Internet Explorer Registry Keys commonly required for delivery

Im often trying to dig around for Internet Explorer registry keys to control IE as opposed to using group policy.

The following has some good detail on the registry locations used by IE.

http://technet.microsoft.com/en-us/library/cc736412(v=ws.10).aspx

Changing the Internet Explorer Default File open path

Changing the Internet Explorer default file open path proved to be a hard one to get to bottom of. This work with Internet Explorer 8 , im not sure about other versions. Ive no idea why microsoft dont just allow a path setting on this one.

You basically need to export the following reg_binary keys from a machine that has the correct location set. Then set this for the user before they launch Internet Explorer.

HKCU\Software\Windows\CurrentVersion\Explorer\ComDLG32\LastVisitedPidMRU
Value Name :MRUListEx
Value Name : 0

Adobe Reader Web Browser Intergration Registry Key

Setting the following key ensures that PDF documents when browsed through internet explorer open in the full Adobe Reader product and dont render inside IE. If you want them to render in IE then set the Key value to 00000001


[HKEY_CURRENT_USER\Software\Adobe\Acrobat Reader\x.x\Originals]
'bBrowserIntegration'=dword:00000000

Control Java Version used By Internet Explorer

Controlling multiple Java versions on Windows Server 2008/ Windows 7 and Internet Explorer 

You can have multiple versions of the Java runtime Environment installed on your windows platform.

Control Panel
The last version installed will be the one that displays from Control Panel. If you wish to launch the control panel for another version simply browse the C:\programs files\Java directory for the relevant version and in the BIN directory their should be a javacpl.exe. This will allow you access to that versions control panel.

Internet Explorer Intergration
Using the java control panel for the required version is the easiest way to set the Java version that will interact with Internet explorer. The following however can be perforemed within the registry.


When you click Internet options, advanced and scroll thru to the java section you will see the Java version registered with Internet Explorer.
To change this version number via the registry you need to find the following key
HKLM\Software\Javasoft\Java Plug-in\x.x.x_xx
UseJava2Iexplorer =  0 = OFF   1 = ON

And edit a number of values under the following registry section
HKLM\Software\Microsoft\Internet Explorer\AdvancedOptions\JAVA_SUN

And alter the users deployment file stored in
%applicationData%\Sun\Java\Deployment

Allow Active Content to run in Files on My Computer - Enabling this setting

In order for Active X and other Active content to run when viewing files from normal file system (eg. C:\ or a network drive)  You may need to enable the setting

"Allow Active Content to run in files on my computer"

This option is seen in the advanced Tab within Internet Explorer Settings

An example of requiring this is viewing Visio Diagrams using Visio Viewer from within Internet Explorer.
GPO can control nearly all the setting on this advanced tab but does not have control for this one.
In order to automate control over this setting we can control the tick via the following registry key

HKCU\Software\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_LOCALMACHINE_LOCKDOWN\iexplore.exe

0 = Allow
1 = Disallow

Control Open and Save Dialog Prompt on Windows 7 and Server 2008

When downloading certain content from within Internet Explorer you may well be prompted with a dialog box asking "Do you want to open or save this file ?"

and their will be a tickbox asking if you want this prompt to appear each time.




I have had trouble finding any decent description of the behaviour for this in Windows 7/Server 2008 but do know this much.

The following registry key gets populated your choices.

HKCU\Software\Microsoft\Windows\Shell\AttachmentExecute\{0002DF01-0000-0000-C000-000000000046}

eg.  Adobe Reader Adds AcroPDF.PDF.1      (reg_Binary)
       MS word Adds         Word.Document.8  (reg_sz)


Adding these keys appears to automatically open the file and not prompt.

I think that the Editflags keys inside HKCR\.fileext may also have a part to play in this process but to resolve my issue of users getting prompted when clicking PDF files the above key was enough.

Internet Explorer 8 - GPO Settings Help

With more than 1300 Internet Explorer 8 GPO settings configurable this technet breakdown is likely to come in very handy.

http://technet.microsoft.com/en-us/library/cc985351.aspx

Internet Explorer Enhanced Security - Scripted Removal

To Disable Internet Explorer Enhanced Security via Script perform the following actions.

Disable in Users Install GUID
HKLM\SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A7-37EF-4b3f-8CFC-4F3A74704073}\IsInstalled = 0

Disable in Admin Install GUID
SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}\IsInstalled = 0

Rundll32 iesetup.dll,IEHardenUser
Rundll32 iesetup.dll,IEHardenAdmin
Rundll32 iesetup.dll,IEHardenMachineNow

Emdedding a WebPage within a WebPage

Sounds Strange i know but sometime this might be handy.
It basically lets you display another webpage within your own. I was considering using it to display my Blog directly inside my www.thinworld.net website but eventually chose against it.

I still might use it in the future so posting the code here. It could also be used to make your own cool portal type page.

Internet Explorer Cookie Handling

There is a good article in the Citrix Blogs today about Internet Explorer Cookie handling and how to manage this using the Citrix UPM (User Profile Manager)

The basics
Cookies in the cookie folder are indexed inside INDEX.DAT
IE is quite bad at keeping things clean and there will often be cookie files in the folder that are not indexed in the INDEX.DAT , these cookies are then stale (not required)
The Citrix UPM can perform a clean up of the cookies by removing any that are not referenced in the index.dat file at user logoff.

The full article is here
 http://community.citrix.com/display/ocb/2011/01/25/Notes+on+synchronising+Internet+Explorer+cookies+using+Profile+Management

Webpage fails to display unless refresh key is pressed

We had a problem with a webpage in IE8. This was a rather specific problem.
If we tried to open the same webpage in 4 seperate tabs the 4th tab would fail to load the page.
It would display a no content found type error message. However if page refresh is performed the webpage displays correctly.

This problem is related to Sophos and the IE8 Tab process handling.

The workaround we found for this error was to increase our TabProcGrowth figure. We set
our to 10 which meant the page would only fail on the 10th Tab. (plenty enough tabs for users)
The TabProcGrowth Registry key lives here
HKCU\Software\Microsoft\Internet Explorer\Main
[reg_sz] TabProcGrowth = 10

More detail on this registry value and its implecations are detailed in a MSDN Article here
http://blogs.msdn.com/b/askie/archive/2009/03/09/opening-a-new-tab-may-launch-a-new-process-with-internet-explorer-8-0.aspx

Internet Explorer 8 PAC script not applying

We had a problem after an upgrade from Internet Exporer 6 to Internet Explorer 8.
Our PAC script file for Internet Explorer is used set to proxy exceptions and the proxy path. After the upgrade to IE8 the settings failed to be applied correctly.

It failed to read the DIRECT statements we had in the file and sent all traffic via the proxy server instead. This is ok but caused problems with access to some internal sites for staff who dont have any permissions to the proxy server.

We raised a support call with Microsoft who advised this problem is fixed with KB972260

I have applied and tested and this indeed works all ok.

We still have the 20 second delay problem with applying "Internet Explorer Branding"
I have detailed a workaround for this in another blog article.

IE8 Control via registry Keys

Im working on a Delivering Internet Explorer 8 to users. I want to tailor the users settings via registry keys so will blog any handy registry keys as i find them. I will also detail any other interesting settings or problems i come across.

Hide/Disable the Address Bar in IE8
HKCU\SOFTWARE\Policies\Microsoft\Internet Explorer\ToolBars\Restrictions\NoNavBar=1 (DWORD)

Hide/Disable Command Bar
HKCU\SOFTWARE\Policies\Microsoft\Internet Explorer\ToolBars\Restrictions\NoCommandBar=1(DWORD)


Disable Suggested Sites
HKCU\Software\Microsoft\Internet Explorer\Suggested Sites\Enabled = 0

Hide Favorites Menu (but leave the file, Favorites buttons)
HKCU\Software\Microsoft\Internet Explorer\LinksBar\Enabled = 0

Prevent the First Run Splash Screen
See separate IE8 Blog entry

RSS Feeds
RSS feeds are stored in %localsettings%\application data\microsoft\feeds
(this is a bad location as most people dont roam this area)

Automatic Configuration Script
There seems to be a bug with Internet Explorer 8 in that it does not read our PAC Script
correctly. It does not perform the DIRECT access commands that we specify in the file and sends all traffic to the proxy server instead. This means a number of our website now redirect through the proxy server instead of being more efficient and going straight to the internal server.
Our file works fine in IE6. I have a MS Support call open for this.

Update :
This bug was resolved by installing Microsoft Fix KB972260

GPO for Inprivate
Ive used the new version of the INETRES.ADM file to set group policy actions to control IE8. However some of the actions do not appear to be working. I set the Inprivate function as disabled yet users can click it still. A RSOP shows the policy setting should have prevented access to this. Yet users can happily still use the function.

File Open Location 
Internet Explorer 8 remembers the last location a webpage was opened from. It stores this location in the following registry key.
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU

Prevent IE8 Setup Screen

When you first Launch IE8 it comes up with a setup or splash screen to help you configure your IE8 with various settings. This is commonly not required in a XenApp Terminal server environment.

This can also be performed via GPO via setting called
Prevent performance of First Run Customize settings


To prevent this pop up coming up set the following HKCU keys for users at logon.

Value Name	Data	Type
IE8RunOnceLastShown	1	REG_DWORD
IE8RunOncePerInstallCompleted	1	REG_DWORD
IE8RunOnceCompletionTime	(empty)	REG_BINARY
IE8TourShown	1	REG_DWORD
IE8TourShownTime	(empty)	REG_BINARY
IE8RunOnceLastShown_TIMESTAMP	(empty)	REG_BINARY