How to set IE 8 Blocker policy

  • Artigo

Hi everyone!

Axel Rivera again with another blog that provides a step by step instruction on how to implement the new IE 8 Blocker Policy.

Here are the steps to setup the IE8 Blocker Policy.

  1. Download the Toolkit to Disable Automatic Delivery of Internet Explorer 8
  2. Once you download the Toolkit, run the IE8BlockerToolkit.EXE. It will extract 4 files
    1. IE80Blocker.adm
    2. IE80Blocker.cmd
    3. IE80BlockerHelp.htm
    4. IE80BlockerHelp-GPFilteringDialog.jpg

Now, let's setup the IE8 Blocker Template (IE80Blocker.adm)

NOTE: I am using local Group Policy Editor to illustrate how to load the policy. Domain administrators should be familiar with the GPMC Console to perform the same task on Enterprise environments. GPMC is not a built-in part of Windows 2000/XP/2003, and needs to be separately installed. You can download GPMC from the following link (Download GPMC). If you do not have GPMC or cannot install it then you'll need to edit the GPO via the regular means, i.e. from Active Directory Users and Computers management tool (dsa.msc).

To complete this procedure, you must be logged on as a member of the Domain Administrators security group, the Enterprise Administrators security group, Local administrator, or the Group Policy Creator Owners security group.

1) From start\Run type: GPEDIT.MSC and then hit the Enter key to open the Group Policy Editor.

2) Navigate to Computer Configuration > Administrative Templates. Right click on Administrative Templates and click Add/Remove Templates.

clip_image002

3) Click on the Add button and then browse to the location where you extracted the IE8BlockerToolkit.EXE files. Click on the IE80Blocker.adm to load the template and then hit close.

clip_image004

Next image, you can see the IE80Blocker template is added. Now click on the Close button.

clip_image006

4) After adding this administrative template to the Group Policy Editor, you must clear the “Only show policy settings that can be fully managed” option in the Filtering dialog box before the new policy becomes visible in the Group Policy Editor. This option is found by highlighting Administrative Templates, selecting View, and then selecting Filtering.

Here you can see how it looks like when first installed:

clip_image007

Setting the filter:

clip_image009

Uncheckthe “Only show policy settings that can be fully managed” and click OK

clip_image010

5) From the left hand tree, find the newly added template: Computer Configuration / Administrative Templates / Windows Components / Windows Update / Automatic Updates Blockers v2

clip_image012

6) Here is how the policy UI looks like:

clip_image014

7) Here is the registry key location and value when policy is Enabled:

Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\8.0

Key value name: DoNotAllowIE80

Value

Result

Key is not defined

Distribution is not blocked.

0

Distribution is not blocked.

1

Distribution is blocked.

Screenshot:

clip_image015

 

To remove the template:

  1. Navigate to Computer Configuration > Administrative Templates. Right click on Administrative Templates and click Add/Remove Templates.
  2. Choose IE80Blocker from the list and click on Remove.

Important:

This registry setting is not stored in a policies key and is thus considered a preference. Therefore if the Group Policy Object that implements the setting is ever removed or the policy is set to Not Configured, the setting will remain. To unblock distribution of Internet Explorer 8 by using Group Policy, set the policy to Disabled.

Note:

  • To complete this procedure, you must be logged on as a member of the Domain Administrators security group, the Enterprise Administrators security group, or the Group Policy Creator Owners security group.
  • To remove a template, in the Current Policy Templates list, click the template, and then click Remove.
  • Users running Windows Vista or Windows Server 2008 will see the policy setting under Computer Configuration / Administrative Templates / Classic Administrative Templates (ADM) / Windows Components / Windows Update / Automatic Updates Blockers v2.
  • This setting is available only as a Computer setting; there is no Per-User setting.

We strongly recommend if you are using WSUS or SMS to review the Frequently Asked Questions

Related Articles:

Using and trouble-shooting the IE 8 Blocker Toolkit

IE9 Blocker Toolkit Related Articles:

Comments

  • Anonymous
    July 09, 2009
    Hi, I applied exactly as a description above. After I ran gpupdate /force on client machine, the group policy objects was not applied because they were filtered out. I applied it to Computer Configurations. What can be wrong?

  • Anonymous
    July 10, 2009
    This is a Computer policy. You may have to reboot the client or make sure you log off and log back in.You can also look under the registry key (hklm) and validate that the key was written, which is all you really need to worry about.The policy works, if you are doing extra configuration with your policies, that could be interfering with this one, you may want to call MS Support for further assistance.KEYNAME "SOFTWAREMicrosoftInternet ExplorerSetup8.0"               VALUENAME "DoNotAllowIE80"               VALUEON  NUMERIC 1               VALUEOFF NUMERIC 0Hope this helps!The IE Team

  • Anonymous
    December 15, 2011
    Question was asked if the registry key can be added instead of the policy.Answer is, Yes, you can merge the registry keySample below:Windows Registry Editor Version 5.00[HKEY_LOCAL_MACHINESOFTWAREMicrosoftInternet ExplorerSetup8.0]"DoNotAllowIE80"=dword:00000001