Windows scripting question-how to make settings in IE "grayed out" so users can't change?

[MichaelD]

Running a NT domain; no AD and no Group Policy, obviously.

We created a .vbs that is called by the logon script that sets a proxy server in IE; it adds a registry key to the Local Machine that sets it.

The script works fine. The problem is that the settings are not "grayed out" in IE and users can go in and uncheck the box, thereby defeating the proxy server.

What lines do I need to add to the script in order to "gray out" the settings.

Here's the script; please don't laugh too hard. I'm a complete script n00b and I stole most of this from someplace else. Thanks for your help.


Const HKCU=&H80000001 'HKEY_CURRENT_USER
Const HKLM=&H80000002 'HKEY_LOCAL_MACHINE

Const REG_SZ=1
Const REG_EXPAND_SZ=2
Const REG_BINARY=3
Const REG_DWORD=4
Const REG_MULTI_SZ=7

Const HKCU_IE_PROXY = "Software\Microsoft\Windows\CurrentVersion\Internet Settings"

Const Proxy_Server = "192.168.202.16"
Const Proxy_Server_Port = 8080

Set oReg=GetObject("winmgmts:!root/default:StdRegProv")

Main

Sub Main()

If GetValue(HKCU,HKCU_IE_PROXY,"ProxyEnable",REG_DWORD) = 0 Then

strProxyServer = Proxy_Server & ":" & Proxy_Server_Port
strProxyOveride = "<local>"

CreateValue HKCU,HKCU_IE_PROXY,"ProxyServer",strProxyServer,REG_SZ
CreateValue HKCU,HKCU_IE_PROXY,"ProxyEnable",1,REG_DWORD
CreateValue HKCU,HKCU_IE_PROXY,"ProxyOverride",strProxyOveride,REG_SZ

End If

End Sub

Function CreateValue(Key,SubKey,ValueName,Value,KeyType)
Select Case KeyType
Case REG_SZ
CreateValue = oReg. SetStringValue(Key,SubKey,ValueName,Value)
Case REG_EXPAND_SZ
CreateValue = oReg. SetExpandedStringValue(Key,SubKey,ValueName,Value)
Case REG_BINARY
CreateValue = oReg. SetBinaryValue(Key,SubKey,ValueName,Value)
Case REG_DWORD
CreateValue = oReg. SetDWORDValue(Key,SubKey,ValueName,Value)
Case REG_MULTI_SZ
CreateValue = oReg. SetMultiStringValue(Key,SubKey,ValueName,Value)
End Select
End Function

Function DeleteValue(Key, SubKey, ValueName)
DeleteValue = oReg.DeleteValue(Key,SubKey,ValueName)
End Function

Function GetValue(Key, SubKey, ValueName, KeyType)

Dim Ret

Select Case KeyType
Case REG_SZ
oReg.GetStringValue Key, SubKey, ValueName, Value
Ret = Value
Case REG_EXPAND_SZ
oReg.GetExpandedStringValue Key, SubKey, ValueName, Value
Ret = Value
Case REG_BINARY
oReg.GetBinaryValue Key, SubKey, ValueName, Value
Ret = Value
Case REG_DWORD
oReg.GetDWORDValue Key, SubKey, ValueName, Value
Ret = Value
Case REG_MULTI_SZ
oReg.GetMultiStringValue Key, SubKey, ValueName, Value
Ret = Value
End Select

GetValue = Ret
End Function

 

[gsellis]

Sorry, but I do not have all the time I need to explain this. Secedit is your friend.

MSKB start here

You create Security Templates, which are similar to local group policies. They can load the IE templates and set the settings there much like you might do with some of the IEAK settings (which is another tool to use). Then you load them with Secedit.

Even so, if you can find the GPO setting covering the Policy item (they are just reg keys after all - well mostly), you have it. You might then have to define a startup script (hey, another gpo registry entry) to set the keys at startup.

 

[MichaelD]

Thanks very much, gsellis. That's some good stuff. I appreciate it. I'll test it out soon.

 

[gsellis]

There is some stuff around on security templates. MS even released a tool with W2K3 server IIRC for creating custom ones (which is no big chore - security template infs are just a custom structure code like a xml file). But I think most of the settings can be enumerated in the MMC plugin.

edit - footnote - don't modify the MS supplied ones. They change with service packs and could be a target of a hotfix update.