Re: [ActiveDir] Blocking IE7

[Matt Hargraves]

You could be correct, it's been about 7 or 8 years since I worked with government institutions.  I know that for K12 they were able to filter, but he's at a university and I didn't notice until later that it's (probably) a private institution that probably doesn't get money from the federal government.  I know that when I worked for a library though, they were not able to filter at all (I asked what software they used and they said that they couldn't filter because they received government funds).. I assume that it's the same at a university, where everyone is expected to be an adult.  Again though, he appears to be at a private institution, where those rules wouldn't apply.

On 10/19/06, Brian Desmond <[EMAIL PROTECTED]> wrote:

You might want to check on that again. To even qualify for erate funds as a K12 you need to be doing web content filtering.

 

Thanks,

Brian Desmond

[EMAIL PROTECTED]

 

c - 312.731.3132

 

From: [EMAIL PROTECTED] [mailto: [EMAIL PROTECTED]] On Behalf Of Matt Hargraves
Sent: Thursday, October 19, 2006 1:49 PM
To: ActiveDir@mail.activedir.org
Subject: Re: [ActiveDir] Blocking IE7

 

I believe that disabling the Automatic Updates service via GPO will block them from installing it, not 100% sure though.

Since you're in an educational environment, things can be a little dicey there.  You can't restrict the internet (government funds thing) and I don't know offhand whether the IE7 installs through Windows Update are running as Local System or as the user that is logged in.  If it's running as the user account, you can simply deny them the right to install software, but if it's running as the local System, things are a little more ugly.

On 10/19/06, Lucas, Bryan <[EMAIL PROTECTED]> wrote:

I see how to block IE7 from deploying through WSUS, but what I don't see is a way to block a user from manually installing it.

 

( http://www.microsoft.com/downloads/details.aspx?FamilyID=4516A6F7-5D44-482B-9DBD-869B4A90159C&displaylang=en)

 

Our users are 90% XP SP2 and managed through GP.  What about building a restricted software GPO that has a hash of iesetup7.exe (if that even exists)?

 

I want to restrict them from getting it through microsoftupdate.com as well.

 

Bryan Lucas

Server Administrator

Texas Christian University