0

I have set the following policy with gpedit in a Windows Server 2008 machine that has IE8:

gpedit screenshot

I have a source that tells me that configuration resides in HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Restrictions\NoExtensionManagement -- but that's a lie. There isn't even an Internet Explorer folder under Software\Policies\Microsoft.

Moreover, the same source says the setting is under "Computer Configuration\Network\Internet Explorer\Do Not Allow Users to enable or Disable Add-Ons" on gpedit. As you see above, that isn't true either.

OK, the "source" I'm talking about is the US Government: http://usgcb.nist.gov/usgcb/download_ie8.html -- namely, their IE8 OVAL definitions.

So, where in the registry is that setting?

JCCyC
  • 16,140
  • 11
  • 48
  • 75

2 Answers2

1

It is an either/or. The policy can be implemented via the registry OR the GPO. You'll find your GPO where it is set in something like:

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{71DA9274-FD7B-4660-A801-B013570D3F5F}Machine\Software\Policies\Microsoft\Internet Explorer\Restrictions

or 

HKEY_USERS\S-1-5-21-2090352725-1269969352-1905203885-2959\Software\Microsoft\Windows\CurrentVersion\Group Policy Objects\{71DA9274-FD7B-4660-A801-B013570D3F5F}Machine\Software\Policies\Microsoft\Internet Explorer\Restrictions

though the GPO itself is stored on disk, and not the registry ... I think here:

%systemroot%\System32\GroupPolicy

As far as where you'll find various settings in gpedit - it does depend on your version of windows.

iivel
  • 2,576
  • 22
  • 19
  • Yeah, after posting the question I found this: http://vlaurie.com/computers2/Articles/group_policy_editor.htm -- the problem is, I have to read and parse that file. Remotely. (Having the proper credentials, of course.) – JCCyC Feb 22 '11 at 21:50
0

After getting hit with some unwanted intrusive piece of software, I couldn't reset the IE8 settings on my Windows XP machine (yes, I know how old that is). Found the problem - the "Control Panel" settings had an additional registry entry in HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings

The zonemap under this registry key had 1803 disabled. That made three different entries for the same value in the registry. It wasn't IE8, it wasn't Group Policies. It was a rogue copy hidden in the HKLM that overrode other settings.

Symptom included that message "some settings controlled by Group Policy ..." Well, who's the group, exactly, on my tablet.

The Microsoft KB182569 is excellent. The only missing data was where to find the "unwanted" copy of zones.

Stymied_no_more
  • 1