ie & group policies

[tokeafatty420]

i was wondering if was possible to disable the view, favs, tools, and help menu in internet explorer via group policies so that a certain dept in my company would have a stripped down version of ie

clients r running w2k
i b on w2k adv ser


any help is appreciated

[Dr Toker]

I'm not sure, but I can lend you this tidbit of advice. Upon looking at the options in the 'Tools' menu, i see listed under there Internet Options. If you are trying to disable this option, you may have to do a few other things. There are many different ways to open the Internet Options. Easiest I would say is right clicking the IE icon on desktop and select properties. You can go to the Control Panel to get there, as well as Network Connections.

I guess what I'm trying to say is that simply disabling these options may not give you the security you need. From what I am getting, is that you don't trust your users very much. In such a case I would go with a Custom Shell. This would effect the whole GUI and pretty much let you customise the access you want your users to have. There are a lot of programs that you could find might be just the solution you are looking for.

[UpperCell]

Here are a few links that look quite promissing. All I did was Google for "Internet explorer group policies".

A VERY formal paper from the NSA in classic government form right down to a few "This page is intentionally left blank" [PDF] www.conxion.com/support/guides/sd-8.pdf]Guide to securing Microsoft internet explorer 5.5 using group policy[/URL] It covers all sorts of win2k and AD stuff.

There are aparently a few problems with doing group policy with win2k and IE 6 sp 1 detailed here: You cannot manage internet explorer 6 policies on a windows 2000-based computer

Have you already messed around with the gpedit.msc? Anything you want to mess with should be under User Configuration/Windows Settings/Internet Explorer Maintenance.

Hope this helps. If you haven't already, go google for it yourself.

Jon.

[phishphreek]

Toker is right. you need to do a bit more.

Try using the IEAK. Internet Explorer Admin Kit.

http://www.microsoft.com/windows/ieak/

[avenger_jcc]

u b on google now...
r u a sys adm?
if u r I b scared that u cant type full sentances....

[tokeafatty420]

I have them on a pretty tight lock down, but the internet is still accessible via tools->show related links->search new. I cannot take the internet away, b/c they need a hand full of sites.

avenger_jcc,

i b a jr. sys adm. This was a project that was given to me by the senior network administrator(s). I was just being lazy and not typing full sentences. I apologize for that. I will be more formal when posting on this board.

UpperCell,

I have searched via google and I was not able to find anything that was of any use to me, but I think that I am going to check out http://www.microsoft.com/windows/ieak/ and other 'custom shells'

thank you to all for the advice and tips

tokeafatty420

[Dr Toker]

Originally posted here by tokeafatty420
I cannot take the internet away, b/c they need a hand full of sites.

Well, have you ever thought about making those sites available offline? It's Easy as adding a favorite. Incorperate this with an intranet and you wont even need the internet at all. I dunno, just a thought.

[phishphreek]

If they need just a handful of sites, then use a proxy and restrict where they can go.

Or, block them at the firewall.. to all places except for the sites they need.

Check out this article:

http://www.linuxjournal.com/article.php?sid=6807

You can use squid (open source proxy) with squid guard (open source filter/redirect/etc).

[nihil]

I came across this a few years ago, we had IE5 and Win NT4.

There was a standard build deployed across around 14,000 desktops and multiple sites. We used a customised version of IE to do it. my involvement was to test it before deployment, and it certainly worked as far as user workgroups were concerned.

I was able to get round it by running a browser that fitted onto a 1.44" floppy but IE was pretty secure.

Some of the other suggestions are interesting though, and I shall have to take them on board.

Thanks for the thread

[SDK]

Start - run - Type "gpedit.msc" The Group Policy Windows will pop. Go under User Configuration - Windows Setting - Internet Explorer Maintenance From here, you have all kind of nice info to customizes and retrited IE. This will work for your machine also but is can be apply to Active Directory Domain with the domain group policy. Good Luck!