How to implement a GPO to block an Add-on?
You can use the Add-on List GPO to help you manage Internet Explorer add-ons.
Available GPO for: Add-on List
- REF: Computer Configuration
- REF: User Configuration
GPO CONFIGURATION:
- Open GPEDIT.MSC
- Navigate to Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management or User Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management
- Open Add-on List, select Enable, select Show
- On Show Contents, select Add.
Example:
For Value Name use Class ID {xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} [In the example below, we are using the Adobe Acrobat GUID: {CA8A9780-280D-11CF-A24D-444553540000}] and for Value use 0
VALUE ADD INFORMATION:
- 0 = The add-on is disabled, and users cannot manage the add-on from the user interface.
- 1 = The add-on is enabled, and users cannot manage the add-on from the user interface.
- 2 = The add-on is enabled, and users can manage the add-on from the user interface.
The Add-On List GPO Registry location (Example !)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext]
"ListBox_Support_CLSID"=dword:00000001[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID]
"{CA8A9780-280D-11CF-A24D-444553540000}"="0"
ARTICLES
ADDITIONAL INFORMATION ON SUPPRESSING THE NEW ADD-ON WARNING
If you want to suppress the NEW add-on warning "some add on are ready to use warning" two buttons "Enable" and "Don't enable". You could used the following registry key:
- Type "regedit" in RUN or start search box and press "Enter." It'll open "Registry Editor."
- Now go to following key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies
- Create a new key under "Policies" key and set its name to "Ext."
- Now select the new "Ext" key and in right-side pane, create a new DWORD "IgnoreFrameApprovalCheck" and set its value to 1
- In case, you have 64-bit edition of Windows then you need to follow the same steps 3 and 4 for the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion
- It will get disabled permanently
GPO: USER CONFIGURATION GPO or COMPUTER CONFIGURATION GPO
- Type "gpedit.msc" in RUN or start search box and press "Enter." It'll open "Group Policy Editor."
- Now go to: Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer
- In right-side pane, double-click on "Automatically activate/enable newly installed add-ons" option and set it to "Enabled."
- Now, the popup is permanently disabled in Internet Explorer.