Some Websites do not function correctly on IE8 as non-Administrator

Posted on 2011-10-09
Last Modified: 2013-12-08
Hi All,

We are experiencing an issue on Internet Explorer 8 where some websites are not functioning correctly as non-Administrator accounts.

Issue Envionment:
- Client Machines are Windows 7 SP1
- Internet Explorer Zones as below:
      - Internet = Medium-High + Protected Mode ON
      - Local Intranet = Medium Low + Protected Mode OFF
      - Trusted Sites = Low + Protect Mode OFF
      - Restricted Sites = High + Protected Mode ON
- Internet Explorer Privacy Settings as below:
      - Override Auto Cookie Handling = True
      - First Party Cookies = Accept
      - Third Party Cookies = Accept
      - Always allow session cookies = True
- Pop-up Blocker = Enabled with Various Allowances (including affected sites)
- Domain Users are *not* Local Administrators or Power Users - they are just Users
- We use group policy to set NTFS permissions on their local machine as below:
      - %SYSTEMDRIVE%\* - Read Only
      - %SYSTEMDRIVE%\Users\%USERNAME%\* - Full Control
      - %SYSTEMDRIVE%\Users\Public\Desktop\* - Full Control

What is happening:
Some sites do not function correctly.
For example a website report will not generate under non-Administrator but will under Administrator.

Example Websites:
      - There is a print function on the website that generates a PDF report that will not work for non-Administrators
      - When a non-Administrator triggers this function the website returns them to the login screen.
      - There is a reporting function on the website that generates a HTML report that will not work for non-Administrators

I know this will make troubleshooting very hard - but both sites above require login information that I cannot divulge.
I have a feeling that both sites have issues relating to cookies - but I am stumped as to why this is happening.

What I Have Tried:
- I have run Process Monitor to see if there is anything along the lines of Access Denied but nothing like that appears during the replication of the problem.
- The workaround I have in place is to grant users Local-Administrator access to their machine (I know I know).
Question by:auscoit
    LVL 30

    Expert Comment

    Try lowering down UAC setting from control panel and then check.


    Author Comment

    Hi ded9 - UAC is disabled on all machines.. forgot to add that.
    LVL 30

    Expert Comment

    Uninstall your security software...reboot and then check.

    LVL 82

    Expert Comment

    by:Dave Baldwin
    That main page for is poorly formatted HTML page.  I'm wondering if they have ActiveX code on their that requires Admin privileges to run.
    LVL 66

    Expert Comment

    "I have run Process Monitor to see if there is anything along the lines of Access Denied". Are you capturing any other write attempts out of their User Profile?

    Did you set the filter to ONLY include "Result=Access Denied" so as not to omit any processes? Or at least search with the results?

    They are read only on the ENTIRE drive?

    Does this "Print" function use a locally installed printer? Maybe it cannot create the .spl files?


    Author Comment

    Hi John,

    Apologies - they do have FC of the print spooler folder as well as permission to change the status of the print spooler service.

    My monitoring attempts with procmon were as below:

    Result != Success

    I will re-run with Result=Access Denied and no other filtering and will see what I can find.
    Watch this space...
    LVL 66

    Expert Comment


    FYI, SUCCESS is normally the first thing I exclude, when troubleshooting issues, as it SIGNIFICANTLY reduces the amount of data to dig through....

    Accepted Solution

    After much research and banging my head against the wall I came across the following information:

    The issue is that whenever the reports .etc generate the browser was opening a new window and the cookies were not carrying over to the new window!

    This is all due to the fact that IE8 creates separate processes between windows.
    I cannot explain why it was working for local administrators - but basically the issue is resolved by the following key:

    Windows Registry Editor Version 5.00
    [HKEY_USERS\S-1-5-21-1170163745-1901472128-176895030-10308\Software\Microsoft\Internet Explorer\Main]

    Open in new window


    Author Comment

    Note - It also works for

    HKLM\Software\Microsoft\Internet Explorer\Main

    Author Closing Comment


    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    Course: HTML5 Mobile App Development with PhoneGap

    PhoneGap can help you leverage your already existing HTML5, JavaScript, and CSS skills in order to create and deploy cross-platform mobile apps.This program comprehensively covers HTML5 mobile app development from top to bottom.

    Article by: Lee
    Windows 7 Ultimate and Enterprise (and 2008 R2) introduced a new feature you may not be aware of - Boot from VHD.   Boot from VHD (or what Microsoft refers to asNative Boot allows you to install Windows to a VHD (Virtual Hard Disk) file that is t…
    New Windows 7 Installations take days for Windows-Updates to show up and install. This can easily be fixed. I have finally decided to write an article because this seems to get asked several times a day lately. This Article and the Links apply to…
    The viewer will learn how to back up in Windows 7 with native tools. This should be the first step. Third party tools should also be used. Access the Backup and Restore options: Click on the windows 7 start ball in the lower left corner of the scree…
    The Task Scheduler is a powerful tool that is built into Windows. It allows you to schedule tasks (actions) on a recurring basis, such as hourly, daily, weekly, monthly, at log on, at startup, on idle, etc. This video Micro Tutorial is a brief intro…

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    14 Experts available now in Live!

    Get 1:1 Help Now