| Author | Messages | |
stecrompton
Posts:0
 | | 01/30/2009 4:40 AM |
|
Hi Guys
Ive come across a strange problem whilst configuring IE settings via GPO...
I want to disable the "allow paste operations via script" setting for the INTERNET Zone which seems to work well, however, i still want this setting to be available for the TRUSTED Zone, so i have enabled it for this zone. Problem is, users now cannot use "allow paste operations via script" even if there URL is added to the zone assignment list for trusted sites. Only works if i enable this setting for the Internet zone ! it almost looks like the trused zone setting is be overided with the internet zone setting, if that makes sense.
Any help with this greatly appreciated.
Thanks
_________________________________________________________________
Love Hotmail? Check out the new services from Windows Live!
http://clk.atdmt.com/UKM/go/132630768/direct/01/
| | | |
| stecrompton
Posts:0
| | 01/30/2009 10:57 AM |
|
Yes, the site is appearing within trusted sites, i can see this as you say, in the right hand corner. I have set this within the admin template not the maintenance policy.
I first thought that the internet zone were i have it set to disabled is causin this but not sure. Im stumped !
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 09:45:32 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Are you sure the site is actually being assigned to the proper zone? Have you verified this in lower right corner of the IE window? How are you defining the setting…IE Maintenance Policy or Admin Templates?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 3:34 AMTo: gptalk@lists.gpoguy.comSubject: [gptalk] IE Setting
Hi Guys Ive come across a strange problem whilst configuring IE settings via GPO... I want to disable the "allow paste operations via script" setting for the INTERNET Zone which seems to work well, however, i still want this setting to be available for the TRUSTED Zone, so i have enabled it for this zone. Problem is, users now cannot use "allow paste operations via script" even if there URL is added to the zone assignment list for trusted sites. Only works if i enable this setting for the Internet zone ! it almost looks like the trused zone setting is be overided with the internet zone setting, if that makes sense. Any help with this greatly appreciated. Thanks
Windows Live Hotmail just got better. Find out more!
Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of all or any portion of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system.
_________________________________________________________________
Twice the fun—Share photos while you chat with Windows Live Messenger. Learn more.
http://www.microsoft.com/uk/windows/windowslive/products/messenger.aspx
| | | |
| JamieNelson
Posts:0
| | 01/30/2009 11:03 AM |
| Strange, the only thing I can think is that maybe you have some kind of
other policy floating around overriding that setting. Have you run a
Resultant Set of Policy (RSoP) to verify that the setting is correct on
the client and coming from the right GPO? You can do this through the GP
Results Wizard in GPMC and get a nice report view of what's being
applied.
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 9:50 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Yes, the site is appearing within trusted sites, i can see this as you
say, in the right hand corner. I have set this within the admin template
not the maintenance policy.
I first thought that the internet zone were i have it set to disabled is
causin this but not sure. Im stumped !
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 09:45:32 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Are you sure the site is actually being assigned to the proper zone?
Have you verified this in lower right corner of the IE window? How are
you defining the setting...IE Maintenance Policy or Admin Templates?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 3:34 AM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] IE Setting
Hi Guys
Ive come across a strange problem whilst configuring IE settings via
GPO...
I want to disable the "allow paste operations via script" setting for
the INTERNET Zone which seems to work well, however, i still want this
setting to be available for the TRUSTED Zone, so i have enabled it for
this zone. Problem is, users now cannot use "allow paste operations via
script" even if there URL is added to the zone assignment list for
trusted sites. Only works if i enable this setting for the Internet zone
! it almost looks like the trused zone setting is be overided with the
internet zone setting, if that makes sense.
Any help with this greatly appreciated.
Thanks
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
________________________________
Confidentiality Warning: This message and any attachments are intended
only for the use of the intended recipient(s), are confidential, and may
be privileged. If you are not the intended recipient, you are hereby
notified that any review, retransmission, conversion to hard copy,
copying, circulation or other use of all or any portion of this message
and any attachments is strictly prohibited. If you are not the intended
recipient, please notify the sender immediately by return e-mail, and
delete this message and any attachments from your system.
________________________________
Share your photos with Windows Live Photos - Free Find out more!
<http://clk.atdmt.com/UKM/go/132630768/direct/01/>
| | | |
| stecrompton
Posts:0
| | 01/30/2009 11:08 AM |
|
Yes Jamie, first thing i checked, gpo was being applied. One for the Internet Zone which is disabled and one for the Trusted Zone which was enabled.
Only works if i enable this setting within the Internet Zone. It is indeed strange.
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 09:59:28 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Strange, the only thing I can think is that maybe you have some kind of other policy floating around overriding that setting. Have you run a Resultant Set of Policy (RSoP) to verify that the setting is correct on the client and coming from the right GPO? You can do this through the GP Results Wizard in GPMC and get a nice report view of what’s being applied.
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 9:50 AMTo: GPO GUYSubject: RE: [gptalk] IE Setting
Yes, the site is appearing within trusted sites, i can see this as you say, in the right hand corner. I have set this within the admin template not the maintenance policy. I first thought that the internet zone were i have it set to disabled is causin this but not sure. Im stumped !
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 09:45:32 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Are you sure the site is actually being assigned to the proper zone? Have you verified this in lower right corner of the IE window? How are you defining the setting…IE Maintenance Policy or Admin Templates?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 3:34 AMTo: gptalk@lists.gpoguy.comSubject: [gptalk] IE Setting
Hi Guys Ive come across a strange problem whilst configuring IE settings via GPO... I want to disable the "allow paste operations via script" setting for the INTERNET Zone which seems to work well, however, i still want this setting to be available for the TRUSTED Zone, so i have enabled it for this zone. Problem is, users now cannot use "allow paste operations via script" even if there URL is added to the zone assignment list for trusted sites. Only works if i enable this setting for the Internet zone ! it almost looks like the trused zone setting is be overided with the internet zone setting, if that makes sense. Any help with this greatly appreciated. Thanks
Windows Live Hotmail just got better. Find out more!
Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of all or any portion of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system.
Share your photos with Windows Live Photos – Free Find out more!
_________________________________________________________________
Love Hotmail? Check out the new services from Windows Live!
http://clk.atdmt.com/UKM/go/132630768/direct/01/
| | | |
| JamieNelson
Posts:0
| | 01/30/2009 11:21 AM |
| Are you doing this in user policy or computer policy (with Admin
Templates you have a choice)? Have you tried do all of your zone
security settings in one GPO instead of breaking it up into multiple
ones?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 10:04 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Yes Jamie, first thing i checked, gpo was being applied. One for the
Internet Zone which is disabled and one for the Trusted Zone which was
enabled.
Only works if i enable this setting within the Internet Zone. It is
indeed strange.
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 09:59:28 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Strange, the only thing I can think is that maybe you have some kind of
other policy floating around overriding that setting. Have you run a
Resultant Set of Policy (RSoP) to verify that the setting is correct on
the client and coming from the right GPO? You can do this through the GP
Results Wizard in GPMC and get a nice report view of what's being
applied.
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 9:50 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Yes, the site is appearing within trusted sites, i can see this as you
say, in the right hand corner. I have set this within the admin template
not the maintenance policy.
I first thought that the internet zone were i have it set to disabled is
causin this but not sure. Im stumped !
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 09:45:32 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Are you sure the site is actually being assigned to the proper zone?
Have you verified this in lower right corner of the IE window? How are
you defining the setting...IE Maintenance Policy or Admin Templates?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 3:34 AM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] IE Setting
Hi Guys
Ive come across a strange problem whilst configuring IE settings via
GPO...
I want to disable the "allow paste operations via script" setting for
the INTERNET Zone which seems to work well, however, i still want this
setting to be available for the TRUSTED Zone, so i have enabled it for
this zone. Problem is, users now cannot use "allow paste operations via
script" even if there URL is added to the zone assignment list for
trusted sites. Only works if i enable this setting for the Internet zone
! it almost looks like the trused zone setting is be overided with the
internet zone setting, if that makes sense.
Any help with this greatly appreciated.
Thanks
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
________________________________
Confidentiality Warning: This message and any attachments are intended
only for the use of the intended recipient(s), are confidential, and may
be privileged. If you are not the intended recipient, you are hereby
notified that any review, retransmission, conversion to hard copy,
copying, circulation or other use of all or any portion of this message
and any attachments is strictly prohibited. If you are not the intended
recipient, please notify the sender immediately by return e-mail, and
delete this message and any attachments from your system.
________________________________
Share your photos with Windows Live Photos - Free Find out more!
<http://clk.atdmt.com/UKM/go/132630768/direct/01/>
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
| | | |
| stecrompton
Posts:0
| | 01/30/2009 11:30 AM |
|
User setting only.
All settings under one GPO accept the zone to site assignments are in a seperate GPO (enforced) which is applied before the one which contains the zone settings.
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 10:15:59 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Are you doing this in user policy or computer policy (with Admin Templates you have a choice)? Have you tried do all of your zone security settings in one GPO instead of breaking it up into multiple ones?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 10:04 AMTo: GPO GUYSubject: RE: [gptalk] IE Setting
Yes Jamie, first thing i checked, gpo was being applied. One for the Internet Zone which is disabled and one for the Trusted Zone which was enabled.Only works if i enable this setting within the Internet Zone. It is indeed strange.
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 09:59:28 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Strange, the only thing I can think is that maybe you have some kind of other policy floating around overriding that setting. Have you run a Resultant Set of Policy (RSoP) to verify that the setting is correct on the client and coming from the right GPO? You can do this through the GP Results Wizard in GPMC and get a nice report view of what’s being applied.
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 9:50 AMTo: GPO GUYSubject: RE: [gptalk] IE Setting
Yes, the site is appearing within trusted sites, i can see this as you say, in the right hand corner. I have set this within the admin template not the maintenance policy. I first thought that the internet zone were i have it set to disabled is causin this but not sure. Im stumped !
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 09:45:32 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Are you sure the site is actually being assigned to the proper zone? Have you verified this in lower right corner of the IE window? How are you defining the setting…IE Maintenance Policy or Admin Templates?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 3:34 AMTo: gptalk@lists.gpoguy.comSubject: [gptalk] IE Setting
Hi Guys Ive come across a strange problem whilst configuring IE settings via GPO... I want to disable the "allow paste operations via script" setting for the INTERNET Zone which seems to work well, however, i still want this setting to be available for the TRUSTED Zone, so i have enabled it for this zone. Problem is, users now cannot use "allow paste operations via script" even if there URL is added to the zone assignment list for trusted sites. Only works if i enable this setting for the Internet zone ! it almost looks like the trused zone setting is be overided with the internet zone setting, if that makes sense. Any help with this greatly appreciated. Thanks
Windows Live Hotmail just got better. Find out more!
Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of all or any portion of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system.
Share your photos with Windows Live Photos – Free Find out more!
Windows Live Hotmail just got better. Find out more!
_________________________________________________________________
Hotmail, Messenger, Photos and more - all with the new Windows Live. Get started!
http://www.download.live.com/
| | | |
| stecrompton
Posts:0
| | 01/30/2009 11:52 AM |
|
Havent tried a single GPO for this but i would of thought it would all tie together unless there was a confliction ? (in this case, no confliction)
From: xxxxxxxxxxxxxxxx: gptalk@lists.gpoguy.comSubject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 16:24:25 +0000
User setting only.All settings under one GPO accept the zone to site assignments are in a seperate GPO (enforced) which is applied before the one which contains the zone settings.
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 10:15:59 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Are you doing this in user policy or computer policy (with Admin Templates you have a choice)? Have you tried do all of your zone security settings in one GPO instead of breaking it up into multiple ones?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 10:04 AMTo: GPO GUYSubject: RE: [gptalk] IE Setting
Yes Jamie, first thing i checked, gpo was being applied. One for the Internet Zone which is disabled and one for the Trusted Zone which was enabled.Only works if i enable this setting within the Internet Zone. It is indeed strange.
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 09:59:28 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Strange, the only thing I can think is that maybe you have some kind of other policy floating around overriding that setting. Have you run a Resultant Set of Policy (RSoP) to verify that the setting is correct on the client and coming from the right GPO? You can do this through the GP Results Wizard in GPMC and get a nice report view of what’s being applied.
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 9:50 AMTo: GPO GUYSubject: RE: [gptalk] IE Setting
Yes, the site is appearing within trusted sites, i can see this as you say, in the right hand corner. I have set this within the admin template not the maintenance policy. I first thought that the internet zone were i have it set to disabled is causin this but not sure. Im stumped !
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 09:45:32 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Are you sure the site is actually being assigned to the proper zone? Have you verified this in lower right corner of the IE window? How are you defining the setting…IE Maintenance Policy or Admin Templates?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 3:34 AMTo: gptalk@lists.gpoguy.comSubject: [gptalk] IE Setting
Hi Guys Ive come across a strange problem whilst configuring IE settings via GPO... I want to disable the "allow paste operations via script" setting for the INTERNET Zone which seems to work well, however, i still want this setting to be available for the TRUSTED Zone, so i have enabled it for this zone. Problem is, users now cannot use "allow paste operations via script" even if there URL is added to the zone assignment list for trusted sites. Only works if i enable this setting for the Internet zone ! it almost looks like the trused zone setting is be overided with the internet zone setting, if that makes sense. Any help with this greatly appreciated. Thanks
Windows Live Hotmail just got better. Find out more!
Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of all or any portion of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system.
Share your photos with Windows Live Photos – Free Find out more!
Windows Live Hotmail just got better. Find out more!
Windows Live Hotmail just got better. Find out more!
_________________________________________________________________
Check out the new and improved services from Windows Live. Learn more!
http://clk.atdmt.com/UKM/go/132630768/direct/01/
| | | |
| Darren
Posts:103
| | 01/30/2009 1:25 PM |
| Yes, there would only be a problem if settings were in conflict. One
possibility is that IE is simply busted here. As a test, can you try setting
this through IE Maintenance policy rather than Admin. Templates on one or
two machines to see if it makes any difference. That would at least rule out
a policy issue if that still doesn't work, and point to some problem with
the way IE reads and interprets the policy.
Darren
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 10:46 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Havent tried a single GPO for this but i would of thought it would all tie
together unless there was a confliction ? (in this case, no confliction)
_____
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 16:24:25 +0000
User setting only.
All settings under one GPO accept the zone to site assignments are in a
seperate GPO (enforced) which is applied before the one which contains the
zone settings.
_____
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 10:15:59 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Are you doing this in user policy or computer policy (with Admin Templates
you have a choice)? Have you tried do all of your zone security settings in
one GPO instead of breaking it up into multiple ones?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 10:04 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Yes Jamie, first thing i checked, gpo was being applied. One for the
Internet Zone which is disabled and one for the Trusted Zone which was
enabled.
Only works if i enable this setting within the Internet Zone. It is indeed
strange.
_____
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 09:59:28 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Strange, the only thing I can think is that maybe you have some kind of
other policy floating around overriding that setting. Have you run a
Resultant Set of Policy (RSoP) to verify that the setting is correct on the
client and coming from the right GPO? You can do this through the GP Results
Wizard in GPMC and get a nice report view of what's being applied.
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 9:50 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Yes, the site is appearing within trusted sites, i can see this as you say,
in the right hand corner. I have set this within the admin template not the
maintenance policy.
I first thought that the internet zone were i have it set to disabled is
causin this but not sure. Im stumped !
_____
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 09:45:32 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Are you sure the site is actually being assigned to the proper zone? Have
you verified this in lower right corner of the IE window? How are you
defining the setting.IE Maintenance Policy or Admin Templates?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx]
On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 3:34 AM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] IE Setting
Hi Guys
Ive come across a strange problem whilst configuring IE settings via GPO...
I want to disable the "allow paste operations via script" setting for the
INTERNET Zone which seems to work well, however, i still want this setting
to be available for the TRUSTED Zone, so i have enabled it for this zone.
Problem is, users now cannot use "allow paste operations via script" even if
there URL is added to the zone assignment list for trusted sites. Only works
if i enable this setting for the Internet zone ! it almost looks like the
trused zone setting is be overided with the internet zone setting, if that
makes sense.
Any help with this greatly appreciated.
Thanks
_____
Windows Live Hotmail just got better. Find
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx> out
more!
_____
Confidentiality Warning: This message and any attachments are intended only
for the use of the intended recipient(s), are confidential, and may be
privileged. If you are not the intended recipient, you are hereby notified
that any review, retransmission, conversion to hard copy, copying,
circulation or other use of all or any portion of this message and any
attachments is strictly prohibited. If you are not the intended recipient,
please notify the sender immediately by return e-mail, and delete this
message and any attachments from your system.
_____
Share your photos with Windows Live Photos - Free Find out more!
<http://clk.atdmt.com/UKM/go/132630768/direct/01/>
_____
Windows Live Hotmail just got better. Find
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx> out
more!
_____
Windows Live Hotmail just got better. Find
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx> out
more!
_____
Beyond Hotmail - see what else you can do with Windows Live Find out
<http://clk.atdmt.com/UKM/go/132630768/direct/01/> more!
| | | |
| JamieNelson
Posts:0
| | 01/30/2009 1:25 PM |
| Okay, so you already confirmed the GPO was being applied, but is the
setting in question configured as expected when you view the RSoP data?
Have you actually verified the corresponding registry keys to make sure
it is set as expected? If there is a conflicting machine setting
(perhaps in Local Policy?) it could be overriding what you've defined in
user policy.
Check the following registry values. If present, they should all be set
to "0". Internet Explorer looks for settings in the below order, so if
it find a machine policy it will stop and any user policies you've
defined will be ignored. (Note: 1407 = URLACTION_SCRIPT_PASTE)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2\1407
HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2\1407
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2\1407
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2\1407
If any of them are set to "3" or "1" then that is your problem.
See the following article for more information:
http://technet.microsoft.com/en-us/library/cc783259.aspx
Regards,
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 10:46 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Havent tried a single GPO for this but i would of thought it would all
tie together unless there was a confliction ? (in this case, no
confliction)
________________________________
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 16:24:25 +0000
User setting only.
All settings under one GPO accept the zone to site assignments are in a
seperate GPO (enforced) which is applied before the one which contains
the zone settings.
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 10:15:59 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Are you doing this in user policy or computer policy (with Admin
Templates you have a choice)? Have you tried do all of your zone
security settings in one GPO instead of breaking it up into multiple
ones?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 10:04 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Yes Jamie, first thing i checked, gpo was being applied. One for the
Internet Zone which is disabled and one for the Trusted Zone which was
enabled.
Only works if i enable this setting within the Internet Zone. It is
indeed strange.
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 09:59:28 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Strange, the only thing I can think is that maybe you have some kind of
other policy floating around overriding that setting. Have you run a
Resultant Set of Policy (RSoP) to verify that the setting is correct on
the client and coming from the right GPO? You can do this through the GP
Results Wizard in GPMC and get a nice report view of what's being
applied.
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 9:50 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Yes, the site is appearing within trusted sites, i can see this as you
say, in the right hand corner. I have set this within the admin template
not the maintenance policy.
I first thought that the internet zone were i have it set to disabled is
causin this but not sure. Im stumped !
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 09:45:32 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Are you sure the site is actually being assigned to the proper zone?
Have you verified this in lower right corner of the IE window? How are
you defining the setting...IE Maintenance Policy or Admin Templates?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 3:34 AM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] IE Setting
Hi Guys
Ive come across a strange problem whilst configuring IE settings via
GPO...
I want to disable the "allow paste operations via script" setting for
the INTERNET Zone which seems to work well, however, i still want this
setting to be available for the TRUSTED Zone, so i have enabled it for
this zone. Problem is, users now cannot use "allow paste operations via
script" even if there URL is added to the zone assignment list for
trusted sites. Only works if i enable this setting for the Internet zone
! it almost looks like the trused zone setting is be overided with the
internet zone setting, if that makes sense.
Any help with this greatly appreciated.
Thanks
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
________________________________
Confidentiality Warning: This message and any attachments are intended
only for the use of the intended recipient(s), are confidential, and may
be privileged. If you are not the intended recipient, you are hereby
notified that any review, retransmission, conversion to hard copy,
copying, circulation or other use of all or any portion of this message
and any attachments is strictly prohibited. If you are not the intended
recipient, please notify the sender immediately by return e-mail, and
delete this message and any attachments from your system.
________________________________
Share your photos with Windows Live Photos - Free Find out more!
<http://clk.atdmt.com/UKM/go/132630768/direct/01/>
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
________________________________
Beyond Hotmail - see what else you can do with Windows Live Find out
more! <http://clk.atdmt.com/UKM/go/132630768/direct/01/>
| | | |
| stecrompton
Posts:0
| | 01/31/2009 3:44 PM |
|
Yes, ive followed the reg setting which the GPO edits and it looks fine.
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 12:20:46 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Okay, so you already confirmed the GPO was being applied, but is the setting in question configured as expected when you view the RSoP data?
Have you actually verified the corresponding registry keys to make sure it is set as expected? If there is a conflicting machine setting (perhaps in Local Policy?) it could be overriding what you’ve defined in user policy.
Check the following registry values. If present, they should all be set to “0”. Internet Explorer looks for settings in the below order, so if it find a machine policy it will stop and any user policies you’ve defined will be ignored. (Note: 1407 = URLACTION_SCRIPT_PASTE)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1407
HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1407
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1407
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1407
If any of them are set to “3” or “1” then that is your problem.
See the following article for more information: http://technet.microsoft.com/en-us/library/cc783259.aspx
Regards,
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 10:46 AMTo: GPO GUYSubject: RE: [gptalk] IE Setting
Havent tried a single GPO for this but i would of thought it would all tie together unless there was a confliction ? (in this case, no confliction)
From: xxxxxxxxxxxxxxxx: gptalk@lists.gpoguy.comSubject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 16:24:25 +0000User setting only.All settings under one GPO accept the zone to site assignments are in a seperate GPO (enforced) which is applied before the one which contains the zone settings.
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 10:15:59 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Are you doing this in user policy or computer policy (with Admin Templates you have a choice)? Have you tried do all of your zone security settings in one GPO instead of breaking it up into multiple ones?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 10:04 AMTo: GPO GUYSubject: RE: [gptalk] IE Setting
Yes Jamie, first thing i checked, gpo was being applied. One for the Internet Zone which is disabled and one for the Trusted Zone which was enabled.Only works if i enable this setting within the Internet Zone. It is indeed strange.
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 09:59:28 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Strange, the only thing I can think is that maybe you have some kind of other policy floating around overriding that setting. Have you run a Resultant Set of Policy (RSoP) to verify that the setting is correct on the client and coming from the right GPO? You can do this through the GP Results Wizard in GPMC and get a nice report view of what’s being applied.
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 9:50 AMTo: GPO GUYSubject: RE: [gptalk] IE Setting
Yes, the site is appearing within trusted sites, i can see this as you say, in the right hand corner. I have set this within the admin template not the maintenance policy. I first thought that the internet zone were i have it set to disabled is causin this but not sure. Im stumped !
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 09:45:32 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Are you sure the site is actually being assigned to the proper zone? Have you verified this in lower right corner of the IE window? How are you defining the setting…IE Maintenance Policy or Admin Templates?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 3:34 AMTo: gptalk@lists.gpoguy.comSubject: [gptalk] IE Setting
Hi Guys Ive come across a strange problem whilst configuring IE settings via GPO... I want to disable the "allow paste operations via script" setting for the INTERNET Zone which seems to work well, however, i still want this setting to be available for the TRUSTED Zone, so i have enabled it for this zone. Problem is, users now cannot use "allow paste operations via script" even if there URL is added to the zone assignment list for trusted sites. Only works if i enable this setting for the Internet zone ! it almost looks like the trused zone setting is be overided with the internet zone setting, if that makes sense. Any help with this greatly appreciated. Thanks
Windows Live Hotmail just got better. Find out more!
Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of all or any portion of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system.
Share your photos with Windows Live Photos – Free Find out more!
Windows Live Hotmail just got better. Find out more!
Windows Live Hotmail just got better. Find out more!
Beyond Hotmail — see what else you can do with Windows Live Find out more!
_________________________________________________________________
Hotmail, Messenger, Photos and more - all with the new Windows Live. Get started!
http://www.download.live.com/
| | | |
| JamieNelson
Posts:0
| | 02/02/2009 9:45 AM |
| If those registry values are defined as they're supposed to then the GPO
sounds like it is applying the setting. However, since you're still
experiencing the problem, I don't know what it could be unless that is
some kind of bug.
Just out of curiosity, have you tried different versions of IE?
Regards,
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Saturday, January 31, 2009 2:39 PM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Yes, ive followed the reg setting which the GPO edits and it looks fine.
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 12:20:46 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Okay, so you already confirmed the GPO was being applied, but is the
setting in question configured as expected when you view the RSoP data?
Have you actually verified the corresponding registry keys to make sure
it is set as expected? If there is a conflicting machine setting
(perhaps in Local Policy?) it could be overriding what you've defined in
user policy.
Check the following registry values. If present, they should all be set
to "0". Internet Explorer looks for settings in the below order, so if
it find a machine policy it will stop and any user policies you've
defined will be ignored. (Note: 1407 = URLACTION_SCRIPT_PASTE)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2\1407
HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2\1407
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2\1407
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2\1407
If any of them are set to "3" or "1" then that is your problem.
See the following article for more information:
http://technet.microsoft.com/en-us/library/cc783259.aspx
Regards,
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 10:46 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Havent tried a single GPO for this but i would of thought it would all
tie together unless there was a confliction ? (in this case, no
confliction)
________________________________
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 16:24:25 +0000
User setting only.
All settings under one GPO accept the zone to site assignments are in a
seperate GPO (enforced) which is applied before the one which contains
the zone settings.
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 10:15:59 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Are you doing this in user policy or computer policy (with Admin
Templates you have a choice)? Have you tried do all of your zone
security settings in one GPO instead of breaking it up into multiple
ones?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 10:04 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Yes Jamie, first thing i checked, gpo was being applied. One for the
Internet Zone which is disabled and one for the Trusted Zone which was
enabled.
Only works if i enable this setting within the Internet Zone. It is
indeed strange.
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 09:59:28 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Strange, the only thing I can think is that maybe you have some kind of
other policy floating around overriding that setting. Have you run a
Resultant Set of Policy (RSoP) to verify that the setting is correct on
the client and coming from the right GPO? You can do this through the GP
Results Wizard in GPMC and get a nice report view of what's being
applied.
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 9:50 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Yes, the site is appearing within trusted sites, i can see this as you
say, in the right hand corner. I have set this within the admin template
not the maintenance policy.
I first thought that the internet zone were i have it set to disabled is
causin this but not sure. Im stumped !
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 09:45:32 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Are you sure the site is actually being assigned to the proper zone?
Have you verified this in lower right corner of the IE window? How are
you defining the setting...IE Maintenance Policy or Admin Templates?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 3:34 AM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] IE Setting
Hi Guys
Ive come across a strange problem whilst configuring IE settings via
GPO...
I want to disable the "allow paste operations via script" setting for
the INTERNET Zone which seems to work well, however, i still want this
setting to be available for the TRUSTED Zone, so i have enabled it for
this zone. Problem is, users now cannot use "allow paste operations via
script" even if there URL is added to the zone assignment list for
trusted sites. Only works if i enable this setting for the Internet zone
! it almost looks like the trused zone setting is be overided with the
internet zone setting, if that makes sense.
Any help with this greatly appreciated.
Thanks
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
________________________________
Confidentiality Warning: This message and any attachments are intended
only for the use of the intended recipient(s), are confidential, and may
be privileged. If you are not the intended recipient, you are hereby
notified that any review, retransmission, conversion to hard copy,
copying, circulation or other use of all or any portion of this message
and any attachments is strictly prohibited. If you are not the intended
recipient, please notify the sender immediately by return e-mail, and
delete this message and any attachments from your system.
________________________________
Share your photos with Windows Live Photos - Free Find out more!
<http://clk.atdmt.com/UKM/go/132630768/direct/01/>
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
________________________________
Beyond Hotmail - see what else you can do with Windows Live Find out
more! <http://clk.atdmt.com/UKM/go/132630768/direct/01/>
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
| | | |
| stecrompton
Posts:0
| | 02/03/2009 3:34 AM |
|
Hi
Looks like the GPO works fine after all as i have tested on other sites i.e. http://www.htmlgoodies.com/beyond/javascript/article.php/3458851
The users in question which were having problems when accessing another type of site (intranet) which used a plug in for copy and pasting which doesnt work unless the Internet Zone is enabled. As above, as it works for this, the functionality of this feature works fine !
Thanks for your help.
Subject: RE: [gptalk] IE SettingDate: Mon, 2 Feb 2009 08:39:54 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
If those registry values are defined as they’re supposed to then the GPO sounds like it is applying the setting. However, since you’re still experiencing the problem, I don’t know what it could be unless that is some kind of bug.
Just out of curiosity, have you tried different versions of IE?
Regards,
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Saturday, January 31, 2009 2:39 PMTo: GPO GUYSubject: RE: [gptalk] IE Setting
Yes, ive followed the reg setting which the GPO edits and it looks fine.
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 12:20:46 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Okay, so you already confirmed the GPO was being applied, but is the setting in question configured as expected when you view the RSoP data?
Have you actually verified the corresponding registry keys to make sure it is set as expected? If there is a conflicting machine setting (perhaps in Local Policy?) it could be overriding what you’ve defined in user policy.
Check the following registry values. If present, they should all be set to “0”. Internet Explorer looks for settings in the below order, so if it find a machine policy it will stop and any user policies you’ve defined will be ignored. (Note: 1407 = URLACTION_SCRIPT_PASTE)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1407
HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1407
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1407
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\1407
If any of them are set to “3” or “1” then that is your problem.
See the following article for more information: http://technet.microsoft.com/en-us/library/cc783259.aspx
Regards,
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 10:46 AMTo: GPO GUYSubject: RE: [gptalk] IE Setting
Havent tried a single GPO for this but i would of thought it would all tie together unless there was a confliction ? (in this case, no confliction)
From: xxxxxxxxxxxxxxxx: gptalk@lists.gpoguy.comSubject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 16:24:25 +0000User setting only.All settings under one GPO accept the zone to site assignments are in a seperate GPO (enforced) which is applied before the one which contains the zone settings.
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 10:15:59 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Are you doing this in user policy or computer policy (with Admin Templates you have a choice)? Have you tried do all of your zone security settings in one GPO instead of breaking it up into multiple ones?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 10:04 AMTo: GPO GUYSubject: RE: [gptalk] IE Setting
Yes Jamie, first thing i checked, gpo was being applied. One for the Internet Zone which is disabled and one for the Trusted Zone which was enabled.Only works if i enable this setting within the Internet Zone. It is indeed strange.
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 09:59:28 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Strange, the only thing I can think is that maybe you have some kind of other policy floating around overriding that setting. Have you run a Resultant Set of Policy (RSoP) to verify that the setting is correct on the client and coming from the right GPO? You can do this through the GP Results Wizard in GPMC and get a nice report view of what’s being applied.
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 9:50 AMTo: GPO GUYSubject: RE: [gptalk] IE Setting
Yes, the site is appearing within trusted sites, i can see this as you say, in the right hand corner. I have set this within the admin template not the maintenance policy. I first thought that the internet zone were i have it set to disabled is causin this but not sure. Im stumped !
Subject: RE: [gptalk] IE SettingDate: Fri, 30 Jan 2009 09:45:32 -0600From: Jamie.Nelson@dvn.comTo: xxxxxxxxxxxxxxxx
Are you sure the site is actually being assigned to the proper zone? Have you verified this in lower right corner of the IE window? How are you defining the setting…IE Maintenance Policy or Admin Templates?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 | http://www.dvn.com
From: xxxxxxxxxxxxxxxx [mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve CromptonSent: Friday, January 30, 2009 3:34 AMTo: gptalk@lists.gpoguy.comSubject: [gptalk] IE Setting
Hi Guys Ive come across a strange problem whilst configuring IE settings via GPO... I want to disable the "allow paste operations via script" setting for the INTERNET Zone which seems to work well, however, i still want this setting to be available for the TRUSTED Zone, so i have enabled it for this zone. Problem is, users now cannot use "allow paste operations via script" even if there URL is added to the zone assignment list for trusted sites. Only works if i enable this setting for the Internet zone ! it almost looks like the trused zone setting is be overided with the internet zone setting, if that makes sense. Any help with this greatly appreciated. Thanks
Windows Live Hotmail just got better. Find out more!
Confidentiality Warning: This message and any attachments are intended only for the use of the intended recipient(s), are confidential, and may be privileged. If you are not the intended recipient, you are hereby notified that any review, retransmission, conversion to hard copy, copying, circulation or other use of all or any portion of this message and any attachments is strictly prohibited. If you are not the intended recipient, please notify the sender immediately by return e-mail, and delete this message and any attachments from your system.
Share your photos with Windows Live Photos – Free Find out more!
Windows Live Hotmail just got better. Find out more!
Windows Live Hotmail just got better. Find out more!
Beyond Hotmail — see what else you can do with Windows Live Find out more!
Windows Live Hotmail just got better. Find out more!
_________________________________________________________________
Windows Live Messenger just got better .Video display pics, contact updates & more.
http://www.download.live.com/messenger
| | | |
| JamieNelson
Posts:0
| | 02/03/2009 6:19 PM |
| Cool. Glad to hear it. That sounded kind of strange when you said you
checked the registry keys and they were already correct, so I knew
something was a little off.
Regards,
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Tuesday, February 03, 2009 2:30 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Hi
Looks like the GPO works fine after all as i have tested on other sites
i.e. http://www.htmlgoodies.com/beyond/javascript/article.php/3458851
The users in question which were having problems when accessing another
type of site (intranet) which used a plug in for copy and pasting which
doesnt work unless the Internet Zone is enabled. As above, as it works
for this, the functionality of this feature works fine !
Thanks for your help.
________________________________
Subject: RE: [gptalk] IE Setting
Date: Mon, 2 Feb 2009 08:39:54 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
If those registry values are defined as they're supposed to then the GPO
sounds like it is applying the setting. However, since you're still
experiencing the problem, I don't know what it could be unless that is
some kind of bug.
Just out of curiosity, have you tried different versions of IE?
Regards,
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Saturday, January 31, 2009 2:39 PM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Yes, ive followed the reg setting which the GPO edits and it looks fine.
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 12:20:46 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Okay, so you already confirmed the GPO was being applied, but is the
setting in question configured as expected when you view the RSoP data?
Have you actually verified the corresponding registry keys to make sure
it is set as expected? If there is a conflicting machine setting
(perhaps in Local Policy?) it could be overriding what you've defined in
user policy.
Check the following registry values. If present, they should all be set
to "0". Internet Explorer looks for settings in the below order, so if
it find a machine policy it will stop and any user policies you've
defined will be ignored. (Note: 1407 = URLACTION_SCRIPT_PASTE)
HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2\1407
HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2\1407
HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2\1407
HKLM\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\2\1407
If any of them are set to "3" or "1" then that is your problem.
See the following article for more information:
http://technet.microsoft.com/en-us/library/cc783259.aspx
Regards,
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 10:46 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Havent tried a single GPO for this but i would of thought it would all
tie together unless there was a confliction ? (in this case, no
confliction)
________________________________
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 16:24:25 +0000
User setting only.
All settings under one GPO accept the zone to site assignments are in a
seperate GPO (enforced) which is applied before the one which contains
the zone settings.
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 10:15:59 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Are you doing this in user policy or computer policy (with Admin
Templates you have a choice)? Have you tried do all of your zone
security settings in one GPO instead of breaking it up into multiple
ones?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 10:04 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Yes Jamie, first thing i checked, gpo was being applied. One for the
Internet Zone which is disabled and one for the Trusted Zone which was
enabled.
Only works if i enable this setting within the Internet Zone. It is
indeed strange.
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 09:59:28 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Strange, the only thing I can think is that maybe you have some kind of
other policy floating around overriding that setting. Have you run a
Resultant Set of Policy (RSoP) to verify that the setting is correct on
the client and coming from the right GPO? You can do this through the GP
Results Wizard in GPMC and get a nice report view of what's being
applied.
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 9:50 AM
To: GPO GUY
Subject: RE: [gptalk] IE Setting
Yes, the site is appearing within trusted sites, i can see this as you
say, in the right hand corner. I have set this within the admin template
not the maintenance policy.
I first thought that the internet zone were i have it set to disabled is
causin this but not sure. Im stumped !
________________________________
Subject: RE: [gptalk] IE Setting
Date: Fri, 30 Jan 2009 09:45:32 -0600
From: xxxxxxxxxxxxxxxx
To: xxxxxxxxxxxxxxxx
Are you sure the site is actually being assigned to the proper zone?
Have you verified this in lower right corner of the IE window? How are
you defining the setting...IE Maintenance Policy or Admin Templates?
Jamie Nelson | Operations Consultant | BI&T Infrastructure-Intel | Devon
Energy Corporation | Work: 405.552.8054 | Mobile: 405.200.8088 |
http://www.dvn.com <http://www.dvn.com/>
From: xxxxxxxxxxxxxxxx
[mailto:xxxxxxxxxxxxxxxx] On Behalf Of Steve Crompton
Sent: Friday, January 30, 2009 3:34 AM
To: xxxxxxxxxxxxxxxx
Subject: [gptalk] IE Setting
Hi Guys
Ive come across a strange problem whilst configuring IE settings via
GPO...
I want to disable the "allow paste operations via script" setting for
the INTERNET Zone which seems to work well, however, i still want this
setting to be available for the TRUSTED Zone, so i have enabled it for
this zone. Problem is, users now cannot use "allow paste operations via
script" even if there URL is added to the zone assignment list for
trusted sites. Only works if i enable this setting for the Internet zone
! it almost looks like the trused zone setting is be overided with the
internet zone setting, if that makes sense.
Any help with this greatly appreciated.
Thanks
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
________________________________
Confidentiality Warning: This message and any attachments are intended
only for the use of the intended recipient(s), are confidential, and may
be privileged. If you are not the intended recipient, you are hereby
notified that any review, retransmission, conversion to hard copy,
copying, circulation or other use of all or any portion of this message
and any attachments is strictly prohibited. If you are not the intended
recipient, please notify the sender immediately by return e-mail, and
delete this message and any attachments from your system.
________________________________
Share your photos with Windows Live Photos - Free Find out more!
<http://clk.atdmt.com/UKM/go/132630768/direct/01/>
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
________________________________
Beyond Hotmail - see what else you can do with Windows Live Find out
more! <http://clk.atdmt.com/UKM/go/132630768/direct/01/>
________________________________
Windows Live Hotmail just got better. Find out more!
<http://www.microsoft.com/uk/windows/windowslive/products/hotmail.aspx>
________________________________
Share your photos with Windows Live Photos - Free Try it Now!
<http://www.microsoft.com/uk/windows/windowslive/products/messenger.aspx
>
| | | |
|
|