none
Windows 7 Group Policies RRS feed

  • Question

  • The group policies for windows 7 doesnt work with Internet Explorer 11. it used to be working fine with Internet Explorer 9. but after updating to IE11 we encounter an error while opening the gpedit.msc console which is:

    [  $(string.Advanced Enable SSL3 Fallback) referenced in attribute displayname could not be found. ]

    I dowanloaded an update from the microsoft website and it is the (KB3008923). Then I tried once again and while opening the gpedit.msc I did not get the error message again however I am unable to apply group policies for IE11 since it is not there anymore under the: User Setting - Windows Settings menu. Is there any possibility to fix this?

    The computer is under a Domain and I am also unable to edit the policies for IE11 using the Domain server.

    Monday, December 15, 2014 2:34 PM

Answers

  • Hi,

    How did you apply the group policy to IE 11? Via local group policy editor in Windows 7 or GPO in a domain?

    I did not get the error message again however I am unable to apply group policies for IE11 since it is not there anymore under the: User Setting - Windows Settings menu. Is there any possibility to fix this?

    Could you plaese give us a snapshot so we can better understand what happened?

    The computer is under a Domain and I am also unable to edit the policies for IE11 using the Domain server.

    What is the DC version? What is the IE version insatlled in DC? If you want to configure GPP settings for IE 11, then you need to you need to have Windows 8.1 (RSAT for Windows 8.1 installed) or Windows Server 2012 R2 installed as DC.


    Yolanda Zhu
    TechNet Community Support

    Tuesday, December 16, 2014 8:59 AM
    Moderator

All replies

  • I am having the same problem.  After updating the system to IE 11, I am getting the error when opening gpedit.msc.

    I look forward to a solution.

    Win7 64

    Monday, December 15, 2014 7:56 PM
  • Hi,

    How did you apply the group policy to IE 11? Via local group policy editor in Windows 7 or GPO in a domain?

    I did not get the error message again however I am unable to apply group policies for IE11 since it is not there anymore under the: User Setting - Windows Settings menu. Is there any possibility to fix this?

    Could you plaese give us a snapshot so we can better understand what happened?

    The computer is under a Domain and I am also unable to edit the policies for IE11 using the Domain server.

    What is the DC version? What is the IE version insatlled in DC? If you want to configure GPP settings for IE 11, then you need to you need to have Windows 8.1 (RSAT for Windows 8.1 installed) or Windows Server 2012 R2 installed as DC.


    Yolanda Zhu
    TechNet Community Support

    Tuesday, December 16, 2014 8:59 AM
    Moderator
  • Im too having the same issue, im testing windows 7 with IE11 enterprise mode in our environment but im not able to enable Enterprise Mode at all its not showing in the Tool menu. 

    When i open the local Group Policy im getting a error message complaining about a line 795, column 308 in the inetres.admx template.

    ive installed IE11 from Microsoft this time around on a single workgroup machine.

    any help would be much appreciated.

    Monday, December 22, 2014 12:25 PM
  • Hi a4r0 ,

    To enable enterprise mode appears under tools, we first need to configure the group policy

    Computer Configuration\Administrative Templete\Windows Components\Internet Explorer, turn on "let users turn on and use enterprise mode from the tools menu"

    Since there's a inetres.admx error in template, so the template might be corrupted, have you tried to replace the C:\windows\PolicyDefinitions with a right copy?

    You can check the similar link (the Administrative template mentioned in the link can also apply to Windows 7)

    https://social.technet.microsoft.com/Forums/windows/en-US/426340dd-2c70-483d-87c1-bf9255aa0442/local-group-policy-editor-error?forum=w8itprogeneral

    Thursday, December 25, 2014 6:37 AM
  • oh i see, the domain server is using Windows Server 2008 R2, we were trying to apply the policies throught the domain server itself, and all our computers are running on Windows 7 Professional.
    Thursday, January 8, 2015 9:51 PM
  • I am also experiencing the same issue and have found some interesting info that has not yet been shared here.

    CASE #1

    I created an SCCM package for IE11 back in 2014. I deployed this package to 2 Win7 Enterprise systems on Nov. 11 2014, and was able to configure the local policy such that I was able to enable Enterprise mode via the "let users turn on and use enterprise mode from the tools menu". This worked great.

    The inetres.admx on these 2 systems deployed on Nov. 11 2014, is 1,627KB in size.

    CASE #2

    Using the same SCCM package with no changes to it, I deployed it to 4 Win7 Enterprise systems on Jan. 19, 2015, and received the error when trying to modify the local policy via gpedit.msc with elevated privileges.

    "[Window Title]

    Administrative Templates

    [Main Instruction]

    Encountered an error while parsing.

    [Content]

    Resource '$(string.Advanced_EnableSSL3Fallback)' referenced in attribute displayName could not be found.

    File C:\WINDOWS\PolicyDefinitions\inetres.admx, line 795, column 308

    [OK]"

    The inetres.admx on these 2 systems deployed on Jan. 19 2015, is 1,629KB in size.

    After opening up this file, and comparing them, the error above proved to be the difference in the files. There is an extra policy in this new .admx and is indeed on line 795, ending on line 818.

    My Questions:

    1. How did this file change? Security patch? Did IE11 download it and apply it during the install?

    2. How can I overwrite this file? Everything I try to do to replace the existing .admx has failed. Logging in with local admin, safe mode, deleting, overwriting, nothing seems to work at it is always in use. I cannot boot from  WinPE as the drive is encrypted.

    I will post more as I continue my troubleshooting.


    • Edited by vandrd Tuesday, January 20, 2015 3:44 PM Added details.
    Tuesday, January 20, 2015 3:42 PM
  • I too am experiencing the same exact issue. Has anyone found a fix for this issue or know what could be causing it?

    Thanks

    Friday, January 23, 2015 1:16 PM
  • Is there any word on this? I have the same problem on my domain.
    Friday, January 23, 2015 10:04 PM
  • Same problem here.  Any word?

    Thanks

    Thursday, February 5, 2015 2:19 AM
  • We had this issue crop up on one of our test environments.

    This should be something that Microsoft resolves in a future patch, but I am not associated with them, and have no idea if this will happen. They either tried to remove something from the admx template and removed it from the adml file (language descriptor that translates variables into the appropriate text in the appropriate language), but not the admx file; or they accidentally removed the variables from the adml file.

    For instance, the adml file was missing this (the first one that gets caught and causes an error):

          <string id="Advanced_EnableSSL3Fallback">Allow fallback to SSL 3.0 (Internet Explorer)</string>
          <presentation id="Advanced_EnableSSL3Fallback">
            <dropdownList refId="Advanced_EnableSSL3FallbackOptions" noSort="true" defaultItem="0">Allow insecure fallback for:</dropdownList>
          </presentation>

    To fix this, I was able to copy the adml file from my Windows 7 machine (c:\Windows\PolicyDefinitions\en-US\InetRes.adml) to the domain controllers group policy definitions (C:\Windows\SYSVOL\domain\Policies\PolicyDefinitions\en-US\InetRes.adml).

    Hope that helps!

    Btw, I figured this out by using procmon https://technet.microsoft.com/en-us/sysinternals/bb896645.aspx


    Friday, February 6, 2015 6:56 PM
  • Hi,

    I have Windows 2008 R2 Domain Controllers.  All our computers still have IE9 except for few beta machines

    Are you suggesting that I have to upgrade the IE of my DC to IE11 just to be able to get rid of this error message? If I do that, won't it affect the existing GPO of my IE9 already or is it backwards compatible?

    Thanks!

    Friday, February 20, 2015 1:07 AM
  • My Questions:

    1. How did this file change? Security patch? Did IE11 download it and apply it during the install?

    2. How can I overwrite this file? Everything I try to do to replace the existing .admx has failed. Logging in with local admin, safe mode, deleting, overwriting, nothing seems to work at it is always in use. I cannot boot from  WinPE as the drive is encrypted.

    We are experiencing the same issue, so we have the same questions.  Did you ever find how this file get changed?

    Thursday, March 19, 2015 1:30 PM
  • Hi, FYI I was able to get past the error and get Enterprise Mode working in IE11 by copying the InetRes.admx & InetRes.adml from a working Win7 machine to the affected system and rebooted.

    c:\Windows\PolicyDefinitions\InetRes.admx

    c:\Windows\PolicyDefinitions\en-US\InetRes.adml

    The error initially came up after deploying IE11 to a group of UAT users. Out of 60 users, only 5 had this error. It's a manual process, but a quick fix.

    Hopes this helps someone.


    • Proposed as answer by FmlyMn2015 Wednesday, June 24, 2015 10:34 PM
    • Edited by FmlyMn2015 Thursday, June 25, 2015 2:56 PM Forgot to add the second file.
    Wednesday, June 24, 2015 10:33 PM