Using Group Policy with Internet Explorer

To customize and maintain Internet Explorer after deployment on Windows 2000, you can use the Internet Explorer maintenance features and administrative templates in Group Policy.

Group Policy is a collection of user-environment settings used to define configurations for groups of users and computers. Group Policy is flexible and includes options for registry-based policy settings, security settings, software installation, scripts (computer startup and shutdown, and log on and log off), and folder redirection. Administrators use Group Policy to specify options for managed desktop configurations. Administrators can apply settings to various hierarchical groups of users, known as organizational units. This structure enables an administrator to set broad standards or restrictions for a company or division, while specifying exceptions for smaller departments or groups. For more information about Group Policy, see the "Group Policy" chapter in the Distributed Systems Guide of the Windows 2000 Resource Kit.

Note To manage software distribution from a centralized source in your organization, you can also use the Software Installation snap-in for Group Policy. You can assign and publish software for groups of users and groups of computers. For more information, see the Software Installation section in the "Group Policy" chapter in the Distributed Systems Guide of the Windows 2000 Resource Kit.

Customizing Internet Explorer with Group Policy

You can customize the following areas using Group Policy:

• The user interface and the appearance of the browser
• Connection settings, such as dial-up and local area network (LAN) connections, and user agent string
• Custom URLs, such as favorites, the search page, and the home page
• Security settings, such as security zones and content ratings
• Default programs for common Internet tasks, such as reading e-mail and viewing newsgroups

The type of group customization and administration you want to do will determine how you start Group Policy. For more information about starting Group Policy, see Group Policy in Windows 2000 online Help or the "Group Policy" chapter in the Distributed Systems Guide of the Windows 2000 Resource Kit.

To use the Internet Explorer maintenance features in Group Policy

1. Start Group Policy.
2. In Group Policy, click User Configuration.
3. Click Windows Settings, and then click Internet Explorer Maintenance.
4. Click the icon for the feature area you want to customize.
5. Double-click the title of the feature you want to administer.
6. Change the settings you want.

Restricting Which Settings Users Can Change

You can use administrative templates in Group Policy to restrict the settings users can change. This will help you maintain consistency across your organization.

For example, if you preconfigure or use a script to set connection settings for your users, and you don't want users to change those settings, you can remove connection settings from the user interface. By using the hierarchical structure of Group Policy, you could still enable the user interface for a specific group of users in your company—for example, a department that often works remotely and frequently needs to change connection settings.

The Administrative Templates nodes of the Group Policy snap-in provide registry-based Group Policy settings to the administrator. Administrative Templates govern a variety of behaviors for the Windows 2000 operating system and its components. There are several Internet Explorer settings for the user interface, offline pages, persistence, and Microsoft ActiveX® controls. You can set restrictions on either a per-computer basis to apply to any user on the computer, or on a per-user basis.

The administrative templates in Group Policy are similar to the System Policies and Restrictions that appear in the IEAK, and to those that are used by the Policy Editor in previous versions of Windows. For more information about using administrative templates for previous operating systems, see Appendix E, "Setting System Policies and Restrictions," in the Internet Explorer Resource Kit. However, to administer administrative templates for Windows 2000, you should use Group Policy.

The .adm file is a text file (Unicode support for .adm files is new to Windows 2000) that specifies a hierarchy of categories and indicates the registry locations where changes should be made if a particular selection is made.

The type of group customization and administration you want to do will determine how you start Group Policy. For more information about starting Group Policy, see Group Policy in Windows 2000 online Help or the "Group Policy" chapter in the Distributed Systems Guide of the Windows 2000 Resource Kit.

To restrict Internet settings in Group Policy

1. Start Group Policy.
2. In Group Policy, click Computer Configuration to set restrictions on a per-computer basis, or click User Configuration to set restrictions on a per-user basis.
3. Click Administrative Templates, click Windows Components, and then click Internet Explorer.

   There are subcategories for many of the Internet Explorer templates under User Configuration. Open those folders to see additional policies.

4. Double-click the setting you want to administer.
5. Change the settings you want. For most Internet Explorer templates, clicking Enabled sets a restriction, clicking Disabled prevents the restriction from applying to that group of users (even if it is enabled for a broader category of users), and clicking Not Configured does not set the restriction.

Note See the Explain tab of each policy's Properties page for more details on the policy settings within the .adm file.

The Administrative Templates nodes of the Group Policy snap-in can be extended by using custom .adm files. For more information about extending administrative templates, see the online Help for Administrative Templates in Windows 2000 or the "Group Policy" chapter in the Distributed Systems Guide of the Windows 2000 Resource Kit.