0

I need to force change the search provider programmatically for IE9 to K9SafeSearch. I have this working most of the way, but after the user logs in, they are shown the following prompt to confirm the change:

I cannot seem to find a way to force this confirmation so that the user does not see it. I need to deploy this to about 1000 library PCs, so I'd rather not log back into each one to confirm this. Since these PCs are locked (similar to DeepFreeze), the user would be prompted for this at each logon even if they confirmed the change - hence the need to force the confirmation.

Here are the keys I'm forcing (note that they are also pushed to HKLM):

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
    "DefaultScope"="{6107AD2D-B8EA-49F2-B501-464ADEEF4A85}"
    "DoNotAskAgain"=bing.com

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6107AD2D-B8EA-49F2-B501-464ADEEF4A85}]
    "DisplayName"="K9 Safe Search"
    "URL"="http://www.k9safesearch.com/search.jsp?r=o&q={searchTerms}"
    "OSDFileURL"="http://www.k9safesearch.com/providers.jsp?p=os"
    "FaviconURL"="http://www.k9safesearch.com/favicon.ico"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6107AD2D-B8EA-49F2-B501-464ADEEF4A85}\Non-Matches]
    "http://www.k9safesearch.com/providers.jsp?p=os"=hex:00,00,00,00,00,00,00,00
4
  • 2
    -1 These security measures were put in place by Microsoft to prevent evil sysadmins and ISVs like you and Google to forcing the One True Search Engine on users.
    – kinokijuf
    Feb 11, 2013 at 16:24
  • 1
    Why don't you just UPDATE the image then deploy the image to the computers? This way the change won't be reversed on a reboot.
    – Ramhound
    Feb 11, 2013 at 22:29
  • At the current point, I don't have a method to re-distribute an entire image to 1000 computers, unfortunately.
    – Beems
    Feb 12, 2013 at 4:02
  • @kinokijuf, why would Beems have bad intentions just because others might be evil?
    – Arjan
    Apr 7, 2013 at 14:47

4 Answers 4

2

There is no way around this. This is to prevent malware from changing search pages from under to you engines that further distribute malware or would direct you to fake sites.

2
  • Well, that isn't exactly what I wanted to hear, but is what I expected. Our next solution then is to make the change, then reboot, then log in, then have a custom application that opens IE, finds the option, and pushes the "Change" button. Either that or we have to log in to 1000 computers to change this.
    – Beems
    Feb 11, 2013 at 16:05
  • I can't answer my own question yet, but here is the answer: This can be completed by using the Internet Explorer Administration Kit. See this post from TechNet here: social.technet.microsoft.com/Forums/en-US/ieitprocurrentver/…
    – Beems
    Feb 11, 2013 at 17:08
1

This can be completed by using the Internet Explorer Administration Kit. From this Technet forum post:

Update the install.ins file and run the StubPath from the IE ActiveSetup registry key for our IEAK 9 Customization. This will reset the user to our default Custom deployment. I'll change the default search provider in the the [SearchProviders] section for the specific country's desired provider and run "RunDLL32 IEDKCS32.DLLL,BrandIE4 CUSTOM" to reimport the settings.

Kinda cool this command. It updates the settings even if the user has IE open.

0

Another alternative is using a Group Policy preference item to create the necessary registry entries. Granted, usually a Kiosk machine isn't domain joined but if it is that would work as well.

If you need a more management-friendly way for non-domainjoined PC's, there's also the possibility to use the LocalGPO tool from Microsofts Security Compliance Manager 3.0 to get the settings in your image.

0

How to create custom .adm (XP) or .admx (Vista) files to add search providers to the toolbar search box:

How to create a .adm file that includes the policy setting

Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base: 322756 How to back up and restore the registry in Windows

1.Decide which search providers that you want to provide to users.

2.Add these search providers to the registry. You can do this by adding search providers from the Internet. To do this, follow these steps: a.In Internet Explorer, click the search arrow in the upper-right corner. b.Click Find More Providers. c.A page opens that contains a list of supported search providers. Click to select a search provider, and then click Add Provider. This step adds the search provider to the search list. Click the search arrow again, and then verify that the newly-added search provider is present in the list. d.Repeat step c for each search provider that you want to add. e.Click Start, click Run, type regedit, and the click OK. f. Locate and then right-click the following registry subkey:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes

g.Verify that GUIDs that represent the search providers are listed under this subkey. Note You can also add your own search provider directly into the registry. In this case, create a registry key for that provider under the subkey that is listed in step 2f. Populate the key by using information that corresponds to that search provider. The GUID data is provided by the search provider.

3.Create a policy template. To do this, open a text editor such as Notepad, and then copy the following template into the Notepad file.

CLASS USER CATEGORY !!WindowsComponents CATEGORY !!InternetExplorer

POLICY !!PopulateSearchProviderList #if version >= 4 SUPPORTED !!SUPPORTED_IE7 #endif EXPLAIN !!IE_Explain_PopulateSearchProviderList KEYNAME "Software\Policies\Microsoft\Internet Explorer\SearchScopes" VALUENAME Version VALUEON NUMERIC ACTIONLISTON KEYNAME "Software\Policies\Microsoft\Internet Explorer\SearchScopes" VALUENAME DefaultScope VALUE ""

            KEYNAME "Software\Policies\Microsoft\Internet Explorer\SearchScopes\<SUBKEY1>"
            VALUENAME DisplayName  VALUE "<NAME1>"  
            VALUENAME URL               VALUE "<URL1>"
        END ACTIONLISTON
    END POLICY

END CATEGORY END CATEGORY

CLASS MACHINE CATEGORY !!WindowsComponents CATEGORY !!InternetExplorer END CATEGORY END CATEGORY

[strings] SUPPORTED_IE7="At least Internet Explorer 7.0" WindowsComponents="Windows Components" InternetExplorer="Internet Explorer" PopulateSearchProviderList="Populate List of search providers" IE_Explain_PopulateSearchProviderList="This policy setting will let you populate a list of search providers that will be displayed in the Internet Explorer search box.\n\n If you enable this policy setting and if the "Restrict search providers to a specific list of search providers" Group Policy setting is enabled, this list will be the only list that appears in the Internet Explorer drop-down list. If the "Add a specific list of search providers to the user's search provider list" Group Policy setting is enabled, this list will be added to the user's list of search providers.\n\n If you disable this policy setting or do not configure it, users will have complete freedom to create their own search provider list."

Note If you require a user policy, use User class. If you require a machine policy, use Machine class.

4.Populate the policy template by using the same values that populate the registry key that designates your preferred search providers. To do this, follow these steps: a.Click Start, click Run, type regedit, and the click OK. b.Locate and then right-click the following registry subkey: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes

c.Replace in the template file by using the data for the REG_DWORD version. d.Copy the name of the first subkey that is listed under the SearchScopes key, and then use it to replace in the template. e.Copy the data strings for DisplayName and for URL, and then use these data strings to replace and in the template. f.For each search provider that is listed under SearchScopes, create and populate the following section of the template by repeating steps b through e.

ACTIONLISTON KEYNAME "Software\Policies\Microsoft\Internet Explorer\SearchScopes" VALUENAME DefaultScope VALUE ""

            KEYNAME "Software\Policies\Microsoft\Internet Explorer\SearchScopes\<SUBKEY1>"
            VALUENAME DisplayName  VALUE "<NAME1>"  
            VALUENAME URL               VALUE "<URL1>"

KEYNAME "Software\Policies\Microsoft\Internet Explorer\SearchScopes\" VALUENAME DisplayName VALUE ""
VALUENAME URL VALUE "" END ACTIONLISTON

g.Replace in the template file with one of the instances. For example, replace in the template file with . h.Copy the whole policy section that you have just created and use it to replace the following text:

5.Save the file as a *.adm file. For example, save it as SearchProvider.adm.

6.Verify the results. To do this, follow these steps. a.Open Group Policy Object Editor. b.Click Computer Configuration, expand Administrative Templates, Right-click Administrative Templates, click Add/Remove Templates, and then click Add to add the SearchProvider.adm file that you have created. c.Expand Computer Configuration, expand Administrative Templates, expand Windows Components, and then click Internet Explorer. d.Search for the Populate list of search providers policy setting, and then enable this policy setting. e.In the registry, locate and then right-click the following registry subkey to verify that you have enabled the policy: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Internet Explorer\SearchScopes

f.Expand User Configuration, expand Administrative Templates, expand Windows Components, and then click Internet Explorer. g.Search for the Populate list of search providers policy setting, and then enable this policy setting. h.To verify this setting, locate and right-click the following registry subkey: HKEY_CURRENT_USER\Software\policies\Microsoft\Internet Explorer\SearchScopes

How to create an .admx file that includes the policy setting

1.Open a text editor such as Notepad, and then copy the following template into the Notepad file.

NAME1
URL1 Insert same as user policy above

2.Replace the "VERSION," "NAME1," "URL1," and "SUBKEY1" strings by using the information that you collected in step 4 of the "How to create a custom .adm file that includes the policy setting" section.

3.Copy the whole policy section that you have just modified and use it to replace the following text: Insert same as user policy above

4.Save the file as an .admx file. For example, save it as SearchProvider.admx.

5.Copy the .admx file to the %windir%\policydefinitions folder.

Note If the specified URL contains a "&" character, you must replace the "&" with the following:

&

This is because "&" is a special character in XML.

For example, if the search URL is "http: //search.msn.com/results.aspx?g={searchTerms}&locale={language}&FORM=I7AW," you must enter the following search URL in the .admx file:

http: //search.msn.com/results.aspx?g={searchTerms}&locale={language}&FORM=I7AW

How to create a SearchProvider.adml file

1.Open a text editor such as Notepad, and then copy the following template into the Notepad file.

enter display name here enter description here Populate List of search providers This policy setting will let you populate a list of search providers that will be displayed in Internet Explorer's search box.

If you enable this policy setting and if the "Restrict search providers to a specific list of search providers" Group Policy setting is enabled, this list will be the only list that appears in the Internet Explorer drop-down list. If the "Add a specific list of search providers to the user's search provider list" Group Policy setting is enabled, this list will be added to the user's list of search providers.

If you disable this policy setting or do not configure it, users will have complete freedom to create their own search provider list.

2.Replace "enter display name here" by using the display name that you used in step 4e of the "How to create an .adm file that includes the policy setting" section.

3.Type a description to replace the "enter description here" string.

4.Save the file as an .adml file. For example, save it as SearchProvider.adm1.

5.Copy the .adml file to the %windir%\policydefinitions\language directory folder.

This policy setting lets you add a set of search providers to the user's default search provider list. Ordinarily, a user can add search providers during setup or by using a third-party toolbar. However, a user can also add a search provider by using the search provider's Web site. If you enable this policy setting, a user can add and remove search providers. However, a user cannot add and remove search providers from the list of search providers that you provide by using Group Policy. If you disable this policy setting or do not configure it, the user can configure the search provider list unless another policy setting restricts this configuration.

In the above where it talks about replacing the "&" character it does not show the replacement correctly in the posting, look at the cited link to see the correct replacement.

Cited from: http://support.microsoft.com/kb/918238

1
  • Welcome to Superuser, Please post all information relevant to your answer in your answer to avoid link rot. You can still sight the KB item as a source.
    – 50-3
    Sep 12, 2013 at 21:35

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .