Stop Users Deleting History 2

[roblay22]

Does anyone know a way of stopping users from deleting their IE history under XP, using the "clear history" button in internet options??

I haven't been able to find a way of doing this yet.

Thanks in advance.

 

[mikiemov]

If your users all use XP, and you have a 2000 / 2003 domain, this can be restricted by creating a GPO.

I have implemented this in our office and nobody can clear / delete history

Mike,

 

[bcastner]

http://www.regxplor.com/tweak15.html

for general hints on registry entries for IE Options.

Open a notepad session and copy/paste the below. Save the file as no_history.reg :

******* begin copy/paste below this line
REGEDIT4

[HKEY_CURRENT_USER\Software\Policies\Microsoft\Internet Explorer\Control Panel]
"History"=dword:00000001

******** end copy/paste above this line

In your user logon script add:

regedit /s no_history.reg

 

[roblay22]

Thanks bcastner I've done that and it works a treat

Cheers

 

[bcastner]

You are very welcome.
Bill Castner

 

[mikiemov]

Quick question, is directly changing the registry better than restricting via GPO ?

My reasoning for this, was if another user (who we want to be able to change history) would be able to on this pc or any other they log on to...

Mike

 

[roblay22]

Mike,

In this case it is simply a single user who always uses the same machine and has been warned that his internet usage will be monitored so has started deleting his history. We don't want to impliment a group policy on the nework since this is confined to a single user in a single department and simply want to check his history every no and then.
That said I agree with your thinking, the registry change will affect all users (as I understand it) and so wouldn't really be suitable if you had different users working in the same machine.

 

[mikiemov]

Ah, wasnt obvious that it was a single user....

Was panicking there !

 

[bcastner]

Notice that the registry entry is for HKEY_Current_User. This means it only applies to the user who has the entry in their logon script.

The Group Policy change can be found in gpedit.msc here:

User Configuration
Administrative Templates
Windows Components
Internet Explorer
Internet Control Panel
Disable Changing History Settings

In a Domain you could create OUs and apply the policy selectively. On a single machine the policy would apply to all users. From the Description:

Prevents users from changing the history settings for the browser.

If you enable this policy, the settings in the History area on the General tab in the Internet Options dialog box appear dimmed.

If you disable this policy or do not configure it, users can change the number of days to store Web page information and clear Web page history.

If you set the "Disable the General page" policy (located in \User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel), you do not need to set this policy, because the "Disable the General page" policy removes the General tab from the interface.

As I said above, with the registry edit you can be more granular in both non-domain and domain settings.

Best,
Bill Castner

 

[mikiemov]

bcastner, thanks for explanation.... very helpful

Mike,

 

[roblay22]

Bill,

Yep, spotted that now, where do you find the logon scripts to edit them?? I might be staring it in the face but its been one of those days!

Cheers

 

[mikiemov]

look in the sysvol folder on a DC..

Mike,

 

[roblay22]

Thanks Mike

Here's another question, can you not apply a GPO to a group rather than an OU, I have an issue here where the user is in an OU with GPO's already applied to the OU but it has ither users in it that I'm not worried if they clear the history. Could I put this user in a group on his own and then apply the GPO to it so that I don't affect the other users in the OU??

Cheers
Rob

 

[bcastner]

Open notepad and create a new file called No_history.cmd
It will contain one line:
regsvr32 /s no_history.reg

Now place that, and the no_history.reg file from earlier into the user profile at the folder:

\Documents and Settings\user name\Start Menu\Programs\Startup

Sometimes it is just easier to handle one-off exceptions in a one-off fashion.

If there are a lot of users in this position, use Group Policy. I am 92% positive you will have to enable group policy loopback processing on the OU members in this case.

 

[mikiemov]

Can only do that by amending rights to the GPO...

For ease, you could create a "sub ou" containing only specific users, and apply a GPO to that OU. As long as you dont block inheritance all previous GPOs will be applied..

Mike,

 

[mikiemov]

For avoidance of doubt, I was writing my reply when bcastner submitted his !!

Mike,

 

[roblay22]

Mike, I hadn't thought of that, thanks.

Bill, I'm just trying your solution, it works but I get registry dialogues popping up asking me if I want to allow the change to the registry, and then informing me that it has done it. Is there some way that I can stop these appearing, or at least get them to automatically "ok" the dialogues???

Rob

 

[bcastner]

Did you miss the "/s" parameter?

regedit /s no_history.reg

This does a registry merge without prompting for confirmation.