In this blog post we explain the Event id 1085 seeing when the Internet Explorer Site To Zone Assignment List GPO is used.

This scenario applies to All Internet Explorer versions and Windows Operating Systems(Windows 7, Windows 2008 R2, Windows 8.1, Windows 2012 R2, Windows 10 IE11).

When you examine the System-Eventlog, you may find the following event:

Log Name:      System
Source:        Microsoft-Windows-GroupPolicy
Event ID:      1085
Level:         Warning
Description:  Windows failed to apply the Internet Explorer Zonemapping settings. Internet Explorer Zonemapping settings might have its own log file. Please click on the “More information” link.
Event Xml:
<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>
<System>
<Provider Name=”Microsoft-Windows-GroupPolicy” Guid=”{AEA1B4FA-97D1-45F2-A64C-4D69FFFD92C9}” />
<EventID>1085</EventID>
<Level>3</Level>
</System>
<EventData>
<Data Name=”ErrorCode”>87</Data>
<Data Name=”ErrorDescription”>The parameter is incorrect. </Data>
<Data Name=”ExtensionName”>Internet Explorer Zonemapping</Data>
<Data Name=”ExtensionId”>{4CFB60C1-FAA6-47f1-89AA-0B18730C9FD3}</Data>
</EventData>
</Event> 

What cause this Microsoft-Windows-GroupPolicy event id 1085?

This event can occur in case you have entered an invalid entry within the “Site To Zone Assignment List” – policy below

[Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page]

Or

[User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page]

The format of the Site To Zone Assignment List has been described within the policy itself:

This policy setting allows you to manage a list of sites that you want to associate with a particular security zone. These zone numbers have associated security settings that apply to all of the sites in the zone.

Internet Explorer has 4 security zones, numbered 1-4, and these are used by this policy setting to associate sites to zones. They are: (1) Intranet zone, (2) Trusted Sites zone, (3) Internet zone, and (4) Restricted Sites zone. Security settings can be set for each of these zones through other policy settings, and their default settings are: Trusted Sites zone (Low template), Intranet zone (Medium-Low template), Internet zone (Medium template), and Restricted Sites zone (High template). (The Local Machine zone and its locked down equivalent have special security settings that protect your local computer.)

If you enable this policy setting, you can enter a list of sites and their related zone numbers. The association of a site with a zone will ensure that the security settings for the specified zone are applied to the site.  For each entry that you add to the list, enter the following information:

Valuename – A host for an intranet site, or a fully qualified domain name for other sites. The valuename may also include a specific protocol. For example, if you enter http://www.contoso.com as the valuename, other protocols are not affected. If you enter just www.contoso.com, then all protocols are affected for that site, including http, https, ftp, and so on. The site may also be expressed as an IP address (e.g., 127.0.0.1) or range (e.g., 127.0.0.1-10). To avoid creating conflicting policies, do not include additional characters after the domain such as trailing slashes or URL path. For example, policy settings for www.contoso.com and www.contoso.com/mail would be treated as the same policy setting by Internet Explorer, and would therefore be in conflict.

Value – A number indicating the zone with which this site should be associated for security settings. The Internet Explorer zones described above are 1-4.

When entering data in the Group Policy Editor, there is no syntax nor logical error-checking available. This is then performed on the client itself, when the “Internet Explorer Zonemapping” Group Policy Extension will convert the registry into the format which Internet Explorer uses itself. During that conversion the same methods are implemented which are used which Internet Explorer uses when adding a site manually to a specific security zone. In case an entry would be rejected when adding manually, the conversion would fail too in case the Group Policy is used and the event 1085 would be issued. Wildcard-entries to Top-Level-Domains (TLD) One scenario, which is rejected when adding sites is the addition of a wildcard to a TLD (like *.com, or *.co.uk). Now, the question is, which entries are treated as TLD; the following schemes were by default treated as TLD in Internet Explorer:

• Flat Domains (example: .com)
• Two-Letter-Domains in a two-Letter TLD (example: .co.uk).

Starting with Internet Explorer 8, an own internally used list had been introduced (ietldlist.xml) in which several domains have been added to behave like a TLD, while others were named to behave like a domain although they had a two letter format (like .ch.ch). The following blog-post includes a granular explanation concerning domains:

• Understanding Domain Names in Internet Explorer https://blogs.msdn.microsoft.com/ieinternals/2009/09/18/understanding-domain-names-in-internet-explorer/

With Windows 10, Internet Explorer (and Microsoft Edge) use no more the ietldlist.xml, but  the TLD list from https://www.publicsuffix.org/list/public_suffix_list.dat , which had been compiled into the internal resources so no active Internet connection is needed to obtain the list. This feature-change was announced in the following blog-post: http://blogs.msdn.com/b/ie/archive/2014/10/01/internet-explorer-and-the-windows-10-technical-preview.aspx

This updated list is also honored while configuring sites to any security-zone, regardless if this is done manually through the Internet Options, or through the Site To Zone Assignment List policy

This blog has been provided to you by Heiko Mayer and the IE Support team!

In this blog, we will cover the steps taken to configure a site to open in IE using Microsoft Edge and Internet Explorer 11 Enterprise Mode GPOs.

OBJECTIVE: To implement Microsoft Edge and Internet Explorer 11 Group Policy using SiteList Manager rule to open a site url in IE11

REQUIREMENTS: Be familiar with Group Policies using GPEDIT.MSC or GPMC.MSC console.

APPLICABLE OS: Windows 10

SCENARIO: In this example, we will have www.bing.com to open in IE 11 instead of default MS Edge browser out of your Windows 10 client machine. We are publishing the site list xml file on  a web server, but this can also be retrieved using the file protocol, as long as the users have access to the location.

STEP 1:

If not already, download the Windows 10 Site list Manager tool and install it on your system. We will create the sitelist xml file with this tool to be used in the Group policy. To get familiar with the tool, see this article: KB2942883 Enterprise Mode Site List Manager tool is available for Windows – https://support.microsoft.com/en-us/kb/2942883

STEP 2:

Run the Site List Manager tool from your desktop and add www.bing.com with the following configuration:

Enterprise Mode Site List Manager tool

Save the file as bing.xml or any name you like.

STEP 3

Copy the Sitelist to your Web server. In this case, I am dropping the file in the wwwroot folder:  C:\inetpub\wwwroot\bing.xml

Confirm you are able to load the bing.xml from your test machine. Example:

STEP 4

Configure the following GPOs with the link to the site list xml file: http://axelrmsft/bing.xml

Computer Configuration/Windows Components/Internet Explorer/Use the Enterprise Mode IE website list

Computer Configuration/Windows Components/Microsoft Edge/Configure the Enterprise Mode IE website list

STEP 5

Verify the GPO is taking effect by opening the registry key:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main\EnterpriseMode

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode

both key should be pointing to the GPO defined URL, in this example should be the: http://axelrmsft/bing.xml

STEP 6:

Test the site: http://www.bing.com

The site should be redirected to IE11 and should load in EMIE 8 mode, which is identified with an EMIE icon next to the URL

Here is a screenshot:

MICROSOFT EDGE EMIE GPO WORKING

TROUBLESHOOT

If you are not seeing the GPO take effect, here are a few tips you could use to make sure, everything is lined up correctly.

Open Regedit.exe and navigate to the following keys and confirmed it looks correctly, if it does not look right, delete it. A GPupdate /force or a restart of your machine should bring this back!

• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\MicrosoftEdge\Main\EnterpriseMode
• HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\EnterpriseMode
• HKEY_CURRENT_USER\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.microsoftedge_8wekyb3d8bbwe\MicrosoftEdge\NeedIE

MS EDGE EMIE NeedIE Registry location

Make sure, there is NO IExplore.exe or MSEdge process running

Run the GPupdate /force or restart your machine and then test again.

This blog has been provided to you by the IE Support team!

In this blog, we will go over the options we have to configure a Homepage URL using GPO for IE10 and IE11.

Requirements: Be familiar with GPMC.MSC console and Group Policy Preferences.

In this blog, we will cover the following scenario:

• You have deployed the Internet Explorer Enterprise Mode(EMIE) SiteList GPO and you need to confirm the browser is loading in the corresponding document mode configuration.
• Use of F12 Developer tool to help you identify which document mode is the site loading.
• Use of fiddler trace to help to help you identify which document mode is the site loading. 

USING F12 DEVELOPER TOOL

We are lucky to have multiple options and the most common one is the build-in F12 Developer tool. In this example, we have configured the  Use the Enterprise Mode IE website List GPO with a SiteList.xml file that is including www.bing.com to load in IE8 Enterprise mode.

• Open the site: www.bing.com
• Hit the F12 key on your keyboard or from the Gears icon, select F12 developer tools
• From the F12 tools menu, you will quickly see an icon with multi-monitor and the number 8, which represents the document mode the site is loading and matching the GPO SiteList configuration defined for this URL(www.bing.com)
• You can also use the Networking tool within F12 to trace the site http request and looking at the DETAILS tab where the User-Agent value will display the Compatible;MSIE 8.0 value corresponding to the EMIE Sitelist xml gpo configuration we defined for this site.

Screenshot:

USING FIDDLER WEB DEBUGGER TOOL

In this example, we are setting www.bing.com to load in EMIE 8 (Enterprise Mode using SiteList GPO).

• Download Fiddler from https://www.telerik.com/download/fiddler
• Install Fiddler
• Load Fiddler
• Load your site. In the example below, I am using bing.com as an example for the screenshots below J !
• From the left side pane in fiddler you will find the frames.
• On the right side Pane, you have several TABS, select the Inspectors TAB
• From the left side select your site URL you would want to see what User-Agent and document Mode is loading
• In the example below, I had setup a SiteList xml with bing.com to load in EMIE 8 which is what we see in the fiddler request header for this site.

Screenshot:

As you can see, we have easy to use tools to help you find out the document mode. I would like to add that any networking tools that allows to trace http traffic should help you find out what the document mode is by looking at the User-Agent entry, but the easiest to use and install are the one outlined in this blog above!

This blog has been provided to you by the IE Support team!

By default, Internet Explorer will provide users with the ability to Turn on or off suggestions while typing in the address bar. In this quick blog, I will show how you can implement a Group Policy to manage this particular feature from IE11.

In this blog, we share how you can use Group Policy Preferences / Registry to change your Default Search provider used in Internet Explorer 11.

What we will cover in this document:

• SearchScope Registry and Default SearchScope location
• Using GPP Registry Wizard
• User Preferences Registry location
• Renaming the GPO
• Warning

REQUIREMENTS: To be familiar with Group Policy Console and Group Policy Preferences / Registry. To have your Clients configured with at least 2 Search Providers.

Make sure you have the Latest Windows Roll-up updates to address any known issues.

• Microsoft Security Bulletin MS16-144 – Critical
• MS16-144: Cumulative security update for Internet Explorer: December 13, 2016

SEARCHSCOPE REGISTRY LOCATION

By Default, the SearchScopes registry key contains the default search provider information. This is the location in the registry that will help you identify, which GUID is being used to defined the default search provider.

Here is the location:

• HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

If more than one Search provided is defined by the user, you will first find a DEFAULTSCOPE string name with the REG_SZ GUID identifying the Search provider.

• So, if you look at the {6aXXXX} value, it shows it is the Google GUID.
• As you can see, under the SearchScopes key we have two providers: Google and Bing search. In this scenario, we will be configuring Bing as the default search provider.

USING GROUP POLICY PREFERECNES REGISTRY

In this example, we have two providers: Google and Bing.

Here are the steps I took to configure Bing as the default provider.

PART I – STAGING MY HOST MACHINE

• First, I configure my local host machine that I will be setting the GPO from, with the settings to be configuring on the clients using GPP Registry. This is the easiest way you can configure this GPO and also helps reduce any mistake. So, simply open IE Manage Add-ons / Search Providers and add Google to the list it will take you to the IE gallery site: (https://www.microsoft.com/en-us/iegallery)
• Second, Set the Google Provider as the Default provider from the Manage Add-ons window.
  • This is what it looks like:

The Client machines, where we want to change the settings to Big(example), may look like this:

PART II – GROUP POLICY

Now, that we have the IE settings on the host machine, we can configure our GPP Registry.

• From GPMC.MSC navigate to your GPO / Preferences / Windows Settings / Registry
• Right Click on Registry / New and Select Registry Wizard

• From the Registry Browser Window, select Local Computer and click on Next >

• From the Registry Browser, navigate to: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes

• From this key, make sure you select the DefaultScope name

• Next, check both Sub keys containing the GUIDS for the Search Providers: Bing and Google and every value under each keys except any path to user profiles! Also, remember to scroll down to select other items!!

Example:

In the Screen below, we can see the FavIconPath goes to a profile directory. DO NOT SELECT THIS OPTION!!

• Click on finish to complete this GPO configuration.

PART III – ELIMINATING THE WARNING

• NEXT, lets add the User Preferences We will use this to help eliminate a warning the user may get when we enforce the DefaultScope search. This warning is by Design and design to alert users of a program trying to modify their settings. If you do not care about this warning and your users are hands, you can skip this step.

Also, note that this warning may not show for a brand new users.

THE WARNING- EXAMPLE!

An unknown program would like to change your default search provider to ‘Google’ (www.google.com)

SCREENSHOT:

• Start a new Registry Wizard and navigate to: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\User Preferences

NOTE: All you need to check is the top User Preference key. No need to select the sub names in the bottom pane!  We will be deleting this with the GPO, so no real use to check these out .

• Click on Finish
• Now, we have all the setting we need to get the default provider configured on the clients. We need to perform some housekeeping to help others understand what we are doing and a small adjustment to the User Preferences setting to make sure, we eliminate the warning.
• Configured this new GPO to delete the User Preferences. This can be done from the properties of the User Preferences policy. Double-click on the User Preferences object on the right side pane and change the Action to Delete and save it.

PART IV – CLEANING UP THE GPO

We will now, label the GPO settings and make small adjustments that any admin will appreciate when all done.

As you may have noticed, when using the Wizard, you will end up with a full registry tree view to the path of the settings and not very intuitive. We however, can modify the GPO and make it look a lot cleaner without affecting anything.

First, expand the GPO keys:

• Grab the SearchScopes Folder  and drag and drop it on the Registry  object:
• Do the same for the User Preferences folder, drag it and drop it on the Registry
• Now, delete the empty tree objects. From Registry Wizard Values folder to Internet explorer Here is a screenshot of what you want to delete and what you want to keep: Red Goes and Blue KEEP

Here is what it looks after the clean-up:

Let’s rename the GUIDS to represent the Search Provider. Just click on the GUID and on the right side pane, you can figure out which GUID is for Bing and Google.

It will end up looking like this:

PART V – TESTING THE GPO

In this screenshot, we can see the warning as the GPO was applied without the User Preferences GPP (I had disabled this GPO to better illustrate how this works).

• I enabled the User Preferences GPO, which I have configured to delete the User Preferences registry “key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\User Preferences” and ran the GPUPDATE /FORCE command to reapply the GPO.
• Relaunch IExplore and no Warnings. Checked my settings Manage Add-ons Search Provider configuration and Bing shows as my Default.

With these steps, you should successfully set your prefer search provider on your manage environment. We suggest that you be running the latest IE cumulative updates and Windows Roll-ups to assure you are fully patch and free of any known issues.

This blog has been provided to you by the IE Support team!

In this blog post, we are covering a few methods you could used to manage secondary home pages on your environment using Group policy objects.

Requirement: To a local or domain administrator and be familiar with GPMC.MSC console and Group Policy Preferences.

Method I:

The Disable changing secondary home page settings Administrative Template. This policy is available under the Computer and User configuration Policy.

• Secondary home pages are the default Web pages that Internet Explorer loads in separate tabs from the home page whenever the browser is run. This policy setting allows you to set default secondary home pages.
• If you enable this policy setting, you can specify which default home pages should load as secondary home pages. The user cannot set custom default secondary home pages.
  If you Disable or do not configure this policy setting, the user can add secondary home pages.

  Note: If the “Disable changing home page settings” policy is enabled, the user cannot add secondary home pages.

  Detailed values:

  • Id: secondaryhomepagesList

Computer Configuration: http://gpsearch.azurewebsites.net/#653 

• Policy Name: Disable changing secondary home page settings
• Category Path: Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\
• Supported: On At least Internet Explorer 8.0
• Registry Key: HKLM\Software\Policies\Microsoft\Internet Explorer\Main\secondaryStartpages
• Value: no value given
• Admx: inetres.admx

User Configuration:  http://gpsearch.azurewebsites.net/#7084 

• Policy Name: Disable changing secondary home page settings
• Category Path: User Configuration\Administrative Templates\Windows Components\Internet Explorer\
• Supported: On At least Internet Explorer 8.0
• Registry Key: HKCU\Software\Policies\Microsoft\Internet Explorer\Main\secondaryStartpages
• Value: no value given
• Admx: inetres.admx

Screenshot:

METHOD II

Use Group Policy Preferences (GPP)

The advantage of using Group Policy Preferences is that it allows you to specify a default home page but still allow users to change it if they want.

Windows 2012 R2 Demo:

• From GPMC.MSC navigate to your GPO object and edit
• Go to: User Configuration / Preferences / Control Panel Settings / Internet Settings
• Right Click on Internet Settings and select Internet Explorer 10

• The first thing we notice is that we have red underline settings:Settings which are underlined in red are not configured at the target machine, while settings underlined in green are configured at the target machine.
  In order to change the underlining, use the following function keys:

F5 – Enable all settings on the current tab
F6 – Enable the currently selected setting
F7 – Disable the currently selected setting
F8 – Disable all settings on the current tab

• Article reference: http://blogs.technet.com/b/grouppolicy/archive/2008/10/13/red-green-gp-preferences-doesn-t-work-even-though-the-policy-applied-and-after-gpupdate-force.aspxI would encourage pressing a F8 to disable all before configuring anything as the recommended scenario is to configure only the settings you want to apply.

  DEFAULT, WITH RED UNDERLINED INDICATING IS NOT ACTIVE

  EDIT MODE, AFTER DEPRESSING F6 TO ACTIVATE AND EDIT THE SETTING. NOTICED THE GREEN UNDERLINE!

• Add the homepage  and click Apply and OK to complete.

• You will now see the GPP IE Setting Policy configured

Method III

Using Group Policy Preferences Registry – This requires you to be more familiar with the registry, but it gives you a more granular approach.

• First, setup your host machine with the home pages you would like the clients machines to be configured with.
  • In this example, I am using three sites.
• From User Configuration / Preferences / Windows Settings / Registry
• Right Click on Registry and select Registry Wizard
• From Registry Browser, click select Local Computer(default) and click on Next>
• From the Registry Browser, find the following key: Software\Microsoft\Internet Explorer\Main
• From the bottom pane, select the following items: Start Page and Secondary Start Pages

• NEXT: Click on Finish.
• You can clean up the structure of this GPO if you like, to make it a little easier to manage. See the steps below!

To clean up the GPP GPO, follow these simple steps:

• From the Registry GPO Object, expand the folder tree view til you find the Main folder.
• Right click on the Main Folder and choose “Rename”
• Give it a friendly name, like: Homepage_and_Secondary_Startup-Page

• Now, Drag the Homepage_and_Secondary_Startup-Page to the Registry GPO object and drop it. This will eliminated the unnecessary tree view for this GPO created by the Wizard.

• Delete what is left over and it will look like this:

The Policy is ready and should provide you with the home page and a secondary homepage.

Related Blog:

How to configure Internet Explorer 11 homepage using Group Policy?

In this quick post, we will share different methods you can use to remove Internet Explorer 11 from Windows 10 in favor of just having MS EDGE as the only browser.

NOTE:

We recommend that if you are going to use any of the methods shared in this blog, you stick to one and not to mixed them up.

Example: If you are going to use the Programs and Feature from Control Panel to remove it, use it to add it.

If using the CMD line DISM command to removed it, use it to add it.

METHOD I: Using Programs and Features from Control Panel

• From Start / Run (Hit the Windows key + R) type appwiz.cpl
• From the Programs and Features click on “Turn Window features on or off “
• From the Windows Features dial /onlinog, Find the Internet Explorer 11 feature and deselect the checked box.
• Click on Yes and OK to commit the changes.
• Restart your PC

METHOD II: Using the DISM command line tool

————————————————————————————————–
DISABLE: Restart after this command is executed!
————————————————————————————————–
From and elevated command window type:

dism /online /Disable-Feature /FeatureName:Internet-Explorer-Optional-amd64

You will see…

Deployment Image Servicing and Management tool
Version: 6.1.7600.16385
Image Version: 6.1.7600.16385
Disabling feature(s)
[==========================100.0%==========================]
The operation completed successfully.
Restart Windows to complete this operation.
Do you want to restart the computer now (Y/N)?

————————————————————————————————–
ENABLE: You can use the command below to add it back. 
————————————————————————————————–
From and elevated command window type:

dism /online /Enable-Feature /FeatureName:Internet-Explorer-Optional-amd64

You will see the following….

Deployment Image Servicing and Management tool
Version: 6.1.7600.16385
Image Version: 6.1.7600.16385
Enabling feature(s)
[==========================100.0%==========================]
The operation completed successfully.
Restart Windows to complete this operation.
Do you want to restart the computer now (Y/N)?

This blog has been provided to you by the IE Support team!

With the next release of Windows 10, which is already available through the Insider Preview Program on Build 14986 , we received a new way policy “Keep favorites in sync between Internet Explorer and Microsoft Edge” to configure the favorites in IE and Edge.

The new GPO is located under:

User Configuration\Administrative Templates\Windows Components\Microsoft Edge
“Keep favorites in sync between Internet Explorer and Microsoft Edge”

After enabling this policy, favorites in Edge and Internet Explorer stay synchronized. This means, Favorites you add in Internet Explorer do appear automatically in Microsoft Edge too and Favorites you delete in Edge are deleted in Internet Explorer as well.

Another benefit of this policy, is that this setting eases also the maintenance of the favorites. In addition, the workflow also honors redirected favorites, so you can keep your IE-favorites on a network-share, and those are then copied to your Edge browser on the client.

From a technical point of view, Microsoft Edge still uses its own database at %LOCALAPPDATA%\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\AC\MicrosoftEdge\User\Default\DataStore\Data\nouser1\120712-0049\DBStore\spartan.edb to use and manage its favorites and IE still uses the URL-files in the favorites-folder, which may also be redirected on a network-share. But, with the policy enabled, these favorites just stay in sync through Edge:

• When you add a favorite in Edge, it is added in the favorites-folder of IE too.
• When you add a favorite in Internet Explorer while Edge is not running, the database from Edge is not updated, as this is done when Edge is running.
• When you add a favorite in Internet Explorer while Edge is currently running, the favorite will appear in Edge too.

This blog has been provided to you by Heiko Mayer!

I am Hari from the Internet Explorer Core team. In this blog, we will discuss a scenario involving Microsoft EDGE and Skype for Business.

SCENARIO: Skype for business does not launch when you click on the “Join the meeting” option from outlook.

PROCESS: Here are the steps the user normally takes to launch Skype client.

1. You click on “Join the meeting”
2. It should invoke Edge (When Edge is configured as default browser which is Windows 10 default configuration), and the Edge would validate the request and handover the meeting operation to Skype for Business and you would join the meeting.

RESULTS: This might not work in some instances and Microsoft Edge might show the below messages:

CAUSE: This issue can occur of the policy setting “Block launching desktop apps associated with a URI scheme” is enabled. This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme.

GPO ONLINE LINK: http://gpsearch.azurewebsites.net/#7395 [This link explains the “Block launching desktop apps associated with a URI scheme”]

Registry Key: HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\Associations

Value:  BlockProtocolElevation

Enabled Value:
decimal: 1

Disabled Value:
decimal: 0

When you remove the policy, the setting allows Edge to launch desktop applications properly irrespective of the URI Scheme.  Since Microsoft Edge is a Windows Store application, this particular policy affects its functionality when configured.

Note:  When you configure the policy locally, make sure that “Runtimebroker.exe” is stopped manually to see immediate effect of the policy.  However, if you still see the issue please have the machine rebooted so that you can see Edge opening Skype for business.

This blog has been provided to you by Hariprasad Raghavan!

This is a quick post to help you identify what could be causing your Favorite links not to show in your favorites when updating to Windows 10  version.

Here are two possible scenarios to look at. :

SCENARIO I: When you build a Windows image from unattended setup, please consider the following:

The unattend.xml file may have an entry like this: <FavoritesDelete>true</FavoritesDelete> When executed this will cause the installation to removed the favorites.

SCENARIO II: You may see an install.ins file with the entry similar to this:

Path: C:\programfiles\internet explorer\Signup\install.ins 

Entry to look for: “FavoritesDelete=1”

• 1 = delete
• 0= preserve

The above entry will also cause your favorites to be deleted

In most cases, these updates were done with managed solutions such SCCM  where can be used to change the values and get the desired results.

For an SCCM deployment,  and dealing with the install.ins scenario you can you can change the file through a task sequence.

This blog has been provided to you by the IE/EDGE Support team!

That is a good question and in this blog, we hope to shed some light and help understand what the DefaultConnectionSettings  key is and what it maps to when looking at the IE Connection / Lan Settings User Interface(UI).

SIMPLIFIED ANSWER:

DefaultConnectionSettings is a registry value that contains the currently configured connection settings for the browser.  For example, if you configure internet settings to use a proxy server, connect directly, or use a configuration script, those settings are stored in this registry entry.

EXAMPLE:

In this screenshot we have set a proxy server abcde and port 80. Reviewing the defaultconnectionsettings registry value reflects these settings:

REGISTRY KEY LOCATION:

Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections

VALUE DEFINITION:

• DefaultConnectionSettings. This entry specifies the configuration of the default connection used by Internet Explorer.
• SavedLegacySettings. This entry is a copy of DefaultconnectionSettings, and specifies the configuration used by network connections other than the default connection.

Related articles:

• How to configure Proxy Settings for IE10 and IE11 as IEM is not available
• How to use GPP Registry to uncheck automatically detect settings?
• How can I configure Proxy AutoConfigURL Setting using Group Policy Preference (GPP) ?
• WPAD detection in Internet Explorer
• HOW TO CONFIGURE A PROXY SERVER URL AND PORT USING GPP REGISTRY ?

This blog has been provided to you by the IE Support team!

In the blog-post “Description of Event ID 1085 from “Internet Explorer Zonemapping” we already explained that an invalid entry within the Site To Zone Assignment List policy will cause the Event 1085, but it is still not easy to determine which exact entries are invalid and by that are not converted into the intended Zone-Mapping.

When examining a handful of those entries it may appear appropriate to enter the URLs as a Trusted Site within the Internet Options on a client that does not receive the Assignment policy until you find the invalid entry that causes the following message:

But when this list exceeds a few pages in the Group Policy Report the effort is very high then.

In order to help the Administrator to find such invalid entries I wrote the attached command-line utility  Site2ZoneMap.exe, which interprets the entries below the two registry-keys:

[HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zonemapkey]

[HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zonemapkey]

Command-line utility with parameters:

EXAMPLE: Assume the following policy, which has a correct value and an invalid entry (*.com):

When you execute the tool with Parameter “-test“, you receive the following output in CMD:

C:\>site2zonemap -test

Processing [HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zonemapkey]

==========================================================================

Success: *.microsoft.com

Error 87 for URL: *.com

1 Errors found.

When you execute the tool with Parameter “-erroronly “, you receive the following output in CMD:

C:\>site2zonemap -erroronly

Processing [HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zonemapkey]

==========================================================================

Error 87 for URL: *.com

1 Errors found.

DOWNLOAD: Site2ZoneMap

This blog has been provided to you by Heiko Mayer and the IE Support team!

There are different options on how you can find this information.

Finding the MS Edge version using the UI

To check which version of Microsoft Edge you are using follow the below steps:

1. Open Microsoft Edge.
2. Select More actions in the upper-right corner, and then select Settings.
3. Look for your version under About this app.

Please note that this is an example done from a Windows 10 Creator update 1703. To help you find the ProgID, you can look at the OEMDefaultAssociations.xml file. I have some steps at the end of this blog to help you find the version. You can modify the the Batch sample and reg export command accordingly!

Using Powershell option

From an elevated command windows type:

powershell get-appxpackage *edge* >c:\MSEdgeVersion.txt

RESULT:

Name              : Microsoft.MicrosoftEdge
Publisher         : CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US
Architecture      : Neutral
ResourceId        :
Version           : 40.15063.0.0
PackageFullName   : Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe
InstallLocation   : C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe
IsFramework       : False
PackageFamilyName : Microsoft.MicrosoftEdge_8wekyb3d8bbwe
PublisherId       : 8wekyb3d8bbwe
IsResourcePackage : False
IsBundle          : False
IsDevelopmentMode : False
IsPartiallyStaged : False

REGISTRY EXPORT

From an elevated command window type:

reg export "HKEY_CLASSES_ROOT\AppX3xxs313wwkfjhythsb8q46xdsq8d2cvv\Application" C:\MSEDGE_Version_Key.txt /y

RESULT:

Note: The output will give you the Prog ID and Version

Windows Registry Editor Version 5.00

[HKEY_CLASSES_ROOT\AppX3xxs313wwkfjhythsb8q46xdsq8d2cvv\Application]
"ApplicationName"="@{Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe?ms-resource://Microsoft.MicrosoftEdge/Resources/AppName}"
"ApplicationCompany"="Microsoft Corporation"
"ApplicationIcon"="@{Microsoft.MicrosoftEdge_40.15063.0.0_neutral__8wekyb3d8bbwe?ms-resource://Microsoft.MicrosoftEdge/Files/Assets/MicrosoftEdgeSquare44x44.png}"
"ApplicationDescription"="ms-resource:AppDescription"
"AppUserModelID"="Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge"

Batch File that will execute the PowerShell and Registry export for you!

:Run from Elevated CMD window
:Start Batch 
 
setlocal
set _FOLDERNAME=MSEDGE_logs_temp
set _TEMPDIR=%systemdrive%\%_FOLDERNAME%
 
@echo.
echo -------------------------------------------
echo Copying logs to temporary folder ...
echo -------------------------------------------
mkdir %_TEMPDIR% 2> NUL

@echo.
echo -------------------------------------------
echo Get MS EDGE Version ...
echo -------------------------------------------
powershell get-appxpackage *edge* >%_TEMPDIR%\MSEdgeVersion.txt
reg export "HKEY_CLASSES_ROOT\AppX3xxs313wwkfjhythsb8q46xdsq8d2cvv\Application" %_TEMPDIR%\MSEDGE_Version_Key.txt /y

goto end
 
:end
 
pause

@echo.
echo -------------------------------------------
echo Go to c:\MSEDGE_logs_temp
echo -------------------------------------------
start c:\MSEDGE_logs_temp

:End of Batch

If you want to see what the OEM xml file have and compare it with the output, you can export the OEMDefaultAssociations.xml to notepad. Here is how:

When you open the OEMDefaultAssociations.xml in notepad, find the .htm and .html file extension to help you find the application handler. In this case, Windows 10 default .htm and .html is Microsoft Edge.

Example:

<Association Identifier=".htm" ProgId="AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9" ApplicationName="Microsoft Edge" ApplyOnUpgrade="true" OverwriteIfProgIdIs="AppX6k1pws1pa7jjhchyzw9jce3e6hg6vn8d" />
<Association Identifier=".html" ProgId="AppX4hxtad77fbk3jkkeerkrm0ze94wjf3s9" ApplicationName="Microsoft Edge" ApplyOnUpgrade="true" OverwriteIfProgIdIs="AppX6k1pws1pa7jjhchyzw9jce3e6hg6vn8d" />

This blog has been provided to you by the IE Support team!

I am Hari from the Browser team sharing some scenarios where web font’s icons are missing when loading web applications using these highly used web HTML font  Icons ("Example: font-awesome, @font-face, graphic shell-icons, GDI fonts") and share a few informative resources.

Here is a list of key words covering the different terms used to describe the behavior.

• Website graphic shell-icons are missing
• Web font-face icon missing
• Font-awesome icons missing
• Fonts blocked when using Windows 10 Internet explorer 11
• Office 365 icons missing - right navigation doesn't display the icons
• CRM right navigation doesn't display the icons
• Yammer right navigation doesn't display the icons
• MSN icons missing
• Microsoft.com website icon missing
• Web icons missing when browsing sites using Windows 7 IE11 (see scenario II)

The browser team recommends you use Microsoft EDGE to avoid the described scenarios!

SCENARIO I

The missing web font icon can be missing if the Mitigation System GPO Block untrusted fonts is configured in Windows 10 operating system. To learn more about this GPO, please read the following documents. Also, know that in future Windows 10 Operating system, the “Untrusted Font Blocking” setting will be dropped. See articles below for more information!

When the Untrusted Font Blocking is implemented a few registry keys are created.

GPO Registry Location:

HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\NT\MitigationOptions with the following name and value: MitigationOptions_FontBocking*"="1000000000000"

ARTICLES:

• Block untrusted fonts in an enterprise
• GPO Reference: http://gpsearch.azurewebsites.net/#10949
• Dropping the “Untrusted Font Blocking” setting

If you were to open the F12 Developer Tools (by depressing the F12 key), under the console information you should find the following errors:

CSS3111: @font-face encountered unknown error.

Shell-icons-0.4.0.eot

CSS3114: @font-face failed OpenType embedding permission check. Permission must be Installable.

MWFMDL2.ttf

Screenshot:

SCENARIO II

The GPO Allow Font Download is enabled. This GPO can be configured for each Internet Explore Zones: Internet, Local Intranet, Trusted Sites and Restricted Zone.

Here are all the relevant information you can use to help you determine the client have this GPO Enabled.

Configure the Allow Font Downloads IE Setting on the Internet, Restricted Zone (on by default) via GPO and add the affected Websites to the Trusted Sites or Local Intranet Zone

GPO REF:

• COMPUTER
• USER

Policy name: Allow font downloads
Category Path: Computer Configuration or User Configuration - Administrative Templates\Windows Components\Internet Explorer\Internet\Control Panel\Security Page\Internet Zone\
Supported On: At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1

Registry Key: HKLM or HKCU \Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3

Value: 1604

Admx: inetres.admx
DESCRIPTION: This policy setting allows you to manage whether pages of the zone may download HTML fonts.

If you enable this policy setting, HTML fonts can be downloaded automatically. If you enable this policy setting and Prompt is selected in the drop-down box, users are queried whether to allow HTML fonts to download.

If you disable this policy setting, HTML fonts are prevented from downloading.
If you do not configure this policy setting, HTML fonts can be downloaded automatically.

Detailed values:
Id: IZ_Partname1604
ValueName: 1604
item: decimal: 0 => Enable
item: decimal: 3 => Disable
item: decimal: 1 => Prompt

TIP: While troubleshooting, we suggest to also look under the Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\ 0,1,2,3 zones to make sure, these have not changed if the GPO was not configured!

SCENARIO III

If the above scenarios do not assist in resolving the missing icon issue, please make sure you Disable your Antivirus application that have also known to prevent the Fonts Icon from displaying in the IE11 browser.

ADDITIONAL INFORMATION:

If you are using Symantec DLP, please check for the below link that’s speaks about the resolution that making changes to the DLP Settings.

• https://support.symantec.com/en_US/article.TECH240808.html Known Issues for DLP Agent Support of Microsoft Windows 10 Creators Update

Great question and the answer is No. You can have one URL(Same Exact) per Zone and if the Site already exist on another Zone, lets say you had it in the intranet zone and now wants to add it to the trusted site zone a warning should come up.

Here is a sample scenario you can test:

Add the https://domain.com site to the Local Intranet zone in IE.

Screenshot:

Now, try adding the same https://domain.com site to the Trusted Site Zone. A warning will come up.

The site you specified already exist in the local intranet zone. Would you like to move it to the Trusted site zone?

What if I used the Site To Zone Assignment List GPO to push this, what will happened? Same answer, No.

A warning will appear:

The name "http://domain.com" has already been specified. Make sure that you specify a unique value.

This blog has been provided by the Browser Support Team!

Here are some options to reset IE to default settings via a script or command line.

From Elevated command prompt type: (User interaction is needed to complete. The option to delete user personal setting will come up).

rundll32.exe inetcpl.cpl ResetIEtoDefaults

There is a PowerShell Script that will perform the same the above command line option. Visit the TechNet article here:

Reset all Internet Explorer setting to default using PowerShell.

VBScript Sample below. This will execute silently:

'IE Reset Automation
Set objAP = CreateObject("wscript.shell")
objAP.Run "rundll32.exe inetcpl.cpl ResetIEtoDefaults"
wscript.sleep 1000

objAP.AppActivate "Reset Internet Explorer Settings"
objAP.SendKeys "%r", True

wscript.sleep 2000

If objAP.AppActivate("Reset Internet Explorer Settings") Then objAP.SendKeys "%c"
wscript.sleep 2000

If objAP.AppActivate("Reset Internet Explorer Settings") Then objAP.SendKeys "%c"
wscript.sleep 2000

If objAP.AppActivate("Reset Internet Explorer Settings") Then objAP.SendKeys "%c"

Yes, there is a group policy you can use to help you manage the about:flags page in Microsoft Edge.
The Policy is available in both Computer and User Configuration administrative templates.

GPO Details:

Policy name: Prevent access to the about:flags page in Microsoft Edge
Category Path: User or Computer Configuration\Administrative Templates\Windows Components\Microsoft Edge\
Supported On: Microsoft Edge on Windows 10, Version 1607 or later
Registry Key: HKCU\Software\Policies\Microsoft\MicrosoftEdge\Main
Value: PreventAccessToAboutFlagsInMicrosoftEdge
Admx file: MicrosoftEdge.admx

Explanation:

Here are a few ways you can configure MS Edge Start page.

MANUALY:

• In Microsoft Edge, select More ... > Settings, and then scroll down to select View advanced settings.
• Turn on Show the home button, select A specific page, type the URL of the home page you want, then select Save
• Optional: To change what you see when you first open Microsoft Edge, select More ... > Settings, and then select the option you want under Open Microsoft Edge with.

Here is a good article on how you would setup a homepage in Microsoft Edge Change your home page

USING GROUP POLICY:

In order to allow users edit the start page, both of these policies will have to be configured.

Policy name: Configure Home pages

• User Configuration: http://gpsearch.azurewebsites.net/#13459
• Computer Configuration: http://gpsearch.azurewebsites.net/#13336

This policy setting lets you configure one or more Home pages. for domain-joined devices. Your employees won't be able to change this after you set it.

If you enable this setting, you can configure one or more Home pages. If this setting is enabled, you must also include URLs to the pages, separating multiple pages by using angle brackets in this format:

If you disable or don't configure this setting, your default Home page is the webpage specified in App settings.

Detailed values:

Id: HomePagesPrompt

ValueName: ProvisionedHomePages

Policy name: Disable lockdown of Start pages

• User Configuration: http://gpsearch.azurewebsites.net/#13615
• Computer Configuration: http://gpsearch.azurewebsites.net/#13616

This policy setting lets you disable the lock down of Start pages, letting users modify the Start pages when the "Configure Start pages" setting is in effect.

Note: This setting only applies when you´re using the "Configure Start pages" setting.

Important: This setting can only be used with domain-joined or MDM-enrolled devices. For more info, see the Microsoft browser extension policy (aka.ms/browserpolicy).

If you enable this setting, you can't lock down any Start pages that are configured using the "Configure Start pages" setting, which means that users can modify them.

If you disable or don't configure this setting, users can't change any Start pages configured using the "Configure Start pages" setting. The Start pages will remain locked down.

Detailed values: 

• Enabled Value: decimal: 1
• Disabled Value: decimal: 0

The Registry policy key may look like this:

Windows Registry Editor Version 5.00

[HKEY_CURRENT_USER\Software\Policies\Microsoft\MicrosoftEdge\Internet Settings]

"DisableLockdownOfStartPages"=dword:00000001

"ProvisionedHomePages"="<http://www.website.com>"

This blog has been provided by the Browser Support Team!