The Sysadmins

Tips and tricks from the Sysadmins

Group Policy – Internet Explorer 10+ and the Death of IEM

If you’ve used Group Policy Internet Explorer Maintenance (IEM) to configure your organisations Internet explorer settings and are looking to upgrade to IE10 or above you will find that the settings defined with IEM will no longer work. Not only that but if you try to modify the GPO from a machine running IE10 you will not be able to modify the GPO settings.

DeathofIEM

Settings configured with IEM are not automatically removed when you upgrade from IE9 -> IE10, however any changes made to the IEM GPO will not be reflected by the clients and any new users logging onto a machine with IE10 will not receive the IEM settings.

  • If UserA is logged onto a Windows 7 machine running IE9 and the user updates to IE10. The settings from IEM will be retained- but not enforced by Group Policy.
  • If UserB logs onto the same Windows 7 machine for the first time after IE10 has been installed, they will not receive any IEM settings.
  • If you are deploying or using Windows 8 (which ships with IE10) no settings from IEM will apply, ever.

IEM has been dropped in favour Group Policy preference, Administrative Templates and the Internet Explorer Administration Kit 10 (IEAK 10). This post will run you through a couple of common settings you may need to migrate across. I will cover setting the home page and proxy settings.

Setting Home Page with Group Policy Preferences

Open the Group Policy Management Console and create a new GPO. Browse to User Configuration -> Preferences -> Control Panel Settings -> Internet Settings. Right click and choose New -> Internet Explorer 10. Why isn’t IE11 listed? See here.

Note – You will need Windows 8 / Server 2012 or above with RSAT to see the Group Policy preference settings for Internet Explorer 10.

Group Policy Preferences Internet Explorer 10

Enter the URL of the Home page you wish to set, and select start with home page. Notice the red dots underlining the home page entry.

Group Policy Preferences Internet Explorer 10 Home Page

You must press F5 (or F6), to confirm the entry. If you do not the setting will not be applied. Once you have done so, the entry turns green.

Function keys:

F5 – Enable all settings on the current tab.
F6 – Enable the currently selected setting.
F7 – Disable the currently selected setting.
F8 – Disable all settings on the current tab.

Group Policy Preferences Internet Explorer 10 Home Page F5

Setting a Proxy with Group Policy Preferences

Create or modify an existing Internet Settings policy as explained above, this time head over the connection tab -> Lan Settings.

Internet Explorer 10 Group Policy Preferences Proxy Setting

Specify the proxy, again note the red dots showing that the setting have not been confirmed. Press F5 to confirm.

Internet Explorer 10 Group Policy Preferences Proxy Setting F5

Takeaway

  • Internet Explorer Maintenance will NOT apply to to Internet Explorer 10 or above
  • You will not be able to modify existing IEM GPOs from machines with IE10 or above installed
  • Press F5 to confirm entries made to Group Policy Preferences Internet Settings, basically- make sure you’re green!

11 Comments

  1. Hi,

    sometimes I want to be in the mind of the developers….. why I need to press F5 or F6? why you don’t write in the description of the policy?

    The GPO wad not applied, I spent a couple of hours to troblehoot any AD issues, at the end I searched on google and I found the trick….

    thank you redmond guys!!!!

  2. You have no idea how much time I wasted trying to figure out why my settings were not be applied. I never did figure it out. I needed your site to inform me that F5/6 needed pressed.

    WHY!?!?! Protection from ourselves? Are these settings persistent perhaps and cannot be easily undone? I shall look into that further.

  3. Many thanks for your information. But no thanks to Microsoft for having the audacity to retire Internet Explorer Maintenance from Group Policy.

    There was absolutely no need. They simply fixed something that was never broken. Having to press F5 to confirm the settings is the most ridiculous thing I have ever come across.

    Microsoft have messed this up big time.

  4. +1
    Rob Beresford quote:
    Many thanks for your information. But no thanks to Microsoft for having the audacity to retire Internet Explorer Maintenance from Group Policy.

    There was absolutely no need. They simply fixed something that was never broken. Having to press F5 to confirm the settings is the most ridiculous thing I have ever come across.

    Microsoft have messed this up big time.

  5. Thanks very much, spent ages trying to work out why the policy wasn’t applied. This sorted it out.

    Pressing F5 to confirm a setting is pointless, just by modifying a field should be enough to say “i want this setting applied”

    Microsoft never cease to amaze me……….

  6. many many thanks tom
    greetings from here Tehran to all your signals in your cables.

  7. I have tried above said setting with Windows 8 +RSAT but it didn’t work. 🙁

  8. Greetings

    I have Just run into this issue myself.

    Except i have an extra issue.
    My Group Policy only gives me IE 5-8 options.
    Neither IE 9 or 10 are listed.
    Yet the server is on IE 11

    Any ideas?
    Thank you

    • Tom@thesysadmins.co.uk

      January 20, 2016 at 7:41 pm

      Hi Darius, you need Windows 8+ or Server 2012+ with RSAT to manage IE10+ GPP policy settings.

  9. Thank god I found this after 30 minutes of head-smashing.

    Oddly for me, it defaults green anyway. Changed settings, ran GPUPDATE/FORCE for my user, no change. ran GPRESULT /H to a html and could see the new settings “apparently” applied.
    Decided to press F5, ran GPUPDATE/FORCE again and Bob’s your Mother’s Brother.

    Wow, just wow…..

Leave a Reply

Your email address will not be published.

*

This site uses Akismet to reduce spam. Learn how your comment data is processed.