Wednesday, July 23, 2014

Configure Internet Explorer 10 or 11 settings with GPO

Lately i get a lot of questions about the ability (or inability) of editing internet explorer 10 or 11 settings with domain GPO.

Microsoft decided to deprecated old Internet Explorer Maintenance (IEM) in favor of more robust tools like Group Policy Preferences (GPP), Administrative Templates (.admx), and the Internet Explorer Administration Kit 11 (IEAK 11).
Because of this change, any settings that you previously configured with IEM will no longer work on computers where Internet Explorer 10 or newer is installed, regardless of the Windows version it’s been installed on. You must update your settings using Group Policy Preferences, Administrative Templates (.admx), or the Internet Explorer Administration Kit (IEAK).



In addition, after installing internet explorer 10 to your DC or any other computer with GPMC, you will notice that IEM no longer exist - this is by design and the way Microsoft chose to eliminate this option:


To edit internet explorer 10 and above use one of the options mentioned above (GPP\.admx\IEAK 11).
One important thing to remember is the difference between those options: policy is enforced and can't be changed by the user, while using GPP settings are configured, but can be changed by the user.
In addition, because Group Policy Preferences and IEAK 10 use asynchronous processes when they run, it is recommend that you choose to use only one of the tools within each group of settings, for example using only IEAK 10 within the Security settings or Group Policy Preferences within the Internet Zone settings

When choosing GPP to edit internet explorer settings, you probably see that there is no option for editing newer versions of internet explorer.
To overcome this issue, you need to edit the GPO on Windows 2012\R2 or Windows 8\8.1 machine with RSAT.



Differences between OS versions with GPMC

Another option is to push registry settings to your clients to edit internet explorer settings.

The following is an example of proxy registry values: 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings] 
"ProxyEnable"=dword:00000001
"ProxyServer"="PROXY_IP_ADDRESS:PORT"
"ProxyOverride"="http://*.internal.lan;https://*.internal.com;>


Useful links:

No comments:

Post a Comment