GPO for IE 6

Gav0

hi,

i;m studying for the 290 exam and have set up a test lab for TS to create a kind of thin client web access session.
i want to restrict access as much as poss so that you can only browse and thats it. is it possible to remove the File, Edit,View, Favorites,Tools & Help menu's from IE6 using GPO's in 2003 Server?

Thanks,

Gav

sprkymrk

Absolutely, if I understand your question correctly. Just apply GPO settings to the terminal services user account. The main ones you are looking for are in USER\Adinistrative Templates\Windows Components\Internet Explorer\Internet Control Panel.

Also just noticed these:
USER\Windows\Internet Explorer Maintenance

Gav0

Thanks for the reply.

under USER\Adinistrative Templates\Windows Components\Internet Explorer\Internet Control Panel - i can only see options for disabling the tabs under 'Internet Options' eg, General, connections etc...

is there a specific policy to remove the File, Edit, Tools menu etc. I've been looking for ages but cant find one,

thanks in advance,

Gav

sprkymrk

I see a lot of the "Toolbar" options, including what favorites they have. Check under both of my references mentioned and perhaps by experimenting you can find a useful combination.

Another option is to force "Kiosk" mode. You replace the IE shortcut/executable with a shortcut that has this command:
iexplore -k
I think that may be what you are really looking for. Try it from a run command and see. The only way to close out is CTRL+F4. You can even specify a start page (rather than the default home page) by something like this:
iexplore -k www.msn.com
Have fun!

jpeezy55

sprkymrk wrote:

Another option is to force "Kiosk" mode. You replace the IE shortcut/executable with a shortcut that has this command:
iexplore -k
I think that may be what you are really looking for. Try it from a run command and see. The only way to close out is CTRL+F4. You can even specify a start page (rather than the default home page) by something like this:
iexplore -k www.msn.com
Have fun!

Just to expand on this one, when you run iexplore -k you essentially get a full-screen explorer, but no title bar or tool bar or anything...if you have users who do not know about shortcut-keys, they will be stuck on this page. You will have to use CTRL-O to open a new box to type in an addresss of another page...however, if you have un-informed users and you want to mess with them, they won't be able to get off of whatever page you put them on. :P

sprkymrk

jpeezy55 wrote:

sprkymrk wrote:

Another option is to force "Kiosk" mode. You replace the IE shortcut/executable with a shortcut that has this command:
iexplore -k
I think that may be what you are really looking for. Try it from a run command and see. The only way to close out is CTRL+F4. You can even specify a start page (rather than the default home page) by something like this:
iexplore -k www.msn.com
Have fun!

Just to expand on this one, when you run iexplore -k you essentially get a full-screen explorer, but no title bar or tool bar or anything...if you have users who do not know about shortcut-keys, they will be stuck on this page. You will have to use CTRL-O to open a new box to type in an addresss of another page...however, if you have un-informed users and you want to mess with them, they won't be able to get off of whatever page you put them on. :P

I'm pretty sure that's what he wanted, no toolbars, file menu, etc. This is useful for an intranet where you only want user's to access links, as opposed to navigating freely. This can help keep them off external websites, especially when combined with group policy to specify a proxy server, and then remove the user's ability to change proxy settings.

jpeezy55

sprkymrk wrote:

I'm pretty sure that's what he wanted, no toolbars, file menu, etc. This is useful for an intranet where you only want user's to access links, as opposed to navigating freely. This can help keep them off external websites, especially when combined with group policy to specify a proxy server, and then remove the user's ability to change proxy settings.

Yeah, he did mention something about being able to browse, but not have the toolbars visible...he may need to look somewhere in the middle of what he has now and the -k switch...that might restrict him too much.

If you really want to get into it, you can edit the registry and turn off the features in the menu bars...they will still be visible, but when clicked on, they will display a message that the feature was disabled and you need to contact your Administrator. You can essentially shut down each menu option that way and leave others open if you want to.

: Hey Gav0, what is the reason for removing the toolbars? Are you tyring to stop users from making any Option settings changes? Or are you just curious if it can be done, just for general knowledge?

Gav0

Thanks Guys,

the iexplore -k Kiosk mode is too restricted as i do require the address bar and the forward, back & home buttons - but thanks anyway, i'd didnt know you could do that i'm sure it will come in useful!

If you have used IE7 Beta2 you will know that it defaults to not having the "classic Menu" on - which is basically everything i'm trying to get rid of on 6!

The reasons i'm asking is/doing this is we are looking into setting up a few thin client's in the canteen area of our office so people can browse the web and access Hotmail etc via TS to a standalone 2003 server with an adsl connection. As I'm studying for the 290 exam anyway i set my lab up at home as it seemed a good project for practicing GPO's and TS.

now i've started its really bugging me that I cant do it - i thought it'd be quite simple and a common requirement. It feels like cheating if i just stick IE 7 on there!

where would i find the reg keys you mention Sparky?

Danman32

If there are reg keys, there should be GPOs for it. If not you can create an admistrative template to manipulate the registry. That's essentially what GPOs do anyway.

Also there may be additional administrative templates on MS or other internet sources for IE lockdown besides what comes installed on W2K3 by default.