Lockdown Internet Explorer for Web Applications Publishing > CitrixTools.Net > Citrix Tools

Current Articles | Archives | Search

Saturday, August 29, 2009

Lockdown Internet Explorer for Web Applications Publishing
By Pierre Marmignon @ 8:39 PM :: 5088 Views :: 2 Comments ::

:: XenApp, Terminal Server, Tech Tips

That's a fact, XenApp is ALSO mainly use to deploy Rich Web Applications and not only for rich client one.

When you deploy such applications, you may not want users to be able to use the published Internet Explorer to surf the web or be able to access other informations.

To do so, many policies exists, but there are also some "hidden" settings, not present in standard policies but only within specific KB.

Having to deal with such cases, I've created a little custom ADM that is managing Internet Explorer Lockdown.

This ADM wil allow you to :

Disable 'Mail and News' Menu from Internet Explorer
Disable Internet Explorer Address Bar
Disable Windows Update in Internet Explorer Tools Menu
Disable Internet Explorer Toolbar
Disable Internet Explorer Toolbar Options
Disable Internet Explorer 'Favorites' Menu
Disable Search from Internet Explorer
Disable Open item from Internet Explorer File Menu
Disable New File Item from Internet Explorer File Menu
Disable Save As Option in Internet Explorer Download Dialog Box
Disable Internet Explorer 'Links' Menu
Disable Internet Explorer 'Help' Menu
Disable Internet Explorer Options
Disable 'Save As' from Internet Explorer File Menu
Prevent Internet Explorer Exit (Be careful with this one because users won't be able to exit !)
Disable 'Tip of the Day' from Internet Explorer 'Help' Menu
Disable 'For Netscape Users' from Internet Explorer 'Help' Menu
Disable 'Tutorial' from Internet Explorer 'Help' Menu
Disable 'Feedback' from Internet Explorer 'Help' Menu
Disable Printing from Internet Explorer
Disable Media Bar command on the Internet Explorer Toolbar
Disables F11 key (Internet Explorer full-screen mode)
Disable Internet Explorer Context Menu
Disable Internet Explorer 'View Source' Option
Prevent Users to Open a New Internet Explorer Windows (CTRL + N)
Force Internet Explorer to Always Prompt when Download
Disable Internet Explorer Nav Buttons
Disable Internet Explorer Online Media Streaming

As some settings are working together, please check the following Microsoft Knowledge Base KB for more details.

You can Download the ADM File or simply cut and paste the following content in an .adm file.

As the ADM File is embedded within this article, you also have the detail of all reg values in case you'd to use them within a script.

Please note that this ADM is dealing with Users values but that the same values are also useable for MACHINE policies or scripts.

------------------------------------------------------------------------------------------

CLASS MACHINE
CLASS USER
   CATEGORY "CitrixTools"
        CATEGORY "Internet Explorer"
            POLICY "Disable 'Mail and News' Menu from Internet Explorer"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "RestGoMenu"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Internet Explorer Address Bar"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions"
            VALUENAME "NoAddressBar"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Windows Update in Internet Explorer Tools Menu"
            KEYNAME "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer"
            VALUENAME "NoWindowsUpdate"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Internet Explorer Toolbar"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions"
            VALUENAME "NoToolBar"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Internet Explorer Toolbar Options"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions"
            VALUENAME "NoToolBarOptions"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Internet Explorer 'Favorites' Menu"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoFavorites"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Search from Internet Explorer"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoFindFiles"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Open item from Internet Explorer File Menu"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoFileOpen"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable New File Item from Internet Explorer File Menu"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoFileNew"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Save As Option in Internet Explorer Download Dialog Box"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoSelectDownloadDir"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Internet Explorer 'Links' Menu"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions"
            VALUENAME "NoLinksBar"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Internet Explorer 'Help' Menu"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoHelpMenu"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Internet Explorer Options"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoBrowserOptions"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable 'Save As' from Internet Explorer File Menu"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoBrowserSaveAs"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Prevent Internet Explorer Exit"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoBrowserClose"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable 'Tip of the Day' from Internet Explorer 'Help' Menu"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoHelpItemTipOfTheDay"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable 'For Netscape Users' from Internet Explorer 'Help' Menu"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoHelpItemNetscapeHelp"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable 'Tutorial' from Internet Explorer 'Help' Menu"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoHelpItemTutorial"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable 'Feedback' from Internet Explorer 'Help' Menu"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoHelpItemSendFeedback"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Printing from Internet Explorer"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoPrinting"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Media Bar command on the Internet Explorer Toolbar"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "No_LaunchMediaBar"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disables F11 key (Internet Explorer full-screen mode)"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoTheaterMode"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Internet Explorer Context Menu"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoBrowserContextMenu"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Internet Explorer 'View Source' Option"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoViewSource"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Prevent Users to Open a New Internet Explorer Windows"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoOpeninNewWnd"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Force Internet Explorer to Always Prompt when Download"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "AlwaysPromptWhenDownload"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Internet Explorer Nav Buttons"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "NoNavButtons"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            POLICY "Disable Internet Explorer Online Media Streaming"
            KEYNAME "SOFTWARE\Policies\Microsoft\Internet Explorer\Restrictions"
            VALUENAME "No_MediaBarOnlineContent"
            VALUEON NUMERIC 1
            VALUEOFF NUMERIC 0
            END POLICY
            END CATEGORY
   END CATEGORY

------------------------------------------------------------------------------------------

Share on Twitter

Retweet this Article

Comments

# gary

Wednesday, March 31, 2010 5:08 PM

This article was very informative. I would like to download the adm file. unfortunately i'm not able to.

# Thomas Weiß

Wednesday, April 28, 2010 8:09 AM

Its a lot of work to deactivate surfing for the users. I took the short road and just set the proxy via gpo into the void and made it read-only.

Different approach, but very effective :-)

Only registered users may post comments.