Internet Explorer Maintenance brndlog.txt, what is it and how to use it when troubleshooting?
The brndlog.txt file shows how Internet Explorer was branded during user logon. The Brndlog.txt is the log file generated by the IE client-side extension iedkcs32.dll. This file contains branding information from IE Maintenance Policies and will be the most important item to gather during troubleshooting IE Maintenance Policies.
IMPORTANT: Windows 8 with Internet Explorer 10 deprecates IEM in favor of a more robust tool called Group Policy Preferences. Read More...
Where do I find the logfile?
The location for the logfile varies depending the OS:
| WinXP and Server 2003 | Vista, and beyond: |
| %USERPROFILE%\Local Settings\Application Data\Microsoft\Internet Explorer | %USERPROFILE%\AppData\Local\Microsoft\Internet Explorer |
When the branding itself is applied, information about the branding is stored in the logfile brndlog.txt, and the logfile for the previous branding has been renamed to brndlog.bak
Logfile-conversations:
When branding has been applied the last brndlog.txt is remaned to brndlog.bak, and the new one is named brndlog.txt.
As multiple branding can be applied you can also set the following regkey so the brndlog.txt is not overwritten - which is especially useful when analyzing new profiles, or GPOs, where multiple processes are spawned:
For IE8:
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Setup\8.0]
(DWORD)"DebugAppendBrndLog"=1
For IE9:
[HKLM\SOFTWARE\Microsoft\Internet Explorer\Setup\9.0]
(DWORD)"DebugAppendBrndLog"=1
Determine the Branding-method:
The Brndlog.txt file contains Internet Explorer maintenance policy branding information. It may also contain branding information from IEAK packages and manually created Install.ins files (usually used with Auto-configuration). The first step in reviewing a Brndlog.txt file is to confirm that the settings are coming from Group Policy.
Determine the method of Branding by looking for the /mode section after the Command Line.
Example of brndlog.txt from IEAK:
Branding Internet Explorer...
Command line is "/mode:corp /peruser".
Global branding settings are:
Context is (0x01A00002) "Corporations, running from per-user stub";
Settings file is "C:\Program Files\Internet Explorer\Custom\install.ins";
Target folder path is "C:\Program Files\Internet Explorer\Custom".
Done.
Example of brndlog.txt from Group Policy:
Branding Internet Explorer...
Command line is "BrandInternetExplorer /mode:gp /ins:"C:\Documents and Settings\test3\Local Settings\Application Data\Microsoft\Internet Explorer\Custom Settings\Custom0\INSTALL.INS" /flags:eriu=1,favo=1,qlo=1,swu=1,sbs=1".
/mode:gp - indicates branding is coming from Group Policies.
/mode:corp /peruser - Indicates an IEAK brand is taking place.
Example of IEM in Preference Mode from Group Policy:
Global branding settings are:
Context is (0x02800200) "Group Policy, preference settings";
Target folder path is "C:\Documents and Settings\test3\Application Data\Microsoft\Internet Explorer\Custom Settings\Custom0
Example of IEM in Policy Mode from Group Policy:
Global branding settings are:
Context is (0x00800200) "Group Policy";
Settings file is "C:\Documents and Settings\test3\Application Data\Microsoft\Internet Explorer\Custom Settings\Custom0\INSTALL.INS";
NOTE: Remember that Preference Mode settings are only applied ONCE - even if you execute gpupdate /force.
Common errors which might occur in brndlog.txt
Favorite is not created
05/11/2007 17:52:14 Preprocessing "Title31" title key...
05/11/2007 17:52:14 Preprocessing "URL31" URL key...
05/11/2007 17:52:14 Failed with E_NOTIMPL.
See the following KB
967728 You cannot deploy favorites with URLs that contain the % character: https://support.microsoft.com/default.aspx?scid=kb;EN-US;967728
IE-Branding needs 20 seconds to be executed
10/25/2007 10:36:37 Refreshing browser settings...
10/25/2007 10:36:37 Broadcasting "Windows settings change" to all top level windows...
10/25/2007 10:36:57 Done.
You will see the gap of 20 seconds between the line Broadcasting … and Done
Typically the issue is solved after installing the following KB + settings its FeatureControl-key
- 941158 After Internet Explorer Maintenance Group Policy settings are configured in a domain, a 20-second delay occurs when you log on to the domain from a client computer that has Internet Explorer 7 or Internet Explorer 8 installed
There is also one exception, in which this issue can occur, but the fix is not solving the issue:
In case that IEM including a security-import (seczones-processing) was enabled for the user, but has been removed, the delay occurs for one time when the seczones are reset to default. In this case, brndlog.txt will contain the following lines:
12/14/2010 11:05:53 Processing reset of zones settings...
12/14/2010 11:05:53 "RegInstall" on "IEAKReg.HKCU" in "urlmon.dll" returned S_OK.
12/14/2010 11:05:53 Done.
12/14/2010 11:05:53 Done.
12/14/2010 11:05:53 Refreshing browser settings...
12/14/2010 11:05:53 Broadcasting "Windows settings change" to all top level windows...
12/14/2010 11:06:13 Done.
The information, that previously secimport has been done is indicated by the following regkey:
[HKCU\Software\Microsoft\Ieak\BrandedFeatures]
(DWORD)"Zones.Hkcu"
Therefore it is a good idea to remove the key [HKCU\Software\Microsoft\Ieak\BrandedFeatures] from a mandatory profile in order to prevent the delay with every logon, when you removed Securityzones import in IEM.
Security Settings are not applied
03/10/2010 15:30:50 Processing local machine policies and restrictions...
03/10/2010 15:30:50 ! processExtRegInfSectionHelper for section"ExtRegInf.Hklm".
03/10/2010 15:30:50 ! Key is "SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}".
03/10/2010 15:30:50 Not Delaying executing C:\Documents and Settings\test\Local Settings\Application Data\Microsoft\Internet Explorer\Custom Settings\Custom0\seczones.inf.
03/10/2010 15:30:50 ! Execution of section [IeakInstall.Hklm] in "seczones.inf" failed with E_ACCESSDENIED.
03/10/2010 15:30:50 ! Key is "SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}".
03/10/2010 15:30:50 Machine is not hardened
03/10/2010 15:30:50 Done.
03/10/2010 15:30:50 Processing current user policies and restrictions...
03/10/2010 15:30:50 ! processExtRegInfSectionHelper for section"ExtRegInf.Hkcu".
03/10/2010 15:30:50 ! Key is "SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}".
03/10/2010 15:30:50 Not Delaying executing C:\Documents and Settings\test\Local Settings\Application Data\Microsoft\Internet Explorer\Custom Settings\Custom0\seczones.inf.
03/10/2010 15:30:50 ! Execution of section [IeakInstall.Hkcu] in "seczones.inf" failed with E_ACCESSDENIED.
03/10/2010 15:30:50 ! Key is "SOFTWARE\Microsoft\Active Setup\Installed Components\{A509B1A8-37EF-4b3f-8CFC-4F3A74704073}".
03/10/2010 15:30:50 Machine is not hardened
03/10/2010 15:30:50 Done.
In this sample, the policy Security Zones: Use only machine settings was enabled, but a normal user logged on. The normal user has no permissions to write into [HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings] and therefore the GPO cannot be applied and fails.
For these types of scenarios, we encorage customers to change from IEM to the policy-templates ( e.g. the Internet Zone Template and Site to Zone Assignment List ), because the machine-based settings would also change if different users with different settings log on to the server.
Branding from IEAK-Profilemanager does not apply with IE8
05/20/2010 14:32:06 FCK not set to allow autoconfig branding, or Automatically Detect Settings is checked under LAN Settings
973529 Automatic configuration does not work in Internet Explorer 8 : https://support.microsoft.com/default.aspx?scid=kb;EN-US;973529
[ You need to set the FCK FEATURE_AUTOCONFIG_BRANDING ]
Branding from IEAK-package or IEAK-Profilemanager does not apply
Besides of the FCK mentioned above, you may receive this lines in brndlog.txt:
05/20/2010 14:44:00 Branding Internet Explorer...
05/20/2010 14:44:00 Command line is "/mode:autoconfig /ins:"C:\Documents and Settings\test\Temporary Internet Files\Content.IE5\EPM0UQFI\install[1].ins"".
05/20/2010 14:44:00 ! NoExternalBranding restriction is set. Branding will not be applied.
05/20/2010 14:44:00 Done.
This occurs, if the policy Disable external branding of Internet Explorer has been enabled.
Removing Internet Explorer Maintenance Processing
In case that you do not want to remove IE Maintenance from a policy, you need use the context menu on"Internet Explorer Maintenance" within the "Group PolicyEditor" and choose "Reset browser settings". This will remove
the current settings to apply anymore, but the client side extension will still be applied, e.g. in order to reset security settings when they were configured in the policy as mentioned above.
When you want to remove the extension from the policy at all, please follow the steps outlined in the following KB:
2722241 Policy reporting tools indicate empty Internet Explorer Maintenance policy as winning: https://support.microsoft.com/kb/2722241/EN-US