Internet Explorer appears to ignore Windows NT Policy

[Graham Morecroft]

We have policies in place that stop any user logged into the domain from changing display settings. However, we have discovered that a user can access an internet page and right click any picture and STILL save it as wallpaper.

Does anybody have any ideas how this can be prevented?

The PCs in question are running Windows NT 4.0 SP5 and IE4.01 SP2.

[Jamie Hughes · Accepted solution]

Hello Graham,

I believe the policy you setup only affects changing the wallpaper via Control Panel. This appears to be the case with W2K as well. The only way I've found to get around this is to edit the security settings on the Desktop key in the registry to only allow read access to Everyone. However, some programs that write to the registry directly may be able to change the security and write to the registry entry anyway.

The only machine I have to test on at the moment is W2K. Hopefully you can test this out in your environment. Just go into the Desktop key in the registry (I believe it's under HKEY current user\control panel\desktop) and highlight the Desktop key. Then go to Security - Permissions and restrict the permissions for the Everyone group to Read only. Then test it with IE and see if you can still change the wallpaper.

I hope that helps you out. Sorry I couldn't do any testing for you in a 4.0 environment. Please let us know if that works.

Best regards,
Jamie Hughes

[Graham Morecroft]

Thanks Jamie,

That appears to work on a standalone machine (albeit a message appears stating "unspecified error" - but I can live with that!)

I will try it on the domain on another site at the beginning of next week and let you know how it works there, as I have to merge it into a mandatory profile.