How to implement a GPO to block an Add-on?

  • Article

You can use the Add-on List GPO to help you manage Internet Explorer add-ons.

Available GPO for: Add-on List

GPO CONFIGURATION:

  1. Open GPEDIT.MSC
  2. Navigate to Computer Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management  or User Configuration\Policies\Administrative Templates\Windows Components\Internet Explorer\Security Features\Add-on Management
  3. Open Add-on List, select Enable, select  Show
  4. On Show Contents, select Add.

Example:

For Value Name use Class ID {xxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx} [In the example below, we are using the Adobe Acrobat GUID: {CA8A9780-280D-11CF-A24D-444553540000}] and for Value use 0

VALUE ADD INFORMATION:

  • 0 = The add-on is disabled, and users cannot manage the add-on from the user interface.
  • 1 = The add-on is enabled, and users cannot manage the add-on from the user interface.
  • 2 = The add-on is enabled, and users can manage the add-on from the user interface.

The Add-On List GPO Registry location (Example !)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext]
"ListBox_Support_CLSID"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID]
"{CA8A9780-280D-11CF-A24D-444553540000}"="0"

ARTICLES

ADDITIONAL INFORMATION ON SUPPRESSING THE NEW ADD-ON WARNING

If you want to suppress the NEW add-on warning "some add on are ready to use warning" two buttons "Enable" and "Don't enable". You could used the following registry key:

  • Type "regedit" in RUN or start search box and press "Enter." It'll open "Registry Editor."
  • Now go to following key:   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies
  • Create a new key under "Policies" key and set its name to "Ext."
  • Now select the new "Ext" key and in right-side pane, create a new DWORD "IgnoreFrameApprovalCheck" and set its value to 1
  • In case, you have 64-bit edition of Windows then you need to follow the same steps 3 and 4 for the following key: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion
  • It will get disabled permanently

GPO: USER CONFIGURATION GPO or COMPUTER CONFIGURATION GPO

  • Type "gpedit.msc" in RUN or start search box and press "Enter." It'll open "Group Policy Editor."
  • Now go to: Computer Configuration -> Administrative Templates -> Windows Components -> Internet Explorer
  • In right-side pane, double-click on "Automatically activate/enable newly installed add-ons" option and set it to "Enabled."
  • Now, the popup is permanently disabled in Internet Explorer.