Group Policy driving me nuts - DFWstangs Forums
 
LinkBack Thread Tools Display Modes
post #1 of 20 (permalink) Old 09-08-2008, 11:10 AM Thread Starter
Lifer
 
DoesSpeedTurnUon's Avatar
 
Join Date: Feb 2004
Location: Bedford, TX
Posts: 2,189
Group Policy driving me nuts

All I need to be able to do is allow the users to be able to control their IE security zone settings. I've gone through every option in Group Policy Editor and I just can't find the right one. I can set their settings, but where/how do I let them

The greyed out buttons dont need to be grey

2007 GMC Sierra RCSB - It breathes better now and looks better than stock.
2008 Honda 700XX - Doesn't need any mods.
DoesSpeedTurnUon is offline  
Sponsored Links
Advertisement
 
post #2 of 20 (permalink) Old 09-08-2008, 12:14 PM
Very Interesting
 
The Big Matt's Avatar
 
Join Date: Mar 2000
Location: Around the World
Posts: 9,856
I'm really not sure of a way other than to edit or remove a registry key, you should be able to set this value with Group Policy

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Win dows\CurrentVersion\Internet Settings
Name: Security_HKLM_only

Type: REG_DWORD

Value: 1 <-Enabled 0 <-Disabled

Something has enabled this key.

You're only as strong as you allow yourself to be...

Lockout Workout Forums and Supplements
The Big Matt is offline  
post #3 of 20 (permalink) Old 09-10-2008, 03:52 PM Thread Starter
Lifer
 
DoesSpeedTurnUon's Avatar
 
Join Date: Feb 2004
Location: Bedford, TX
Posts: 2,189
Quote:
Originally Posted by The Big Matt
I'm really not sure of a way other than to edit or remove a registry key, you should be able to set this value with Group Policy

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Win dows\CurrentVersion\Internet Settings
Name: Security_HKLM_only

Type: REG_DWORD

Value: 1 <-Enabled 0 <-Disabled

Something has enabled this key.
Security_HKLM_only is not listed there.

Should I create it?

2007 GMC Sierra RCSB - It breathes better now and looks better than stock.
2008 Honda 700XX - Doesn't need any mods.
DoesSpeedTurnUon is offline  
 
post #4 of 20 (permalink) Old 09-10-2008, 03:57 PM
Mentally Impaired
 
donnie90stang's Avatar
 
Join Date: May 2007
Location: Mt. Pleasant, Tx
Posts: 2,367
temporary highjack

Hey man, how did the exhuast workk out for your buddy mitch. I never was able to get a hold of him after he picked them up. Let me know if you've heard from him. Thanks Don

Quote:
Originally Posted by Tyrone Biggums View Post
It's the American way. I want to do the right thing, but only if it's on my terms and I can half ass my way through it.
donnie90stang is offline  
post #5 of 20 (permalink) Old 09-16-2008, 01:01 AM
 
Join Date: Nov 2002
Posts: 5,831
more info needed... are you on a domain? Do you manage the domain group policy?

gpedit.msc

User Config -> Admin Templates -> Windows components -> IE -> Security

Just look for any setting that is configured... If there is nothing there then you're probably getting your policy from the domain (site, ou, etc) rather then local.
trey85stang is offline  
post #6 of 20 (permalink) Old 09-16-2008, 09:03 AM Thread Starter
Lifer
 
DoesSpeedTurnUon's Avatar
 
Join Date: Feb 2004
Location: Bedford, TX
Posts: 2,189
Quote:
Originally Posted by trey85stang
more info needed... are you on a domain? Do you manage the domain group policy?

gpedit.msc

User Config -> Admin Templates -> Windows components -> IE -> Security

Just look for any setting that is configured... If there is nothing there then you're probably getting your policy from the domain (site, ou, etc) rather then local.
Yea, i'm editing the domain policy. Right now, the CRM software i'm trying to use (Soffront if you're familiar) needs the "Access Data Sources across Domains" to be enabled. I have it set to be enabled.

Also tried going directly from the server (uploading a spreadsheet) and it gives me that same error that "access data sources across domains needs to be enabled" Yet i'm not going across domains.

2007 GMC Sierra RCSB - It breathes better now and looks better than stock.
2008 Honda 700XX - Doesn't need any mods.
DoesSpeedTurnUon is offline  
post #7 of 20 (permalink) Old 09-16-2008, 11:12 AM
Very Interesting
 
The Big Matt's Avatar
 
Join Date: Mar 2000
Location: Around the World
Posts: 9,856
Quote:
Originally Posted by trey85stang
more info needed... are you on a domain? Do you manage the domain group policy?

gpedit.msc

User Config -> Admin Templates -> Windows components -> IE -> Security

Just look for any setting that is configured... If there is nothing there then you're probably getting your policy from the domain (site, ou, etc) rather then local.
There is no setting for disabling the internet zones in group policy.

This is a known issue.

Try adding that key, also what keys do you have there?

Matt

You're only as strong as you allow yourself to be...

Lockout Workout Forums and Supplements
The Big Matt is offline  
post #8 of 20 (permalink) Old 09-16-2008, 11:14 AM Thread Starter
Lifer
 
DoesSpeedTurnUon's Avatar
 
Join Date: Feb 2004
Location: Bedford, TX
Posts: 2,189
our group policy is pretty "out of the box", it was setup that way before I got here. What would happen if i deleted the default domain policy and setup another one from scratch?

2007 GMC Sierra RCSB - It breathes better now and looks better than stock.
2008 Honda 700XX - Doesn't need any mods.
DoesSpeedTurnUon is offline  
post #9 of 20 (permalink) Old 09-16-2008, 11:18 AM Thread Starter
Lifer
 
DoesSpeedTurnUon's Avatar
 
Join Date: Feb 2004
Location: Bedford, TX
Posts: 2,189
Quote:
Originally Posted by The Big Matt
There is no setting for disabling the internet zones in group policy.

This is a known issue.

Try adding that key, also what keys do you have there?

Matt
This is what I have.
Attached Thumbnails
Click image for larger version

Name:	9-16-2008 11-17-36 AM.png
Views:	72
Size:	5.8 KB
ID:	87408  

2007 GMC Sierra RCSB - It breathes better now and looks better than stock.
2008 Honda 700XX - Doesn't need any mods.
DoesSpeedTurnUon is offline  
post #10 of 20 (permalink) Old 09-16-2008, 11:18 AM
Very Interesting
 
The Big Matt's Avatar
 
Join Date: Mar 2000
Location: Around the World
Posts: 9,856
Quote:
Originally Posted by DoesSpeedTurnUon
our group policy is pretty "out of the box", it was setup that way before I got here. What would happen if i deleted the default domain policy and setup another one from scratch?
It's not group policy causing this BTW.

But you can fix it with Group Policy

You're only as strong as you allow yourself to be...

Lockout Workout Forums and Supplements

Last edited by The Big Matt; 09-16-2008 at 11:31 AM.
The Big Matt is offline  
post #11 of 20 (permalink) Old 09-16-2008, 11:20 AM Thread Starter
Lifer
 
DoesSpeedTurnUon's Avatar
 
Join Date: Feb 2004
Location: Bedford, TX
Posts: 2,189
Quote:
Originally Posted by The Big Matt
It's not group policy causing this BTW.
So how do I get those buttons to not be grayed out?

2007 GMC Sierra RCSB - It breathes better now and looks better than stock.
2008 Honda 700XX - Doesn't need any mods.
DoesSpeedTurnUon is offline  
post #12 of 20 (permalink) Old 09-16-2008, 11:30 AM
Very Interesting
 
The Big Matt's Avatar
 
Join Date: Mar 2000
Location: Around the World
Posts: 9,856
The template policy settings for URL Actions are available in both Computer Configuration and User Configuration, in the Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page node of Group Policy Object Editor.

On a domain controller, edit the Default Domain Policy.
Choose Computer Configuration
Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page
Choose Internet Zone
Configure "access data sources across domains"

Enable Policy
And Enable Access
Apply

Refresh Group Policy on that machine.

See if it works?

You're only as strong as you allow yourself to be...

Lockout Workout Forums and Supplements
The Big Matt is offline  
post #13 of 20 (permalink) Old 09-16-2008, 11:37 AM Thread Starter
Lifer
 
DoesSpeedTurnUon's Avatar
 
Join Date: Feb 2004
Location: Bedford, TX
Posts: 2,189
Quote:
Originally Posted by The Big Matt
The template policy settings for URL Actions are available in both Computer Configuration and User Configuration, in the Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page node of Group Policy Object Editor.

On a domain controller, edit the Default Domain Policy.
Choose Computer Configuration
Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page
Choose Internet Zone
Configure "access data sources across domains"

Enable Policy
And Enable Access
Apply

Refresh Group Policy on that machine.

See if it works?
Ok, this is enabled in both internet/intranet. It still gives me this error. the funny thing is i'm not even going across domains, i'm doing a local upload.

2007 GMC Sierra RCSB - It breathes better now and looks better than stock.
2008 Honda 700XX - Doesn't need any mods.
DoesSpeedTurnUon is offline  
post #14 of 20 (permalink) Old 09-16-2008, 11:41 AM
Very Interesting
 
The Big Matt's Avatar
 
Join Date: Mar 2000
Location: Around the World
Posts: 9,856
are you sure it's enabled? is group policy refreshed and applied?

run this from a command prompt on the workstation...

gpupdate /force

then see if it's enabled

You're only as strong as you allow yourself to be...

Lockout Workout Forums and Supplements
The Big Matt is offline  
post #15 of 20 (permalink) Old 09-16-2008, 12:07 PM Thread Starter
Lifer
 
DoesSpeedTurnUon's Avatar
 
Join Date: Feb 2004
Location: Bedford, TX
Posts: 2,189
Quote:
Originally Posted by The Big Matt
are you sure it's enabled? is group policy refreshed and applied?

run this from a command prompt on the workstation...

gpupdate /force

then see if it's enabled
I have already done that too. I really need to disable the domain policy, gpupdate /force check to see what changed and adjust the group policy to what I need. Unfortunately, I've allowed "access data across the domain" in:

Local comp policy for internet/intranet
domain policy for internet/intranet
Enabled the the settings in Computer Config of GPOE and in the User Config.

and it still says it can't do it. (thats why i was thinking if i could disable the policy as a whole, it would revert to the local machine policy, where could i edit directly from IE like it wasn't attached to a domain.


I haven't added the key yet that you suggested though.

2007 GMC Sierra RCSB - It breathes better now and looks better than stock.
2008 Honda 700XX - Doesn't need any mods.
DoesSpeedTurnUon is offline  
post #16 of 20 (permalink) Old 09-16-2008, 12:17 PM
Very Interesting
 
The Big Matt's Avatar
 
Join Date: Mar 2000
Location: Around the World
Posts: 9,856
if all of that is still causing this issue, you might have spyware/malware which is disabling your IE not Group Policy

Try running CWShredder
http://www.trendmicro.com/ftp/produc...cwshredder.exe

You're only as strong as you allow yourself to be...

Lockout Workout Forums and Supplements
The Big Matt is offline  
post #17 of 20 (permalink) Old 09-16-2008, 05:15 PM Thread Starter
Lifer
 
DoesSpeedTurnUon's Avatar
 
Join Date: Feb 2004
Location: Bedford, TX
Posts: 2,189
Quote:
Originally Posted by The Big Matt
I'm really not sure of a way other than to edit or remove a registry key, you should be able to set this value with Group Policy

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Win dows\CurrentVersion\Internet Settings
Name: Security_HKLM_only

Type: REG_DWORD

Value: 1 <-Enabled 0 <-Disabled

Something has enabled this key.

Ok... so i got to looking at this... Mine goes:
HKEY_LOCAL_MACHINE\Software\Microsoft\...

there isn't any "policies" folder there, could this be an issue!?

edit: that was on my local machine, i checked on the server this is installed on, and it IS there... i'll be changing it to disable now.

2007 GMC Sierra RCSB - It breathes better now and looks better than stock.
2008 Honda 700XX - Doesn't need any mods.
DoesSpeedTurnUon is offline  
post #18 of 20 (permalink) Old 09-16-2008, 05:23 PM Thread Starter
Lifer
 
DoesSpeedTurnUon's Avatar
 
Join Date: Feb 2004
Location: Bedford, TX
Posts: 2,189
ok ok ok... evidently that policy folder IS in my registry... and that DID fix it! WOW Thanks a bunch man!

2007 GMC Sierra RCSB - It breathes better now and looks better than stock.
2008 Honda 700XX - Doesn't need any mods.
DoesSpeedTurnUon is offline  
post #19 of 20 (permalink) Old 09-16-2008, 06:55 PM
Very Interesting
 
The Big Matt's Avatar
 
Join Date: Mar 2000
Location: Around the World
Posts: 9,856
glad i could help man

You're only as strong as you allow yourself to be...

Lockout Workout Forums and Supplements
The Big Matt is offline  
post #20 of 20 (permalink) Old 09-30-2008, 11:56 AM Thread Starter
Lifer
 
DoesSpeedTurnUon's Avatar
 
Join Date: Feb 2004
Location: Bedford, TX
Posts: 2,189
Quote:
Originally Posted by The Big Matt
I'm really not sure of a way other than to edit or remove a registry key, you should be able to set this value with Group Policy

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Win dows\CurrentVersion\Internet Settings
Name: Security_HKLM_only

Type: REG_DWORD

Value: 1 <-Enabled 0 <-Disabled

Something has enabled this key.

Ok... this thing just switched back to "1". What/Where is making it do this?!

2007 GMC Sierra RCSB - It breathes better now and looks better than stock.
2008 Honda 700XX - Doesn't need any mods.
DoesSpeedTurnUon is offline  
Sponsored Links
Advertisement
 
Reply

Bookmarks

Quick Reply
Message:
Options

Register Now



In order to be able to post messages on the DFWstangs Forums forums, you must first register.
Please enter your desired user name, your email address and other required details in the form below.

User Name:
Password
Please enter a password for your user account. Note that passwords are case-sensitive.

Password:


Confirm Password:
Email Address
Please enter a valid email address for yourself.

Email Address:
OR

Log-in










Thread Tools
Show Printable Version Show Printable Version
Email this Page Email this Page
Display Modes
Linear Mode Linear Mode



Posting Rules  
You may post new threads
You may post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is On
HTML code is On
Trackbacks are On
Pingbacks are On
Refbacks are On

 
For the best viewing experience please update your browser to Google Chrome