Hot answers tagged

38

Keep in mind that while you may not directly use IE, the IE rendering engine or other components may be used by other applications you may run. I think it should kept it up to date.


19

Go to Server Manager > Configure IE ESC (under Security Information) and disable Internet Explorer Enhanced Configuration for administrators. Alternatively (and probably safer) is to either download from a workstation and save it to a share on the server or add the site in question to the trusted sites temporarily/permanently, depending on how often ...


12

I would be really pushing the increased security in both IE7 and IE8. Pop-up blocking, phishing filters etc... IE6 is one of the biggest entry point for malware onto a Windows system. You can reduce a lot of this by leaving IE6


11

Solved it (finally). http://support.microsoft.com/kb/838028 explains how Office uses Microsoft Office Protocol Discovery to determine if the document server has WebDAV capabilities. It sends a HTTP 1.1 OPTIONS request and expects a 200 OK reply detailing available DAV features. The Subversion server has (limited) DAV support and replies as such, and Office ...


11

Excellent question. Ironically, this very functionality was exposed in the older Microsoft JVM (10 years ago). Controlling Java in Internet Explorer https://blogs.msdn.com/b/ieinternals/archive/2011/05/15/controlling-java-in-internet-explorer.aspx Recently, there’s been some interest in how to control the use of Java within Internet Explorer. Java is a ...


11

There are a few different ways to do it. Do you want to force everyone's home page, and disallow changes? Or do you just want to set a default home page that people can modify? If you want to force a home page: (Do what HopelessN00b said) Create a new GPO or edit the existing one. (I'm assuming you know how to do this already. Let me know if you ...


10

Highlight the security risks that it exposes. Calculate how much damage can be done to the network through a malware attack that gets in through someone's IE6 install. Calculate how much extra time you spend on support handling user questions related to IE6 issues, and how much extra dev work is needed to accommodate the users. Put a yearly dollar range on ...


10

Definitely. If you have it installed, I'd rather run a more the most up-to-date version regarding security. Featurewise it's a moot point, but I'd rather not have admins browsing around in IE6 on my servers. Optimally noone uses IE on servers, but we know sh** happens.


9

A 64-bit version of Internet Explorer is available for 64-bit versions of Windows Vista/7. Nobody uses it, primarily because plug-in developers cough Adobe, specifically Flash cough will not bother writing a 64-bit version of their plug-ins, and who will browse the net if YouTube doesn't work? ;) It would work fine for opening large HTML files however. ...


9

The only proper way of disabling browser caching is by HTTP headers from the webapp itself. The HTTP 1.1 "Cache-Control" header alone should suffice for any post-year-2000 browser. But for extra protection the server can emit both HTTP 1.1 "Cache-Control" and HTTP 1.0 "Expires" headers together. A hack'ish but sometimes seen way of handling cache ...


8

I think that you can try and use Software Restriction Policies (SRP) and deny access to "Program Files\Internet Explorer\iexplore.exe" to restrict IE. Also if you have Win2008 R2 as a DC and all of your clients have Win7, then you can use the new feature that is similar to SRP but much better and it is called AppLocker, which can also be found on the list ...


8

I know of this NTLM work around for Firefox, but I am uncertain about the other browsers. 1) Open Firefox and type “about:config” in the address bar. (without the quotes of course) 2) In the ‘Filter’ field type the following “network.automatic-ntlm-auth.trusted-uris” 3) Double click the name of the preference that we just searched for 4) Enter the URLs ...


8

The biggest one I hear is testing legacy code against a new version. With so many companies having internal web applications which they haven't touched for a while, they often site system instability and the high cost with testing all the production systems against a new version. It's also difficult to get any large organization to do anything faster than ...


8

You can't access 127.0.0.1 from a remote Pc. It's your local computer.


7

My form is 7 pages long but only prints 1 page in Internet Explorer. I resolved this issue by removing a style "position:absolute" from one of my DIV tags. I think this issue is related to absolute positioning of elements in your HTML page. After I made the change the page prints correctly. I hope this helps!


7

KB836941 suggests these addresses: http://*update.microsoft.com https://*update.microsoft.com http://download.windowsupdate.com Better still: http://*.microsoft.com http://*.windowsupdate.com


7

No, you cannot control FF via GPO (without an add-on or script) or update via WSUS. You may be able to push patches with SCCM, but that would be overkill if you don't have it in your environment. In short, unless you have an explicit need for FF, or something is totally incompatible with IE in your environment, stick with IE if you want ease of updates.


7

Just figured this out -- I forgot to give the subdomain its own IP address. More info: http://nginx.org/en/docs/http/configuring_https_servers.html#sni http://en.wikipedia.org/wiki/Server_Name_Indication


7

donL, So I was curious enough about this one to research it out. I don't have a 2003 server environment to test on, so it was up to "Google Fu" to check into this. Turns out it is a "bug" in the GUI. The policy you applied did work correctly, it just doesn't show up correctly in IE's GUI on the client. Stupid, yes...but true. Here's an example accepted ...


7

So it turns out that in Plesk 11.0 it isn't enough to assign an SSL cert with a website on a dedicated IP address. You also have to go to the list of IP addresses (Server Management > Tools and Settings > Tools & Resources > IP Addresses) and set the "Default site" for each IP address to be the site on that address. If you don't do that, Plesk serves ...


6

Do it properly, and don't use the server's browser to download software. You download software from a workstation, either "directly" to the server in question by saving to a shared folder on the server, or you download it onto your workstation and then transfer the file over. Shared folders, copy and paste through an RDP session, USB drive, or any other ...


6

Yes, temporarily disabling Update Rollups is the way to do it. You won't really be missing out on anything - it will still download the update rollups metadata, it just won't automatically approve them. Once the IE9 metadata has downloaded to your WSUS server, you can switch the auto-approval of update rollups back on if you so desire (personally the only ...


6

The only information I've been able to find on this error is from Josh Poley's MSDN blog. 1190 0x800704A6 A system shutdown has already been scheduled. ERROR_SHUTDOWN_IS_SCHEDULED However, the message implies that you get this when trying to schedule a shutdown. The only thing I can think of is that an installation/Windows update is waiting for a ...


6

You can't. Two-factor authentication with one-time passwords (OTPs?) would be the first requirement, as your keystrokes and login procedure no doubt will be recorded. This would make it harder for an attacker to reuse anything another time... ...however even if you then establish an encrypted tunnel - there is of course nothing preventing all the ...


5

Someone else (person or application) might use it, now or in the future - so keep the patch level of all installed applications as recent as possible at all times.


5

You should familiriaze yourself with the notion of routing and use the route command.


5

IE settings are located in the registry. So if you prepare .reg files for the user, he can import the new settings just by double-clicking on the files. Here are some articles that can get you started: How can I manage Internet Explorer Security Zones via the registry Internet Explorer Restriction Internet Explorer security zones registry entries for ...


5

You'll want to push these out through Group Policy. In GPME, User Configuration/Windows Settings/Internet Explorer Maintenance are some options for security and URL options. In User Configuration/Administrative Templates/Windows Components/Internet Explorer are more settings that you can customize. Since you didn't specify what level domain you're in, ...


5

Disabling the option "Enable third-party browser extensions" under Tools -> Internet Options -> Advanced (or Control Panel -> Internet Options) successfully disables most browser bars while still allowing the typical plugins (Java, Flash, etc). If I recall correctly you can control this option in GP. Setting can be found under 'User Configuration -> ...



Only top voted, non community-wiki answers of a minimum length are eligible