Trying to suppress MSIE10 install via registry

Content Authoring
1

(imported topic written by SystemAdmin)

Ultimately, I’m trying to add the following registry key/value pair so MSIE10 won’t be installed via Windows Updates:

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\10.0] 
"DoNotAllowIE10"=dword:00000001

and I’m trying to do this via a fixlet that will be relevant only for Windows computers that don’t have this key/value pair already set.

I’m writing the relevance portion of this right now one small step at a time, debugging as I go. So far the relevance I’ve written is not giving me the response I expect on my workstation where this above key/value pair is already set. I’m using the Windows Q&A application to test the relevance (hence the Q&A format below). This is the relevance I’m starting with:

Q: exists key 
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Setup\10.0" of registry A: False T: 0.134 ms   Q: exists key 
"HKLM\SOFTWARE\Microsoft\Internet Explorer\Setup" of registry A: True T: 0.143 ms

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\10.0 exists and has a key called DoNotAllowIE10 set to DWORD value 1.

I thought this might be a permissions issue for the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\10.0 so I added a permission for the Everyone group to allow reading that key but this change in permissions changed none of the responses from Q&A.

I also saw that the permissions on HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\10.0 and HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup both inherit permissions from their respective parent keys.

So I don’t understand why Q&A

can’t

see the HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup\10.0 key but Q&A

can

see HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Setup?

2

(imported comment written by cstoneba)

i don’t know if blocking IE10 is the same as the previous IE versions, but if so, take a look at the existing fixlets in the TEM console to block IE7.

3

(imported comment written by SystemAdmin)

Thanks; I ended up using the TEM-supplied fixlets to block IE10 as there was one that pertained directly to MSIE10. I’ll have to figure out how that fixlet differed from my approach another time.

4

(imported comment written by SystemAdmin)

Not entirely answered, but I have a working reference in the extant fixlet I can use as a reference to look into differences between TEM’s fixlet and my own.