IE, and Rights to temporary internet files?

[gronis]

Hello.

I have the following scenarios when I have problems with IE:

1: Running as a normal user

It is possible for the user to surf on normal sites. But some functions doesn't work as this example:

http://www.lund.se/templates/Page2____48481.aspx

This page displays correctly, but when trying to click any of the links that will popup a new window, with the PDF inside it, it's just a blank page.

If I instead right click on the link and choose Save Target As.. It works just fine to save the pdf file (on the desktop for example), and open the PDF.

Surfing to the following page should enable you to view some instruction videos

http://sketchup.google.com/training/videos/new_to_gsu.html

It just shows a red x, like there is no image for the page to display, where the video is supposed to be.

If I open the Temporary Internet Files, according to this description, I only find one single file - a cookie.

http://windowshelp.microsoft.com/Windows/e...64f23e1033.mspx

2: Run As Administrator

If I instead right click on IE and choose Run As Administrator, everything works just fine. I can open the PDF files in new windows, and I can watch the instruction videos. I also have many temporary internet files.

3: Run as Domain\Administrator.

When I log on the computer as this user, I don't have to choose Run As Administrator. Everything works fine, without having to "run as administrator"

4: Run as a Domain Admin

If my user is a member of the domain admin group, it still doesn't work. No difference to running as a normal user.

5: Run as the local administrator

If I run as the local user I installed the computer as, IE works just fine.

Do you have any hints on what I can do to solve this? I don't want the users to run IE as administrator.

Edited February 23, 2009 by gronis

[cluberti]

1: Running as a normal user

It is possible for the user to surf on normal sites. But some functions doesn't work as this example:

http://www.lund.se/templates/Page2____48481.aspx

This page displays correctly, but when trying to click any of the links that will popup a new window, with the PDF inside it, it's just a blank page.

If I instead right click on the link and choose Save Target As.. It works just fine to save the pdf file (on the desktop for example), and open the PDF.

It would appear the PDF reader installed is having trouble reading the file from cache, and is opening a new window in a medium integrity process to view the PDF. Is this Adobe's PDF reader, or another? Also, it will depend on the MIME type sent from the server to the client on what the PDF file is (application/PDF vs text/HTML).

Surfing to the following page should enable you to view some instruction videos

http://sketchup.google.com/training/videos/new_to_gsu.html

It just shows a red x, like there is no image for the page to display, where the video is supposed to be.

Again, the control is behaving as if it requires a medium integrity process to load, and placing the site in Trusted sites (no Protected Mode on trusted sites, so any site in trusted sites will open in medium integrity) should allow it to work. I would discuss this with Google, honestly, and have them ship a version of the control that can run as a low-rights user, rather than requiring PM to be disabled (trusted sites has no PM applied by default).

2: Run As Administrator

If I instead right click on IE and choose Run As Administrator, everything works just fine. I can open the PDF files in new windows, and I can watch the instruction videos. I also have many temporary internet files.

Running as administrator makes the process *high* integrity, meaning it can do almost anything to the system it wants. This is not a safe way to run IE, or any browser or app that doesn't need system-level access.

3: Run as Domain\Administrator.

When I log on the computer as this user, I don't have to choose Run As Administrator. Everything works fine, without having to "run as administrator"

PM is not enabled for administrator users (local admin or the domain "administrator" account) by default, as technically you should not be using these accounts for daily work.

4: Run as a Domain Admin

If my user is a member of the domain admin group, it still doesn't work. No difference to running as a normal user.

Domain admins other than the actual "administrator" account do not have a full token, just like a regular user. You have admin access, but you don't get a full token and PM is also enabled for all users other than the local admin by default. What you see is expected behavior.

5: Run as the local administrator

If I run as the local user I installed the computer as, IE works just fine.

See above. PM is disabled for the local admin.

Honestly, I don't see anything specifically wrong, I see applications with problems at differing integrity levels. First, I would make sure that each and every security zone is set to it's default settings, as well as making sure to reset the settings on the Advanced tab in options to make sure everything is as it should be out of the box. If the issues still continue, it would seem as if you may be using things that weren't designed to run in IE on Vista with the new protected mode security mechanisms running IE as a low-integrity process, and you should be investigating whether or not the vendors of these apps and sites have made versions that work when running as a low-integrity process, or whether you need to use the Trusted Sites list to add these sites so the non-compliant apps work.

[gronis]

Hello. I went in another direction to figure out what was wrong.

I checked the permissions on

%LocalAppData%\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5

and the user has full control on that folder, just as system and administrators.

I did the same for tll the other folders found here:

http://www.winvistaclub.com/f11.html

I changed permissions on the folders, to everyone: full control. Still no change.

What finally solved it was to diable UAC for the user, reboot, just surf to the home page, enable UAC again, reboot, and surf again.

Very strange!