How to apply restrictions to Internet Explorer 6 with Service Pack 1 (SP1) in Microsoft SoftGrid

This article discusses how to apply restrictions to Internet Explorer 6 with Service Pack 1 (SP1) in the Microsoft SoftGrid virtual environment. The restrictions are applied by modifying the virtual registry. The registry modifications can be performed when a sequence is created, updated, or streamed.

You can apply restrictions to Internet Explorer by using one of the following methods:

• Method 1: Use the Group Policy Object Editor from the Sequencer
• Method 2: Apply registry modifications to the virtual registry
• Method 3: Use the .reg file from the SoftGrid Client
• Method 4: Use the <REGISTRY> element from the SoftGrid Client

As examples, this article describes how to remove the Open command on the File menu and how to remove the Windows Update command on the Tools menu. For a complete listing of restrictions, see the following Microsoft Knowledge Base article:

Note Windows Update modifications that are made by using the Group Policy Object Editor apply to the following registry subkey:Changes that are made manually apply to the following registry subkey:

Method 1: Use the Group Policy Object Editor from the Sequencer

Warning Serious problems might occur if you modify the registry incorrectly by using Registry Editor or by using another method. These problems might require that you reinstall the operating system. Microsoft cannot guarantee that these problems can be solved. Modify the registry at your own risk.
This method uses the Policy Editor from the Sequencer to apply the restriction registry modifications to the Virtual Registry.

1. During the monitoring phase of the Installation Wizard, start the Group Policy Object Editor (Gpedit.msc).
2. Expand Local Computer Policy, expand User Configuration, expand Administrative Templates, expand Windows Components, expand Internet Explorer, and then expand Browser menus.
3. On the File menu, right-click Disable Open, and then click Properties.
4. Click Enabled, and then click OK.
5. Expand Local Computer Policy, expand User Configuration, expand Administrative Templates, expand Windows Components, and then expand Windows Update.
6. Right-click Remove access to use all Windows Update features, and then click Properties.
7. Click Enabled, and then click OK.
8. Exit the Group Policy Object Editor.

The Group Policy Object Editor makes two registry modifications to enable the policies. Because the modifications were made by the Winlogon process, the Sequencer does not capture them. Therefore, you must export the registry modifications to a .reg file, and then you must import the modifications. The Sequencer will capture the modifications during the import operations. To do this, follow these steps:

1. Open Registry Editor.
2. Locate and then right-click the following registry subkey:
   HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions
3. Click Export.
4. Save the Restrictions.reg file to the desktop.
5. Locate and then right-click the following registry subkey:
   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Windows Update
6. Click Export.
7. Save the Windowsupdate.reg file to the desktop.
8. Exit Registry Editor.
9. Right-click Restrictions.reg, and then click Merge.
10. Right-click Windowsupdate.reg, and then click Merge.
11. Click Stop Monitoring, and then complete the wizard.
12. Save the sequence.

Method 2: Apply registry modifications to the virtual registry.

Use Registry Editor from the Sequencer to apply the restriction registry modifications to the virtual registry.

1. During the monitoring phase of the Installation Wizard, start Registry Editor.
2. Locate and right-click the following registry subkey:
   HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions
3. Point to New, and then click DWORD Value.
4. In New Value #1, type NoFileOpen.
5. Right-click NoFileOpen, and then click Modify.
6. In Value data, type 1, and then click OK.
7. Locate and then right-click the following registry subkey:
   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
8. Right-click Explorer, point to New, and then click DWORD Value.
9. In New Value #1, type NoWindowsUpdate.
10. Right-click NoWindowsUpdate, and then click Modify.
11. In Value data, type 1, and then click OK.
12. Exit Registry Editor.
13. Click Stop Monitoring, and then complete the wizard.
14. Save the sequence.

Method 3: Use the .reg file from the SoftGrid Client

You must modify the .osd file to apply the restriction registry modifications to the Virtual Registry. These steps are performed when you start an application by using the <SCRIPT> element to import a .reg file. To create the .reg file, the registry must be modified and exported. These modifications should be performed from the sequencing station without the Sequencer running.

1. Start Registry Editor.
2. Locate and then right-click the following registry subkey:
   HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions
3. Point to New, and then click DWORD Value.
4. In New Value #1, type NoFileOpen.
5. Right-click NoFileOpen, and then click Modify.
6. In Value data, type 1, and then click OK.
7. Right-click Restrictions, click Export, and then save the .reg file.
8. Locate and then right-click the following registry subkey:
   HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer
9. Point to New, and then click DWORD Value.
10. In New Value #1, type NoWindowsUpdate.
11. Right-click NoWindowsUpdate, and then click Modify.
12. In Value data, type 1, and then click OK.
13. Right-click Explorer, click Export, and then save the .reg file.
14. Exit Registry Editor.
15. Merge the .reg files into a single file. Review the files for information that should not be imported, as shown in the following .reg file.

    Windows Registry Editor Version 5.00
    
    [HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions]
    "NoFileOpen"=dword:00000001
    
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
    "NoWindowsUpdate"=dword:00000001

    The .reg file can exist within the sequence or in a remote network location. Make sure that the user who is starting the application has access to the .reg file.
16. Edit the .osd file by using a text editor.
17. Enter the <SCRIPT> element and child elements in the <DEPENDENCY> element as follows.

    <DEPENDENCY>
      <SCRIPT TIMING="PRE" EVENT="LAUNCH" PROTECT="TRUE" WAIT="TRUE">
        <HREF>%SystemRoot%\regedit.exe /s "PATH/FILENAME.reg"</HREF>
      </SCRIPT>
    </DEPENDENCY>

18. Save the .osd file, and then close the text editor.

Method 4: Use the <REGISTRY> element from the SoftGrid Client

This section outlines how to modify the .osd file to apply the restriction modifications to the virtual registry every time that an application starts. These steps are performed when the application starts by using the <REGISTRY> element.

1. Edit the .osd file by using a text editor.
2. Enter the <REGISTRY> element and child elements within the <VIRTUALENV> element as follows.

   <VIRTUALENV>
     <REGISTRY>
       <REGKEY HIVE="HKCU" KEY="Software\Policies\Microsoft\Internet Explorer\Restrictions">
         <REGVALUE REGTYPE="REG_DWORD" NAME="NoFileOpen">1</REGVALUE>
       </REGKEY>
       <REGKEY HIVE="HKCU" KEY="Software\Microsoft\Windows\CurrentVersion\Policies\Explorer">
         <REGVALUE REGTYPE="REG_DWORD" NAME="NoWindowsUpdate">1</REGVALUE>
       </REGKEY>
     </REGISTRY>
   </VIRTUALENV>

3. Save the .osd file, and then exit the text editor.