2

Duplicate on Server Fault:
Cannot seem to disable ability to view temporary internet files via group policy

Windows XP Pro SP3, IE8 (8.0.6001.18702), within local gpedit.msc I did the below:

  • User Config/Admin Temp/Windows Comp/IE
    • enabled: disable changing temporary internet file settings
  • User Config/Admin Temp/Windows Comp/IE/Delete Browsing History
    • enabled all (11 items)

However there is a loophole that lets me still wipe history & other files via: Tools, Internet Options, Browsing History, Settings, View Objects, delete everything, hit up arrow, go to History (hidden folders has to be on), delete everything

Only way around this I can see is one of the below:

  • disable General Internet Options Page via group policy
  • setup NTFS folder restrictions on that temp internet files (worried about adverse affects like not being able to store them)
  • further grind-down group policy somewhere else to prevent deleting files

Just find it odd group policy wouldn't have a settings to simply disable the Browser History Settings button (as it further shows the location which a user could just go to).

Ideal solution/answer: someone to confirm this is/is-not available in group policy & their suggested action

6
  • What are you trying to do? Disable caching of internet files? Or block a user from deleting their history? Oct 2, 2012 at 21:41
  • Apologize if that wasn't clear: ultimately trying to block a user from deleting their history+temp files. Please feel free to edit my post if you believe you can make it clearer...
    – gregg
    Oct 3, 2012 at 13:19
  • 1
    You cannot do that. You can try, but you can't guarantee that they will not alter them. If a user can write data to the files, then they can also write blank data to them (i.e., delete them). If you want to track what your users are doing, install a proxy and filter at the gateway on your network. (Also, if a user can touch the actual computer for about 5 minutes uninterrupted, then they also have enough time to gain full local administrator access (via reboot and safemode, or many other means) and completely ignore group policies) Oct 3, 2012 at 14:20
  • I understand there is always a loophole. Security & ease-of-use (usability) is always a tightrope you need to walk on. In this case I want an obvious loophole plugged: the ability to click the Settings button within Internet Explorer's Internet Options (General tab)
    – gregg
    Oct 4, 2012 at 20:09
  • My point is there's no security. The most obvious loophole is to delete the index.dat files which hold the history in %systemdir%\Documents and Settings\%username%\Local Settings\History\history.ie5 - Either you deny access, and history isn't recorded, or you allow access, and they can clear their history. If you are trying to enforce policies that users will knowingly subvert if they get the chance, then ease of use doesn't really factor into it. You need to log the information from a secure location if you need it to be reliable. Oct 4, 2012 at 21:00

1 Answer 1

1

As @Darth Android states in the above comments, this cannot be done. Temp/cache files are actively used and changed by the app, and cannot be locked in any way by anyone. The only way to achieve what you're looking for would be to create a very intense process or script which would create a copy of each cache file, perhaps adding it to a zip file stored locally on each computer, then the zip would be automatically transferred to a management host on a regular basis.

Not the answer you're looking for? Browse other questions tagged .