Blocking IE7 through Group Policy

[rstainforth]

Hi all,

Not sure if this is the right place for this question (if not please feel free to move it) but here goes:

We had identified some issues arising between IE7 and some other apps that we run on our networks and domains (we host and manage several here) and so used the M$ IE7 blocking to prevent it being offered to users through automatic updates. This seemed to work for a time, but then we started having reports of it slipping through. Initially it was on a handfull of laptops, so I thought it might have been users connecting at home, off the network, and it getting through like that; now, however, it is cropping up more and more frequently, and started appearing on desktop machines, which obviously never leave the LAN.

When I tested it on a client here in the workshop, the blocking worked fine, and it seems that the GPO is still in place; has anyone else had any experience of this? and if so, have they managed to resolve the issue (how is it getting through!!!)

[rstainforth]

OK, just had another look through the release notes for IE7 amd found this:

"Automatic Updates will only offer Internet Explorer 7 to users with local administrator accounts. Automatic Updates will notify all such users (including those with Automatic Updates configured to automatically download and install updates) when Internet Explorer 7 has been downloaded and is ready to install. The notification and installation process will not start unless and until a user who is a local administrator logs on to the machine. Users who are not local administrators will not be prompted to install the update and will thus continue using Internet Explorer 6."

Now, our policy is to add all laptop users as local admins by default, so I wonder if it isn't being offered to them, and the desktops have started to receive it when a local admin (either an engineer or IT delegate) logs in; I'm starting to suspect that the GPO has actually failed, and IE7 has been there all along, just waiting to be offered.

When I had tested the GPO in the workshop, i had used our "test user" account, who is a member of domain users, but not local admins. grrrrr!!!

[rion]

Hi.

Try this.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\7.0

Name: DoNotAllowIE70

Type: REG_DWORD Value: 1 <- Blocks install (0 <- Unblocks)