IE 7 in the corporate environment

**Iphone** · 30-Mar-2007, 05:01 AM

IE 7 in the corporate environment - Sandi Hardmeier - IE MVP

Body:

Wayne Note: Sandi prepared this article for me to help clarify some of the panic out there in the community about IE7 being released to the public via automatic distribution methods. Sandi's website www.ie-vista.com was the first site worldwide to have good information about IE 7 well before the launch of the product even in beta. Thanks Sandi.

Internet Explorer 7 was released with much fanfare on 18 October 2006 after a beta testing cycle lasting roughly 1 ½ years. In the first three days after the final version’s release it was downloaded over 4 million times.

I am encouraging home users to update to IE7 as soon as possible to take advantage of all of the security benefits that come along with it. The corporate environment, on the other hand, is a different beast. We all have line of business (LOB) applications that we cannot afford to break and Web sites that are essential to our business that must remain accessible.

Network administrators are understandably nervous about the fact that IE7 will be distributed via Automatic Update, WSUS and SMS2003. Rest assured, though, that IE7 WILL NOT INSTALL WITHOUT WSUS / SMS / SUS ADMIN OR USER CONSENT.

SBS 2003 R2, WSUS, SYSTEMS MANAGEMENT SERVER 2003 and SUS

There has been some confusion about what will happen when IE7 is released to WSUS because IE7 has been referred to as a “high priority” update when offered via Windows, Microsoft or Automatic Updates. This, of course, led to many administrators worrying that IE7 would be automatically approved and installed on SBS2003 R2 if WSUS had been left at its default settings. This is not the case.

IE7 is being released to WSUS/SUS/SMS as an "update rollup" therefore it is not auto-approved under default WSUS settings. The reference to “high priority” that has had some people very concerned refers to the update’s behaviour AFTER installation has been approved by the WSUS admin – that is, it will behave as a high priority update, but only after approval. The only way that IE7 will automatically be approved is if the WSUS admin has chosen to adjust WSUS’s settings to automatically approve update rollups.

Side note: IE7 will not be distributed via SUS 1.0 or SUS 1.0/SP1.

Automatic Update, Windows Update and Microsoft Update
IE7 will be offered to the user only if he or she has local administrator rights. If the user is running as a limited user he or she will NOT be offered IE7.

Also, IE7 will not download and install silently, even if the user has local admin rights and AU is set to download and install updates automatically. Instead, the user will see a large window advising that IE7 has been downloaded and is available to install. At this stage the user will be given three choices; install, don't install, or install later.

Internet Explorer 7 will be offered as a high-priority update if a local admin user has Automatic Updates enabled or if they perform a manual scan for updates using the “Express” install option on the Windows Update or Microsoft Update sites.

IE7 will also be offered as a recommended update to a local admin user who performs a manual update scan on the Windows Update and Microsoft Update sites using the “Custom” install option (this should be taken into consideration by corporations planning to use the Blocker Toolkit – see below).

If you are responsible for a corporate network and want to be sure that IE7 is not offered to your users as a High Priority Update via Automatic Updates, or via the “Express” install option on the Windows Update/Microsoft Update sites you can set a registry kill-bit as follows:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\7.0
“DoNotAllowIE70”

When the key value name is set to 0, or does not exist, distribution is not blocked.
When the key value name is set to 1, distribution is blocked.

A very easy way to roll out the registry script in an SBS environment would be to simply create a *.reg file and incorporate it into your users’ log-in script. Alternatively, you can use the Blocker Toolkit that has been released by MS. The Blocker Toolkit contains an executable blocker script and a Group Policy Administrative Template (.ADM file), and will prevent machines from receiving Internet Explorer 7 as a high-priority update via Automatic Updates and the “Express” install option on the Windows Update and Microsoft Update sites.

IMPORTANT NOTE: The Blocker Toolkit will not stop users who are local administrators from manually installing Internet Explorer 7, whether it be as an Recommended update from the Windows Update or Microsoft Update sites, by downloading it from the Microsoft Download Center, or by installing it via external media. Also, Internet Explorer 7 can still be deployed using SUS, WSUS, SMS, and other methods even if the blocking mechanism is activated.

The Blocker Toolkit can be downloaded from the following URL:

Download details: Toolkit to Disable Automatic Delivery of Internet Explorer 7

Additional languages

IE7 is now available in Finnish, French, German, Japanese and Spanish but will not appear in WSUS/SUS/SMS, Automatic, Windows or Microsoft Updates until a few weeks after this article goes live.

In the interim it can be downloaded here:
Download details: Windows Internet Explorer 7 for Windows XP SP2

Information about foreign language builds will be publicized here as it becomes available:
Internet Explorer: Worldwide Sites

IE7 support
Microsoft will provide free, unlimited customer support for IE7 throughout the product lifecycle.

Alternatively, free technical support is available via the Microsoft newsgroups:
http://www.microsoft.com/communities...&lang=en&cr=us

My Web site, WWW.IE-VISTA.COM has been supporting IE7 users since July/August 2005 and contains comprehensive “how to” articles and screenshots, as well as a Knowledge Base and known issues, installation and troubleshooting advice.

Breaking news and sundry information can be found on my blog Spyware Sucks.

Sandi Hardmeier
WWW.IE-VISTA.COM
Microsoft MVP since 1999

Thread Tools
Show Printable Version Email this Page
Display Modes
Linear Mode Switch to Hybrid Mode Switch to Threaded Mode

Currently Active Users Viewing This Thread: 1 (0 members and 1 guests)