Axel Rivera again with another blog that provides a step by step instruction on how to implement the new IE 8 Blocker Policy.
Here are the steps to setup the IE8 Blocker Policy.
Now, let's setup the IE8 Blocker Template (IE80Blocker.adm)
NOTE: I am using local Group Policy Editor to illustrate how to load the policy. Domain administrators should be familiar with the GPMC Console to perform the same task on Enterprise environments. GPMC is not a built-in part of Windows 2000/XP/2003, and needs to be separately installed. You can download GPMC from the following link (Download GPMC). If you do not have GPMC or cannot install it then you'll need to edit the GPO via the regular means, i.e. from Active Directory Users and Computers management tool (dsa.msc).
To complete this procedure, you must be logged on as a member of the Domain Administrators security group, the Enterprise Administrators security group, Local administrator, or the Group Policy Creator Owners security group.
1) From start\Run type: GPEDIT.MSC and then hit the Enter key to open the Group Policy Editor.
2) Navigate to Computer Configuration > Administrative Templates. Right click on Administrative Templates and click Add/Remove Templates.
3) Click on the Add button and then browse to the location where you extracted the IE8BlockerToolkit.EXE files. Click on the IE80Blocker.adm to load the template and then hit close.
Next image, you can see the IE80Blocker template is added. Now click on the Close button.
4) After adding this administrative template to the Group Policy Editor, you must clear the “Only show policy settings that can be fully managed” option in the Filtering dialog box before the new policy becomes visible in the Group Policy Editor. This option is found by highlighting Administrative Templates, selecting View, and then selecting Filtering.
Here you can see how it looks like when first installed:
Setting the filter:
Uncheck the “Only show policy settings that can be fully managed” and click OK
5) From the left hand tree, find the newly added template: Computer Configuration / Administrative Templates / Windows Components / Windows Update / Automatic Updates Blockers v2
6) Here is how the policy UI looks like:
7) Here is the registry key location and value when policy is Enabled:
Registry key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\8.0
Key value name:DoNotAllowIE80
Key is not defined
Distribution is not blocked.
Distribution is blocked.
This registry setting is not stored in a policies key and is thus considered a preference. Therefore if the Group Policy Object that implements the setting is ever removed or the policy is set to Not Configured, the setting will remain. To unblock distribution of Internet Explorer 8 by using Group Policy, set the policy to Disabled.
We strongly recommend if you are using WSUS or SMS to review the Frequently Asked Questions
IE9 Blocker Toolkit Related Articles: