Trying to suppress MSIE10 install via registry

(imported topic written by SystemAdmin)

Ultimately, I’m trying to add the following registry key/value pair so MSIE10 won’t be installed via Windows Updates:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\10.0] 

and I’m trying to do this via a fixlet that will be relevant only for Windows computers that don’t have this key/value pair already set.

I’m writing the relevance portion of this right now one small step at a time, debugging as I go. So far the relevance I’ve written is not giving me the response I expect on my workstation where this above key/value pair is already set. I’m using the Windows Q&A application to test the relevance (hence the Q&A format below). This is the relevance I’m starting with:

Q: exists key 
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Setup\10.0" of registry A: False T: 0.134 ms   Q: exists key 
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Setup" of registry A: True T: 0.143 ms

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\10.0 exists and has a key called DoNotAllowIE10 set to DWORD value 1.

I thought this might be a permissions issue for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\10.0 so I added a permission for the Everyone group to allow reading that key but this change in permissions changed none of the responses from Q&A.

I also saw that the permissions on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\10.0 and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup both inherit permissions from their respective parent keys.

So I don’t understand why Q&A


see the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\10.0 key but Q&A


see HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup?

(imported comment written by cstoneba)

i don’t know if blocking IE10 is the same as the previous IE versions, but if so, take a look at the existing fixlets in the TEM console to block IE7.

(imported comment written by SystemAdmin)

Thanks; I ended up using the TEM-supplied fixlets to block IE10 as there was one that pertained directly to MSIE10. I’ll have to figure out how that fixlet differed from my approach another time.

(imported comment written by SystemAdmin)

Not entirely answered, but I have a working reference in the extant fixlet I can use as a reference to look into differences between TEM’s fixlet and my own.