How To Lock Down Internet Explorer

In working with Police Departments we have relized that locking down Internet Explorer is a concern. There are a few different ways to lockdown IE. You can go into the options and remove a few things, but it is easy to put them back. The other way is to edit the registry. Neither of these are perfect, but using them together works well. 

Anyone who edits the registry does so at thier own risk. You can also see the microsoft site as a reference http://support.microsoft.com/kb/823057/en-us

 

In Internet Explorer

• The first thing that you want to do is set the options the way you want them
• Then you want to assign a homepage
• Remove unwanted links and favorites
• Delete the extra favorite folders
• Add all favorites that you want
• Remove the search button from the tool bar (located in toolbar, customize)

After this is complete you are ready to edit the registry. To do this you are going to open run off the start menu. When this opens type regedit. This will bring up the systems registry.

 

Once regedit pops up you follow this path: HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions You will probably have to create the Internet Explorer and Restrictions part. Do this by right clicking on the Microsoft folder and clicking on new key. After this is complete you will see the Internet Explorer subkey, right click on this and create another New Key (Restrictions). Now you should be in the Restrictions subkey.

 

While you are in the Restrictions subkey go to the right side and right click in the empty space under Default. There you will select a DWORD Value from the list below. Once this is created you need to rename it as one of the restrictions (See Below).

 

After this is renamed double click on the restriction and change the value to a 1 and click OK (1 is On and 0 is Off).  If you need to go back and change any setting in IE that are locked all you need to do is go back into regedit and change the 1 to a 0 for the restriction DWORD. When you are done making adjustments just change the 0 back to a 1.

 

In HKEY_CURRENT_USER \Software\Policies\Microsoft\Internet Explorer\Restrictions

  The choices are:

• NoBrowserOptions: Turns off the Internet Options command on the Tools menu.
• NoFileOpen: Turns off the command on the menu.
• NoFindFiles: Turns the F3 command and the Search bar.
• NoHelpMenu: Disables the Internet Explorer Help menu.

After you have input all of the restrictions it is time to move onto the Local Machine policies(again you will need to create subkey's). Here you will go through the same steps as above for the following path:

HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions

  The choices are:

• NoToolBar: Removes the toolbar. However you can add standard buttons on the View Toolbar menu.
• NoToolbarOptions: The user recieves the error message when they try to click any command on the View menu except Customize and Lock the Toolbars.
• NoAddressBar: Removes the Address bar.

This is what HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Restrictions will look like when you are finished.

 

This is what HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\Toolbars\Restrictions will look like when it is complete.

 

One of the drawbacks is that the buttons that were there before are now gone so when you want to go back or forward you're going to have to right click and select it on the options(this is a picture of IE 7).

 

** There is currently no full proof way to lockdown access to IE, but this example should stop most users.