Windows 7 : Configuring and Troubleshooting Internet Explorer Security - Internet Explorer Add-Ons (part 1)

Add-ons extend Internet Explorer capabilities to enable Web sites to provide much richer, more interactive content. For example, the following are commonly used add-ons:

• Shockwave Flash An add-on that enables complex animations, games, and other interactive capabilities

• Windows Media Player An add-on that enables Web pages to integrate audio and video

• Microsoft Virtual Server VMRC Control An add-on that enables users to remotely control a remote virtual machine from within Internet Explorer

The sections that follow describe how to configure add-ons and troubleshoot problems related to add-ons.

1. How to Enable and Disable Add-Ons

After starting Internet Explorer, you can disable or delete add-ons by following these steps:

1. Click the Tools button on the toolbar, and then click Manage Add-Ons.

   The Manage Add-Ons dialog box appears, as shown in Figure 1.

   

   Figure 1. The Manage Add-Ons dialog box

2. In the Manage Add-Ons dialog box, select an add-on, and then click Disable to prevent the add-on from automatically loading. If the add-on is an ActiveX control, you can click Delete to permanently remove it.

If an add-on is causing serious enough problems that you can't start Internet Explorer, you can disable the add-on without opening Internet Explorer by following these steps:

1. Click Start, and then click Control Panel.

2. Click the Network And Internet link.

3. Under Internet Options, click the Manage Browser Add-Ons link.

   The Internet Properties dialog box appears.

4. Click Manage Add-Ons.

5. In the Manage Add-Ons dialog box, select an add-on, and then click Disable to prevent the add-on from automatically loading.

2. How to Start Internet Explorer without Add-Ons

A buggy or malicious add-on can cause problems with starting Internet Explorer. To work around this problem and launch Internet Explorer without add-ons, follow these steps:

1. Click Start. Then, click All Programs, Accessories, and System Tools.

2. Click Internet Explorer (No Add-Ons).

   Internet Explorer starts with all add-ons disabled. If a Web page opens a new window when you click a link, that new window also has add-ons disabled. Add-ons will be enabled automatically the next time you start Internet Explorer using the standard shortcut.

Alternatively, you can start Internet Explorer manually using the -extoff parameter by clicking Start, typing iexplore -extoff, and pressing Enter.

3. How to Configure Add-Ons in AD DS Domain Environments

As with earlier versions of Internet Explorer, you can use the Group Policy settings in User Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management to enable or disable specific add-ons throughout your organization. Typically, you need to use two settings in this group to block all unapproved add-ons in your organization:

• Add-On List Enable this setting, and then specify the approved add-ons in your organization. To specify an add-on, provide the class identifier (CLSID) for the add-on you need to add as the Value Name in the Add-On List. The CLSID should be in brackets, such as "{BDB57FF2-79B9-4205-9444-F5FE85F37312}." You can find the CLSID for an add-on by reading the <object> tag from the HTML of a Web page that references the add-on. To specify that the add-on should be denied, specify a value of 0. To allow an add-on, specify a value of 1. To both allow an add-on and permit users to manage the add-on, specify a value of 2.

• Deny All Add-Ons Unless Specifically Allowed In The Add-On List After specifying the add-ons you want to allow in the Add-On List setting, enable this policy to block all other add-ons automatically. You can use the combination of these two settings to block all unapproved add-ons.

Two other Group Policy settings related to add-on management are located within both User Configuration and Computer Configuration at Administrative Templates\Windows Components\Internet Explorer. The settings that relate to managing add-ons are:

• Turn Off Crash Detection By default, Internet Explorer detects an add-on that crashes and disables it the next time you start Internet Explorer. If you have a problematic add-on that is required for a critical Web application, you can enable this policy to ensure that even a failing add-on continues to run.

• Do Not Allow Users To Enable Or Disable Add-Ons By default, users can open the Manage Add-Ons dialog box and enable or disable add-ons. If you enable this policy, they won't be able to configure add-ons.