Script to block IE7 update??

[ldmak90]

Ok here's the scenario:

IE7 will be pushed as a critical update on November 1st.

They have provided a block utility that writes a registry key/value to block IE7 from being received as an automatic update.

My company is going to send out a global email advising everyone not to install IE7 at this time and they want to provide a link within that email that the user can click on and that will execute a script that writes the IE7 blocking registry key.

We will also be utilizing Group Policy to block IE7. However, there are some number of computers on the network that are not actually joined to the domain. This is why management would like to provide a link that the user can click on to run a script.

I'd like to know how to accomplish this using vbscript unless you all can recommend another way?

Not all users have local admin rights as well.

So, I'm guessing I'd at least have to do a Run as or find a way to run something in system context?

Any ideas or help would be GREATLY appreciated...

LD

 

[porkchopexpress]

For the users that aren't admins you could use Runas to elevate the privilages of your script.

http://www.palmersoft.co.uk/software/runasuser.asp

When you are the IT director, it's your job to make sure the IT works. If it does work they know already and if it doesn't, they don't want to hear your pathetic excuses.

 

[markdmac]

Microsoft has released a blocker tool. Why don't you use that?

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[markdmac]

here is the link for the blocker tool.

http://www.microsoft.com/technet/updatemanagement/windowsupdate/ie7announcement.mspx

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[ldmak90]

Hmm... I guess I'll test to see if the blocker utility requires local admin rights to work. If not, then you're right I could just use that and let users run it. Otherwise, I'll still need to find a way to script it. I was hoping to do some logging to a log share so we can actually see who clicked on the link and ran the script.

 

[markdmac]

The blocker utility is configured on the server and pushes down. It is designed for enterprise use.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[ldmak90]

The blocker utility is configured on the server and pushes down?

I don't understand.

 

[markdmac]

The blocker utility prevents the local machines from pulling down IE7 via Windows Update.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

 

[ldmak90]

oh ok.. yes I understand that. However, it has to be run on each computer that requires blocking. It doesn't run on a server and push down.

Although it does come with an ADM file to import into Group Policy.

Thanks again everyone.. .I'll let you know what I came up with...

LD

 

[58sniper]

Oh - and MS has been pushing IE7 through updates for the last few days. Dunno why they're saying November 1st.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[ldmak90]

Hmm... I haven't experienced the IE7 Update yet. Not sure why you have.. but I hope that hasn't been the case.

Due to a few issues in my company's environment we took a few different actions. By a few issues in the environment I mean non standardization (local admin passwords are all different, no patching solution like SMS or WSUS, not all computers are joined to the domain, not all users authenticating to AD, etc... etc... just think of the biggest bowl of mess soup you can imagine).

So, I implemented Group Policy to block IE7 as an automatic update, Developed a simple script that anyone can run (with local admin rights) to write the registry key that blocks IE7 from being received as automatic update, sent out a global email to the entire population to warn that they should not choose to install IE7 if prompted during automatic updates and also click on an included link to make the registry change, and provided the script to all staff so they can manually use it on any computers in the environment as necessary.

FYI:

IE7 will automatically download but will prompt the user to install or not.

IE7 will NOT be offered as an automatic update to users who do not have local admin rights.

You can roll back to IE6 afterwards if necessary

We're looking at tightening up AD, standardizing the production environment, touching every machine to get them all joined into the domain and all users authenticating to AD and implementing SMS. We're way behind the times right now.. but this event has opened everyone's eyes to some new ways of doing things.

Thanks again,

LD

 

[58sniper]

We've seen it pushed to dozens of machines so far. Ever since last week.

Pat Richard, MCSE MCSA:Messaging CNA
Microsoft Exchange MVP
Want to know how email works? Read for yourself -

http://www.ietf.org/rfc/rfc2821.txt

 

[markdmac]

I thik everyone will be seeing it happen as of today.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript