I am not sure if you are aware of it, but starting next year Microsoft is changing their Internet Explorer upgrade policy.

Specifically, they will be putting IE updates into the standard automatic update cycle. This means if you have an older version of IE, it will automatically get upgraded.

Many organizations have piles of Web applications that cannot work on anything but a specific version of Internet Explorer.

I would not want to come into the office one morning to find out a few hundred computers now have IE 7, when a critical web app requires IE 6.

How can you prevent this from happening?

Thankfully Microsoft has provided three registry keys that will prevent the automatic install.

There is one for each version of IE (IE 7, IE 8, IE 9)

These are the keys:

For IE 9

Key:
HKLM\Software\Microsoft\Internet Explorer\Setup\9.0\
Value
DoNotAllowIE90 1 = Block Install, 0 = Allow Install

For IE 8

Key:
HKLM\Software\Microsoft\Internet Explorer\Setup\8.0\
Value
DoNotAllowIE80 1 = Block Install, 0 = Allow Install

For IE 7

Key:
HKLM\Software\Microsoft\Internet Explorer\Setup\7.0\
Value
DoNotAllowIE70 1 = Block Install, 0 = Allow Install

A quick and easy way to make these changes is to use our tool, Network Administrator.

We added a plugin that will make it easy to block the automatic install:

You can even pick and choose what version of Internet Explorer you want to block:

It is free for personal and commercial use (up to three computers at a time).

You can find it on our downloads page:

http://www.intelliadmin.com/index.php/downloads/

It is that time again. Microsoft is getting close to releasing IE 9 in its final form. According to my sources, it will be released on Monday, March 14th.

This also means it will show up in automatic updates as an “Important Update”

If you want to prevent this from happening, you can setup a registry key that will block it.

The key is under this path:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\9.0

You will need to create the key above. Once you do that, add this DWORD value:

DoNotAllowIE90

Set it to 1 to block, Set it to 0 to unblock.

We also have updated the free version of Network Administrator to set this key for you – that way you don’t have to mess around with the registry by hand:

Download a free copy from here

One final note – keep in mind this will only prevent it from showing up in Automatic Update. Users can still install IE 9 by hand if they wish.

I got a question this week from a reader:

Steve, we have a locked down environment and I have just about everything set the way I want it, but I still need to find a way of keeping users from deleting their Internet Explorer history. Sometimes we need to do a review of their computer if they get infected with a Virus, or Spyware. Any way to easily do this?

There is a way to do this, but I will start out by saying that a determined user will always find a way around it – either by using an alternative browser, or finding the cached files on their hard drive.

The first way is to dig into the registry. Create a key under HKEY_LOCAL_MACHINE under this path:

Software\Policies\Microsoft\Internet Explorer\Control Panel

Once you have created the key, create a dword value under it named:

DisableDeleteBrowsingHistory

To disable, set it to 1. To enable set it back to zero.

We have also added this to Network Administrator:

It is a free download (For up to 3 computers at a time) from here:

http://www.intelliadmin.com/NetworkAdministrator.exe

Much easier than tinkering with the registry.

Back to Internet Explorer – Lets look at how it changes IE. Before we made our change, the security menu had the delete browsing history option:

Right after the registry key was created and set (Restart of IE required), it is gone:

So there you go. A simple way to prevent users from deleting their browse history – not perfect, but it can work well in most situations.

I installed Windows 7 on my ASUS Atom N270

Before I did that, I recorded how long it took to do a few things:

-Copying a 45 MB file over the network
-Boot Time
-Shutdown Time
-Memory used at idle, after startup
-IE Launch time

Then, after I installed Windows 7, I did the same, and recorded how long it took. I was curious to see if Windows 7 was faster or slower than XP.

Keep in mind this is not scientific, but just a simple test I did on my own computer.

Here is what I found:

Boot time under Windows 7 was 22 seconds faster:

Shutdown time under Windows 7 was 20% faster:

What about the time it takes for Internet Explorer to Launch?

Windows 7 was faster there too:

Amazingly the memory usage at idle was less in Windows 7, than in Windows XP. I should do this article again with Vista. I am sure that number in Vista is over 1GB

Another test I did was copying a 45 MB file over my wireless network.

Look at the difference:

This was an amazing result. I had to try it a few times to make sure it was not a mistake. It took Windows XP almost a minute longer to transfer that same file.

Amazing. Windows 7 is faster on all of my tests.  Not only has it won this little test, but instead of wanting to remove it after 2 weeks (Like with Vista)…I want to install it on all of my computers!

Microsoft announced on Tuesday that a serious security hole was found in all versions of Internet Explorer. The flaw exploits the ActiveX plugin system in IE.

If you use Internet Explorer, and are running flash – you are vulnerable. If you have any ActiveX control installed in IE you have a good chance of being vulnerable. It only takes one website with a bad flash file for your system to get compromised. A blog at Adobe’s website has more detailed information:

http://blogs.adobe.com/psirt/2009/07/potential_adobe_reader_and_fla.html

This problem is far and wide. Adobe comes to the top of the list because so many people have the flash player – but Cisco, and Google are working on fixes for their software too.

The fix (MS-09034) can be downloaded and installed to help resolve the issue, but it will not completely close the hole.

This is because the flaw is not in IE itself, but the libraries that third party developers use to build plugins. This means that any plugin ever created for IE has the potential of having this flaw. The only way for a vendor to fix it is to download a patch for the ATL library, recompile their code, and re-release the software.

All I can say is – what a mess.

What can you do to protect your network? The first answer is to run an alternative browser.

Many times this is impossible. The second way is to have tight control over what ActiveX plugins are used, and to verify with the vendor that they have recompiled with the new ATL library.

The big red light here is that any ActiveX plugin is now a potential flaw waiting to be exploited.

More detailed information about the flaw and its fixes can be found here:

http://www.microsoft.com/technet/security/advisory/973882.mspx

Microsoft released IE 8 for public consumption a few days ago. Microsoft’s Dean Hachamovitch, who leads the IE 8 development team, made the announcement during his keynote address at the company’s MIX09 conference going on in Las Vegas.

While I still use Firefox daily, I can see that Microsoft has made every attempt to make IE 8 attractive to network administrators. Some of the new deployment features make it easy to distribute across a large network. In particular, Microsoft has equipped IE 8 with built-in deployment features, based on the company’s existing deployment and update platforms.

In contrast, to deploy Firefox you need to use third party tools such as FrontMotion Firefox MSI, CCK Wizard, or FirefoxADM.

Microsoft has been pushing IE 8′s ability to automatically switch back into compatibility mode when a website is not made for the new version. This is because IE version 8 and earlier did not follow web standards, and this in turn this forced web developers to create hacks for each browser version. The beauty of this auto detection is that it will not break a corporate Intranet or internal websites that depend on these old hacks when it is deployed across a corporate network – a big issue when IE 7 was rolled out.

Another nice feature is tab crash protection. In the event that something causes a browser crash, it will only take down that tab, and not all of them with it. This is because each tab is run in its own process.

A unique feature of IE 8 is something called “Accelerators”. These are shortcuts to services that open within a given web page. Instead of cutting and pasting to another tab, you highlight text and click the accelerator icon top open a blog, email, map, or search.

What about security? The IE 8 development processes included the Microsoft ‘Trustworthy Computing’ code inspection. IE 8 (running in Protected Mode) will run at low integrity, meaning that they can’t launch applications without the user’s express permission. The browser is designed to use the ‘Data Execution Prevention’ and ‘Address Space Layout Representation’ to protect against remotely executing malware. Neither Firefox nor Safari offers similar protection.

By no means is this a complete list of features found in IE 8. I am still playing with it on one of my test systems to see how well it performs against other browsers.

Is it worth installing on your network? Or in other words, do you need to prevent it from being installed on your network? Yes. Even if Microsoft thinks it is ready, I would suggest taking the slow and easy approach. Install it on a few test machines first. I saw way too many cases of the IE 8 beta totally hosing a machine – to the point that windows needed to be reinstalled.

There are a few ways to block IE 8 from automatic update. First, you can use our Network Administrator, or the IE 8 blocking toolkit from Microsoft.

Back in 2006 we created an IE 7 blocking tool. It set a special registry key that would tell Automatic Update to totally skip IE 7 when it was released.

Now the same can be accomplished with Internet Explorer 8. Yes, I do realize that it is still in beta, and has not even been released to the general public – but that day will come. Most companies will have trouble with at least one or two critical websites that simply will not work with it. To give us time to adjust Microsoft has published a registry key to block IE 8.

To block the automatic install you can open regedit, and browse to:

HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Setup\8.0

If the key(s) do not exist, you will need to create them – most likely they will not since you probably have never installed IE 8!

Then under that key, you can create a new DWORD value called DoNotAllowIE80

Set its value to 1

Now Automatic updates will skip IE 8.

If you don’t like to plunk around in the registry you can do this with the latest of our free (Up to 3 computers) Network Administrator:

Download it from here

If you want to use it to disable it on your own computer, check the “Local System” Box, Select disable, and hit submit – you are done.

Or, you can even use it to disable it on a number of computers across your network:

Microsoft has indicated that the registry key will never expire – this is a change from their original position with the IE 7 blocking key. It was only to last for 12 months after the release of IE 7. I decided to go back and see if they changed the wording on the IE 7 blocking tool website – and they have. It too is now a permanent key.

This tip is only for Vista….so I apologize in advance to those of you still using XP. In Vista you can easily clear your browsing history by going into the options of Internet Explorer. I have helped a few organizations that use this information after a spyware incident to determine where the problem came from.

Users may notice that something happened, and call the IT department for help. Before they do that they clear their history so they don’t get in trouble. This vital information is now lost, and a potentially bad site could cause the problem again.

So how could you prevent this? Easy, use group policy. You can do this locally, or on your domain controller if you want to apply the changes across your network.

To change the policy on your Vista machine, click on the start button, and type gpedit.msc – then press enter.

 

Then the local policy window will be displayed. You will need to drill down to:

Computer Configuration->Administrative Templates->Windows Components->Internet Explorer\

Once you are in that section, scroll down and you will see three items:

“Turn off ‘Delete Browsing History’ functionality”
“Turn off ‘Delete Passwords’ functionality”
“Turn off ‘Delete forms’ functionality” 

Only the first one is necessary for what we are trying to accomplish, but the other two are related and you may want to use them.Â
 

I am not a big fan of how many policy items are worded. It forces you to enable them when you want something disabled. So if you want to disable them, then use the enable option. Now, if you go into internet explorer, and try to clear the history, you will notice that the button is disabled:
 

This same tip could be used on a domain controller. If you have 2008 it will already be available. On some versions of 2003, you will need to get the updated administrative template for Internet Explorer.

I recently received an email: