[Last Call] Learn how to a build a cloud-first strategyRegister Now

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 12866
  • Last Modified:

Disable Internet Explorer in Group Policy

I have a GPO object Block Internet Explorer. I am wanting to only block specific users with the policy though. Right now it blocks all users, even administrators. How do I get this policy to work for a group of people logging on to a group of machines?
0
crsrvn
Asked:
crsrvn
2 Solutions
 
and235100Commented:
You would have to configure a policy under user configuration - not computer configuration. This is what it sounds like is the problem - if not, please define the situation more clearly.
0
 
crsrvnAuthor Commented:
I have tried it under user configuration, but it is not Disabling IE. But if I set it up under computer configuration it works.
0
 
bmsjeffCommented:
The policy settings are located in the following locations in the GPO:

User Settings --> Windows Settings --> Internet Explorer Maintenance --> Connection
Then open the Proxy Settings window and add 0.0.0.0 for port 80.

User Settings --> Administrative Templates --> Windows Components --> Internet Explorer
Then set Disable Changing Proxy Settings.

0
Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

 
hstilesCommented:
Set up a group policy and for the Administrative components, windows explorer, prevent running of following applications and choose iexplore.exe.

Now set security on the GPO and stop it applying to a specific group of users.
0
 
crsrvnAuthor Commented:
I need to make it so it only works for a specific group of users on a specific group of machines.

I have the following scenario,

mydomain.net/High School/Computers/Labs/Lab 7 - the computers that users are logging into
mydomain.net/TV-High School/Students - the users I want IE unavaible to in the Lab above

0
 
crsrvnAuthor Commented:
I need to make it so it only works for a specific group of users on a specific group of machines.

I have the following scenario,

mydomain.net/High School/Computers/Labs/Lab 7 - the computers that users are logging into
mydomain.net/High School/Students - the users I want IE unavaible to in the Lab above
0
 
hstilesCommented:
In that case, remove authenticated users fromt he security tab and replace with aglobal group containing the users you wish to prevent from running IE7
0
 
lecutisCommented:
You could try enabling group policy loopback processing, I used the below article for a terminal services situation, but with some thought it may work for you.

http://support.microsoft.com/kb/260370
0
 
crsrvnAuthor Commented:
If I do an rsop on the machine/user in which I want the policy to apply to it shows me under my computer configuration summary - denied GPOs -  Lab Block Internet Explorer and it's reason is that the computer settings are disabled which is correct I have it disabled I only want it to apply to users. But under the user configuration summary there is nothing about the Lab Block Internet Explorer GPO. It is not in the applied or denied GPOs listing under the user configuration summary. This is getting pretty tough, maybe I should have went to school to be a clown.
0
 
crsrvnAuthor Commented:
Enabling group policy loopback processing worked. Remove Authenticated Users from Security Filtering and add the global group you want the policy to apply to. Enable User Group Policy Loopback Processing mode on the GPO (It's under Computer Configuration/Administrative Templates/System/Group Policy.
0

Featured Post

Keep up with what's happening at Experts Exchange!

Sign up to receive Decoded, a new monthly digest with product updates, feature release info, continuing education opportunities, and more.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now