Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Duplicate on Server Fault:
Cannot seem to disable ability to view temporary internet files via group policy

Windows XP Pro SP3, IE8 (8.0.6001.18702), within local gpedit.msc I did the below:

  • User Config/Admin Temp/Windows Comp/IE
    • enabled: disable changing temporary internet file settings
  • User Config/Admin Temp/Windows Comp/IE/Delete Browsing History
    • enabled all (11 items)

However there is a loophole that lets me still wipe history & other files via: Tools, Internet Options, Browsing History, Settings, View Objects, delete everything, hit up arrow, go to History (hidden folders has to be on), delete everything

Only way around this I can see is one of the below:

  • disable General Internet Options Page via group policy
  • setup NTFS folder restrictions on that temp internet files (worried about adverse affects like not being able to store them)
  • further grind-down group policy somewhere else to prevent deleting files

Just find it odd group policy wouldn't have a settings to simply disable the Browser History Settings button (as it further shows the location which a user could just go to).

Ideal solution/answer: someone to confirm this is/is-not available in group policy & their suggested action

share|improve this question

closed as too localized by slhck Jan 11 '13 at 19:11

This question is unlikely to help any future visitors; it is only relevant to a small geographic area, a specific moment in time, or an extraordinarily narrow situation that is not generally applicable to the worldwide audience of the internet. For help making this question more broadly applicable, visit the help center.If this question can be reworded to fit the rules in the help center, please edit the question.

    
What are you trying to do? Disable caching of internet files? Or block a user from deleting their history? –  Darth Android Oct 2 '12 at 21:41
    
Apologize if that wasn't clear: ultimately trying to block a user from deleting their history+temp files. Please feel free to edit my post if you believe you can make it clearer... –  greggmcfg Oct 3 '12 at 13:19
1  
You cannot do that. You can try, but you can't guarantee that they will not alter them. If a user can write data to the files, then they can also write blank data to them (i.e., delete them). If you want to track what your users are doing, install a proxy and filter at the gateway on your network. (Also, if a user can touch the actual computer for about 5 minutes uninterrupted, then they also have enough time to gain full local administrator access (via reboot and safemode, or many other means) and completely ignore group policies) –  Darth Android Oct 3 '12 at 14:20
    
I understand there is always a loophole. Security & ease-of-use (usability) is always a tightrope you need to walk on. In this case I want an obvious loophole plugged: the ability to click the Settings button within Internet Explorer's Internet Options (General tab) –  greggmcfg Oct 4 '12 at 20:09
    
My point is there's no security. The most obvious loophole is to delete the index.dat files which hold the history in %systemdir%\Documents and Settings\%username%\Local Settings\History\history.ie5 - Either you deny access, and history isn't recorded, or you allow access, and they can clear their history. If you are trying to enforce policies that users will knowingly subvert if they get the chance, then ease of use doesn't really factor into it. You need to log the information from a secure location if you need it to be reliable. –  Darth Android Oct 4 '12 at 21:00

1 Answer 1

As @Darth Android states in the above comments, this cannot be done. Temp/cache files are actively used and changed by the app, and cannot be locked in any way by anyone. The only way to achieve what you're looking for would be to create a very intense process or script which would create a copy of each cache file, perhaps adding it to a zip file stored locally on each computer, then the zip would be automatically transferred to a management host on a regular basis.

share|improve this answer

Not the answer you're looking for? Browse other questions tagged or ask your own question.