Just started with this company, for years they could not modify Baselines within the BigFix Console on Windows 11 workstations. This DOES work when you remote into a Server and use the console there, but on regular Windows 11 workstations, nobody could get it to work.
-
When you click on “go to source” or move a component up or down, the UI just sits there
-
Likewise in Actions, when seeing baseline actions under computers, you can double click to view Action Info, but clicking on sub action status does nothing, no new popup, no freezing, no errors.
We recently upgraded to Server and Consoles 11.0.6 from 10.0.9 so I thought moving there would reduce the dependencies on Internet Explorer policies, but the issue still occurs. I tried various registry settings to force webview2, added internet explorer zone exceptions system wide, but I just cant get it to work on Endpoints
The console renders UI elements from local files (usually residing in the AppData or Program Files temp directories), standard Internet Explorer Trusted Site zone exceptions do not apply. Instead, they are governed by local machine zone security policies.
This is almost certainly a Group Policy issue, which perfectly explains why the console works on Windows Servers but fails on Windows 11 workstations.
To definitively prove this is GPO/Policy related and not an installation corruption, take one of the problematic Windows 11 workstations and temporarily move its AD computer object into another OU. Run a gpupdate /force, reboot, and test the consolw to see if the Baseline editor and Action Info panels start working.
This sounds like the issues that we have encountered as well, related to the console installed on Windows 11 clients. We also followed the instructions in KB0095457, which describes how to fix problems related to “Script Error when editing a Baseline”
One thing that we concluded is that on our machines, we had to define the Process List Exclusion on the computer level, instead of the user level.
Try this modified approach:
- On the windows computer running the BES Console, open Command Prompt or PowerShell with admin privileges and type 'gpedit' and hit Enter to launch the Local Group Policy Editor.
- In the Local Group Policy Editor, expand Computer Configuration
- Expand Administrative Templates
- Expand Windows Components
- Expand Internet Explorer
- Expand Security Features
- Click on Protection From Zone Elevation
- Use the Process List to exclude the BESConsole.exe from protection.
When we defined the exclusion of BESConsole.exe on the Computer level, everything started to work as expected in the console also on our Win11 clients.
Hope this helps for you as well.
3 Likes
that did it, I literally thought I did this but must’ve targetted HKCU, I used the following registry keys
HKLM:\Software\Policies\Microsoft\internet explorer\main\featurecontrol\FEATURE_ZONE_ELEVATION\ dword “BESConsole.exe” = 0
2 Likes
