1

In light of the recently discovered MSHTML vulnerability (and because it's a good idea in general), I want to disallow downloading of ActiveX components via group policy. However, it appears that my policy settings are ignored.

Here's my group policy setting:

Group Policy Settings

Then I refresh the group policy on my client PC (in a non-elevated shell, since this is a user policy):

C:\Users\{redacted}>gpupdate /force
Updating policy...

Computer Policy update has completed successfully.
User Policy update has completed successfully.

Yet IE seems to ignore my new settings:

IE settings

I'm sure I'm overlooking something obvious. What is it?

5
  • What is the Security Filtering of the GPO set to?
    – joeqwerty
    Sep 8 at 13:17
  • @joeqwerty: It's kept at the default value, "Authenticated Users".
    – Heinzi
    Sep 8 at 13:20
  • 2
    Can you generate a gpresult report and take a look at it, see if you can see your policy?
    – Swisstone
    Sep 8 at 17:44
  • I believe for IE10+, it may be preferrable/more modern to use Preferences > Control Panel Settings > Internet Settings > right-click > New > Internet Explorer 10.
    – Greg Askew
    Sep 8 at 17:52
  • @Swisstone: Thanks, the output of gpresult /Z helped me find the root cause. I'll write a self-answer with the details.
    – Heinzi
    Sep 9 at 7:53
2

You disabled the policy setting. This means that the group policy setting is not applied.

What you need to do instead is to enable the policy setting and then configure the policy setting to disabled. In other words, instead of this:

wrong

you should do that:

correct

You can also see the difference in the summary view. This is wrong:

wrong-summary

And this is correct:

correct-summary


Unfortunately, the name of the setting (which needs to be enabled) and the name of the option inside the setting (which needs to be disabled) are exactly the same, which makes such an error easy to overlook. As @Swisstone mentioned in the comments, gpresult can help here. This is the output of gpresult /Z (/Z for super-verbose) in the "wrong" case:

GPO: Internet Explorer
    Folder Id: Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1001
    State:       disabled

And this in the correct case:

GPO: Internet Explorer
    Folder Id: Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\1001
    Value:       3, 0, 0, 0
    State:       Enabled

The latter entry sets this registry value to dword:00000003, which is your intended result. Note that IE respects this setting now:

IE

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.