Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'd love to have the peace of mind of knowing that none of my desktops have toolbars, "browser helpers" or any other crap like that running.

Has anybody done this successfully with Group Policy?

I found this article, but it's not all that clear:

If I want to ban all plugins but the Google Toolbar, Flash & Windows Update on XP, there isn't a clear explanation on how to do it. It seems that I would have to know the ClassID of every toolbar I would like to allow.

The article doesn't really go into how an admin would find these ClassIDs. Does Flash have a different ClassID for each version? Does it vary by OS? What about Windows Update on XP boxes - it requires a plugin that would need to be expressly enabled.

It's such a common problem that there should be an easy solution. It would be great if there was just a checkbox list of common plugins, so you could enable Flash for everyone, Google Toolbar for devs, Windows Update for XP, etc.

share|improve this question
up vote 6 down vote accepted

Disabling the option "Enable third-party browser extensions" under Tools -> Internet Options -> Advanced (or Control Panel -> Internet Options) successfully disables most browser bars while still allowing the typical plugins (Java, Flash, etc).

If I recall correctly you can control this option in GP. Setting can be found under 'User Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> Allow third-party browser extensions'

share|improve this answer

For XP with IE6, your KB source is a workable solution.

I added the CLSID for flash (found from HTML source) and blocked it by adding it to Local Security Policy "User Configuration > Administrative Templates > Windows Components > Internet Explorer > Security Features > Add-On Management > Add-on List"

Put in the CLSID and a 0 for value (disable) and on next IE refresh, Flash wouldn't load.

Sounds like adding a list of the most common offenders to a GPO would take care of most of your issues.

share|improve this answer

I have the same questions you do in regards to ClassID's possibly changing when javascript & flash are upgraded.

Anyhow in the process of trying to find more info on this I figured out in IE9 you can select an add-on & hit 'More Information' in the bottom-left'ish & it gives you the Class ID. I confirmed IE6 doesn't have this. I don't have any IE7 or 8's available to test currently. However the microsoft article DOES show you how to find the Class ID's that were blocked in the section 'Troubleshooting the Manage Add-ons feature'. Sadly it doesn't look like a quick job, will take some research

share|improve this answer

First of all, there is a solvable javascript problem with disabled add-ons:

There is the ToolbarCop which makes the disabling task easier - it's not a checkbox solution, but it's close.

If you want to do it by hand, you can learn the CLSIDs here.

share|improve this answer

You mention XP. Is this just a solution for XP?

For Windows 7 Applocker GPO can help. It's a application whitelist and blacklisting feature in Group Policy (but only works for Windows 7 clients).

There's some good intro videos from TechEd (search that site for more Applocker vids).

The quick and dirty (but not comprehensive) way is to allow everything and add deny rules for what you want to block. The more comprehensive way is to make a white list of all apps on all your computers (not just IE). If you do quick and dirty, create a new GPO and enable tracking of exe and dll and find the most common browser add-on's on your machine's that you don't want and add them with a deny rule.

You can try all sorts of ways to block them... like blocking the install via publisher cert (i.e. block all apps from yahoo), blocking file paths of where it puts the installs, etc.

While testing I recommend using the Local Security Policy. Ensure Application Identity service is running (then wait 5min).

Just to see how it would react, I added a deny rule to block all DLL's in %SYSTEM32%\Macromed\Flash*.* and IE acted gracefully as if Flash was never installed.

share|improve this answer

There is a setting in Group Policity that allows you to deny all add-ons unless specifically allowed. Can be found here: 'User Configuration -> Policies -> Administrative Templates -> Windows Components -> Internet Explorer -> Security Features -> Add-on Management'

Enable the 'Deny all add-ons..' option and then just ad the ones you want to keep in the 'Add-on List' option

share|improve this answer

Problem seems to be as soon as you add a white-list, EVERYTHING is disabled except what is in there. Java. Flash. Etc. I was hoping to find a list of common extensions, but so far it is a LOT of work to use a white-list.

share|improve this answer
This post does not seem to address the OP's question, regarding use of a Group Policy for whitelisting. Could you edit this to make it more related to the question? – Castaglia Mar 11 at 20:28

There is a good explanation with pictures and video here on how to set it up:

share|improve this answer
It's expected that you actually provide information in your answers, not simply point someone to a link. Very bad form. – Magellan Feb 1 '12 at 17:27

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.