causing a different message when launching IE)
    But unfortunately the current KB released around May 10 (KB3154070) still seems to display this message and not take GPO's into consideration...Does anyone know why/where the settings would differ in IE11's behavior on Domain-Joined device vs. one in a Workgroup?  Especially when we have no Domain policies being pushed to devices that should really affect IE11's behavior.?

    (we have devices on an isolated network that cannot be joined to our Domain, and have a user profile that gets recreated @ each reboot to keep the device from retaining user data.  We're using settings in the Default User Hive and local GPO's to set IE's behavior) but this pop-up does not seem to take into consideration any GPO's we've set including: "Prevent Changing the Default Search Provider" and "Disable Changing Homepage Settings" etc.)

    Anyone else had any luck removing this pop-up after the recent KB's?

    Monday, May 16, 2016 6:03 PM
  • Another quick side note.  (On the previous test profile, the Domain Joined device's profile which was NOT getting the pop-up while joined to the domain)

    As soon as I took the device off the Domain and placed it back into a Workgroup, rebooted, and launched IE that same profile began to receive the Pop-up message...So even a device previously not receiving the message, due to being part of a Domain, will begin receiving this message if the device is removed from the domain...even if it is not a "new" profile.

    Monday, May 16, 2016 7:11 PM
  • I think that is the sort of thing that IEAK is made for.  E.g. perhaps this feature would satisfy your requirement

    Robert Aldwinckle

    Unfortunately, IEAK didn't work either. Following your suggestion, I used IEAK to create an INSTALL.INS file. I set the homepage to "about:blank" and the only search provider I left was Google (removed Bing completely in IEAK). I deployed the resulting INSTALL.INS file to

    %ProgramFiles%\Internet Explorer\SIGNUP\INSTALL.INS (both x64 and x32 machines)

    and

    %ProgramFiles(x86)%\Internet Explorer\SIGNUP\INSTALL.INS (x64 machines only, of course).

    But the popup is still there. I don't even know how Internet Explorer even knows the default search engine is supposed to be Bing, I erased any reference to it from the default user profile, and now also from the INSTALL.INS, there is no more mention of Bing anywhere in the registry. Seems like this is hardcoded into the Internet Explorer binaries...


    Tuesday, May 17, 2016 1:00 PM
  • Seems like this is hardcoded into the Internet Explorer binaries...

    To find out I would run ProcMon.  Perhaps there is an undocumented RegQueryValue that you could exploit to avoid this.  Alternatively running ProcMon would help you find out what gets set when the user has gone through these hoops the way they are intended to.  Then you would be looking for a  RegSetValue  which might or might not look relevant and might or might not be documented somewhere.


    Robert Aldwinckle
    ---

    Tuesday, May 17, 2016 1:14 PM
    Answerer
  • Hi Robert, hi everybody else!

    Your suggestion with ProcMon seemed to be quite helpful. I found out that on startup, IE looks for the following registry key:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EUPP_GLOBAL_FORCE_DISABLE

    Okay, in ProcMon, I saw that it got a "not found" error. So I created that key.

    Then, I saw that it was looking for the following registry entry:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EUPP_GLOBAL_FORCE_DISABLE\iexplore.exe

    Okay, so I created that. Of course, I didn't know what value to pick, but from the name of the key I inferred that DWORD:1 would be a good choice. I tried that, and haven't seen the popup since then.

    So, basically, I deployed the following .reg file to all of my machines:

    Windows Registry Editor Version 5.00
    
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_EUPP_GLOBAL_FORCE_DISABLE]
    "iexplore.exe"=dword:00000001
    Could other users in this forum please test to confirm?

    By the way, I also found with ProcMon that if IE cannot find this entry in the HKLM hive, it then also looks for it in the same place only in the HKCU hive, so if someone (for whatever reason) wants to disable EUPP only for certain users, this should work again.

    I really hope this is it, let's see what the tests of others say...

    Anyway, Robert, thanks once more for the hint with ProcMon!



    Tuesday, May 17, 2016 3:17 PM
  • So far so good.  I've placed the registry entry mentioned by Peter on 8 devices that were having the pop-up and launched IE a few times per machine without issue.  The machines should get a decent amount of use today, so I'll get feedback from the staff to see if this key has indeed suppressed the Pop-up...but So Far So Good.  

    (FYI These devices are running w/ the current IE11 KB installed; KB3154070 as well)

    Thanks in advance Peter.

    Tuesday, May 17, 2016 7:05 PM
  • I've only tested the above registry fix on (2) of (3000) PCs, but so far I have a 100% success rate.  Thanks for the suggestion Robert and thank you Peter for finding the actual fix. I'll do some more widespread testing tomorrow but I feel pretty good about this. 
    Wednesday, May 18, 2016 3:40 AM
  • Thanks Peter,

    I just got around to looking at addressing this on a Win 7 home PC and the creation of this registry key appears to have done the trick.  Previously, I had simply made Chrome the default browser to enable web browsing on the system, but it's nice to have the IE capability back.  Thanks for your help.


    Monday, September 26, 2016 1:11 AM
  • That didn´t work for me, but I deleted [HKCU\SOFTWARE\Microsoft\Internet Explorer] and that worked.

    Thanks


    Wednesday, March 29, 2017 10:15 PM
  • DLU, makes think about the days when we used NetWare. (Which I have mixed emotions about ;)

    Found this: https://www.novell.com/support/kb/doc.php?id=7017835

    Which led me to this: https://support.microsoft.com/en-us/help/10605/internet-explorer-11-settings-protection

    Which kind of ties back to the "new" Microsoft way of things, i.e., if you're not AD-Domain-joined, and/or not using Enterprise Edition of Windows client OS, the rules of the game have changed...

    [I guess it's *maybe* a good thing that MSFT implemented some "protection" for user home-pages and search-providers getting hijacked, but the method, is a bit severe?]


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Thursday, March 30, 2017 2:35 AM
  • I think that is the sort of thing that IEAK is made for.  E.g. perhaps this feature would satisfy your requirement

    Robert Aldwinckle

    Unfortunately, IEAK didn't work either. Following your suggestion, I used IEAK to create an INSTALL.INS file. I set the homepage to "about:blank" and the only search provider I left was Google (removed Bing completely in IEAK). I deployed the resulting INSTALL.INS file to

    %ProgramFiles%\Internet Explorer\SIGNUP\INSTALL.INS (both x64 and x32 machines)

    With Windows 10 x64:

    INSTALL.INS works with the Active Setup Command ie4uinit.exe -UserConfig. ({89820200-ECBD-11cf-8B85-00AA005B4383})

    If i either disable the Active Setup Command or use the GPO "Disable external branding of Internet Explorer" the new Profile will inherit the Start Page from the Default ntuser.dat.      Using the ie4uinit.exe with INSTALL.INS to set the HomePage works as well.

    Friday, September 15, 2017 11:07 AM
  • I know this is an older thread, but going through it all I did not see a solution for getting rid of the popup warning caused by changing the default search provider.

    The FEATURE_EUPP_GLOBAL_FORCE_DISABLE key does work to hide the home page warning (and it seems the home page warning only happens on machines that are not domain-joined, as somebody mentioned above).

    But for the search provider, if this is changed via the registry by importing a SearchScopes key, the popup warning will occur whether the machine is domain-joined or not. We can get rid of this by removing the following registry key:

    HKCU\SOFTWARE\Microsoft\Internet Explorer\User Preferences

    Credit for this fix goes to:

    https://blogs.msdn.microsoft.com/askie/2016/12/30/how-to-set-my-default-search-provider-via-gpo/

    This key contains two binary values in it, and the entire key (and its values) will be re-created the next time IE is launched. From what I can tell so far, deleting this key does not cause the loss of any configured settings, etc., but it does prevent the search provider change warning popup mentioned by the OP. Combining this with the EUPP_GLOBAL_FORCE_DISABLE method mentioned above should fix both issues to allow changing both the homepage and search provider via the registry with no popups for the user.

    Friday, July 20, 2018 6:11 PM