Re: GPO to prevent IE, OE, and Address Book menu items?

Cool!

Now that you are an expert on Just-In-Time setup, you get to become an expert on security zone settings.

Let's break this down into smaller chunks so we can figure out what is happening.

* Determine the Zone *

First thing we need to determine is what security zone the shortcuts are actually running in. Log on as a problem user, and open up Internet Explorer.

In the Address box, type in the path to where the shortcut is located, not including the shortcut file name. For example, if my shortcut is located at S:\, I would type S:\ in the address field and press enter.

Make sure the status bar is turned on by using the View menu if necessary. Look down at the lower right corner of the IE status bar and read the zone. In my case it says Local Intranet, because S: is located on a server that I have defined as part of the Local Intranet.

Does yours say Local Intranet? If not, you need to fix this first by adding the UNC path to the list of Local Intranet Sites. We are fixing a single user at the moment, but later we can change the settings for all users using Group Policy.

This is what Vera's FAQ you referred to explains how to do, so I will not cover this (unless you need me to go over it in more depth, or are having problems).

* Check Security Settings *

Above we made sure that the path to our shortcut is in the Local Intranet Zone. The second thing we need to do is check the relevant security settings to make sure they are correct.

For your particular issue, the security setting we are concerned with is called "Launching applications and unsafe files". To check this setting for the Local Intranet Zone, follow these steps:

Open up Internet Options from the control panel
On the Security tab, single-click Local Intranet
Click on the Custom Level button
Begin typing the phrase launching...
Launching applications and unsafe files should be selected

What is it set at?

If you do not want the user to be prompted, you should choose Enable.

After saving the above changes, retry double-clicking the shortcut.

* Setting for All Users via Group Policy *

This is set on the Group Policy object for the users. The setting is under:

User Config\Windows Settings\IE\Security\Security Zones

-TP

Gregg Hill wrote:
I Googled and found Vera's suggestion to add \\servername to the Local
Intranet zone, which I did, with no change in behavior.

Gregg Hill


.