Over the past few months, many of you have shared with me your need to continue to be able to offer support for Internet Explorer 6 specific application while rolling out Windows 7 and Internet Explorer 8 into your organization. Suggestions for walkthroughs, papers and application compatibility lists were made by many of you. Based on those conversations, I am very happy to offer the following resources to help you.
I’m a week late posting about this but I felt that it’s such an important topic that I should go ahead and still post despite being late. 20 years ago last Monday, the Americans with Disabilities Act was signed into law. With current estimates of 20% or more of the U.S. population having some level of disability, I thought it I would take a moment to highlight some of the work we’ve done in Windows 7 to make it universally accessible to everyone including those with disabilities. Microsoft considers it a high priority to make our software accessible to those with disabilities.
Product groups across the company invest a lot in developing technologies that enable PCs, applications, and the web to be accessible regardless of disabilities. With Windows 7, we did a bunch of work to improve accessibility features in Windows 7. You can read this blog post from E7 that discusses some of the engineering work we did in Windows 7 to improve accessibility – not just with our own built-in accessibility utilities but also to make it easier for others to build their own with accessibility software for Windows 7. Internet Explorer 8 also brought improved accessibility for browsing the web.
For more information on accessibility features in both Windows 7 and IE8 – I suggest checking out our Accessibility at Microsoft website. On this website, you will find tutorials and demos of many of the accessibility features in Windows 7 and IE8 today. You can also find a list of accessibility products for Windows that can help people with all types of disabilities. It is an excellent resource for all the work we’re doing here at Microsoft on making our products accessible to everyone.
Today is earnings day and Windows continues to have a strong showing. We announced a new milestone in Windows 7 sales – 175 million copies. This continues our record breaking pace of more than 7 copies sold per second. And as of today – Windows 7 is now running on more than 16% of all PCs worldwide. It’s exciting to see this kind of response from customers who have helped make Windows 7 the fastest selling operating system in history. We are also seeing some strong momentum with businesses for Windows 7. The PC “refresh cycle” for businesses has accelerated and we recorded the second straight quarter of double digital business license growth. And with Internet Explorer, IE8 is now the fastest growing and most popular web browser in the market and we have IE9 coming!
This strong momentum isn’t limited to Microsoft – in fact we’re seeing strong growth across the tech industry. Last week we highlighted a recent IDC press release that illustrated the growth of the global PC market – more than 22.4% year-over-year for the second quarter of 2010. Intel reported its best quarter ever with second quarter revenue up 34% year-over-year. And AMD reported a whopping 40% growth year-over-year in its earnings release, due to record sales of their chips for notebook computers. It’s great to see this kind of growth across the PC ecosystem and we’re pleased to be part of this growth with Windows 7.
This weeks post is from Carl Luberti, a Senior Support Escalation Engineer with the Internet Explorer team.
To start, I wanted to address that Internet Explorer 8 has over 1300 Group Policy entries that can be configured, which is great for keeping your environment managed and safe. That can also create some challenges in wrapping your head around all of the possibilities, so I wanted to begin with a list of 10 entries that are usually the most asked-about control locations for IE8 from a support perspective. Hopefully, this will give a bit of a "jumping off" point to managing Internet Explorer with Group Policy. It’s one of the most powerful features of using Internet Explorer 8 in an Active Directory domain, so I want to make this easier to use and understand.
1. Data Execution Prevention (DEP)
I’ll start at the top, with Data Execution Prevention (DEP) configuration in Internet Explorer 8. Because browsers are the gateway to the internet, I think it wise to look at the Data Execution Prevention policy setting for Internet Explorer 8. By default, Internet Explorer 8 opts-in to DEP on platforms that support the SetProcessDEPPolicy API, which means Windows XP SP3 systems and Windows Vista SP1 / Server 2008 and higher systems. DEP is useful in that it helps to foil attacks by preventing code from running in memory that is marked non-executable, which helps mitigate against certain types of attacks that try to make use of placing executable code in areas of memory not marked as executable, like buffer overrun attacks.
This behavior can be configured in Group Policy, whether you want to make certain this is happening or if you want to disable DEP opt-in for IE8, and can be found as a policy item under Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\Security Features\, called "Turn off Data Execution Prevention":
Note that if the Operating System that IE8 is running on is configured to opt-in to DEP for all processes, then this policy setting has no effect and DEP is enabled for IE unless it is configured here as an opted-out process:
3. SmartScreen Filter
Another area of security in Internet Explorer 8 that is configurable from Group Policy is the SmartScreen Filter, which is used to help prevent phishing attacks and block access to sites that are flagged as malware hosting sites. This setting is configured per zone, which means you can configure SmartScreen scanning to be enabled or disabled for each individual security zone. For example, you could have it enabled for the Internet Zone, but disabled for the Trusted Sites zone. By default, if the SmartScreen filter is not configured from Group Policy, the user has control over whether or not it is enabled, and also whether or not to visit a site anyway if SmartScreen determines a site is to be blocked. However, if this is configured from Group Policy, the user cannot visit a site listed as blocked, and cannot configure the SmartScreen Filter or bypass it’s settings. This setting can be found as a policy item in each named security zone folder under \Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page, called "Use SmartScreen Filter":
3. Site to Zone Assignment
The Site to Zone assignment list allows you to configure which security zones a particular site should render in, allowing you to configure how restrictive or relaxed security settings should be for a particular site based on the security zone settings the site renders in. This policy allows you to ensure that the security settings for the specified zone are applied to the site. Additionally, you can apply granular control over a site in a zone if desired, including control over whether a specific protocol is to be checked for a site, a specific site for that domain is to be specified, or if the entire domain should exist in a particular zone irrelevant of which protocol or site is specified in that domain. You can also use this to specify which sites will reside in the Restricted Sites zone, as part of a defense-in-depth strategy – sites that you do not trust can be placed in this most restrictive zone, which uses the “HIGH” security zone setting by default. This setting can be found as a policy item under \Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page, called "Site to Zone Assignment List":
Note that if you enable the Site to Zone Assignment List policy, users no longer have control over adding or removing sites from this list, and it becomes completely controlled by Group Policy. If you disable the policy, any list on the client is deleted and no specific site assignments are permitted.
4. Home Page Settings
Configuring the user’s home/start page has been a feature of policy since Internet Explorer 5, and to go along with the new ability to configure multiple secondary start pages with Internet Explorer 8 there is a policy to configure both the initial start page, as well as any secondary start pages that are desired. Each secondary start page is loaded in a separate tab from the initial home/start page when the browser is run, although it is worth noting that if you configure the initial start page or any secondary start pages in group policy the user can no longer set or modify any start pages from the Internet Explorer options. These setting can be found as policy items under \Administrative Templates\Windows Components\Internet Explorer, called "Disable changing home page settings" (configuring the default start page) and “Disable changing secondary home page settings”:
5. First Run Customize Settings
Internet Explorer 8 by default runs through the “First Run Customize” wizard when a user starts the new browser for the first time, and quite a few admins like to prevent this from running as they’ve already configured user settings, whether that be via Group Policy, the IEAK, logon scripts and registry values, etc. This can be configured in Group Policy so that the user does not see the First Run Customize wizard, but is instead shown their default home page (and any subsequent start pages on separate tabs), and can be found as a policy item under \Administrative Templates\Windows Components\Internet Explorer called “Prevent performance of First Run Customize settings”:
6. Suggested Sites
Suggested Sites is a new feature of Internet Explorer 8 that can recommend sites a user may wish to visit based on the user’s browsing activity, and an admin may wish to control this behavior in a domain environment due to the fact that the user’s site visit history is sent to Microsoft on a periodic basis when this feature is enabled (privacy information on this and other features can be found here). This setting can be found as a policy item under User Configuration\Administrative Templates\Windows Components\Internet Explorer called “Turn on Suggested Sites”:
7. New Tab Settings
Some administrators like to configure the new tab behavior of what Internet Explorer opens when a new tab is created, and with Internet Explorer 8 this is configurable via Group Policy. You can specify that when a user opens a new tab, that one of three things happens: the tab opens a blank page (about:blank), the “new tab page” page (which is the default behavior), or the tab opens their primary start page. This can be found as a policy item under \Administrative Templates\Windows Components\Internet Explorer called “Configure new tab page default behavior”:
8. InPrivate Browsing and InPrivate Filtering
InPrivate browsing is a feature in Internet Explorer 8 that allows a user to browse leaving virtually no traces of the web browsing actions performed in an InPrivate session, including preventing the browsing history, temporary internet files, cookies, usernames and passwords, etc. from being stored and retained locally by the browser. An administrator might not want users to be able to utilize InPrivate browsing, or they may wish to have some control over the defaults of InPrivate browsing, like whether or not toolbars or browser helper objects (BHOs) are loaded during an InPrivate session, or whether or not InPrivate Filtering is disabled or available for use. These policy items can be configured via a number of entries under \Administrative Templates\Windows Components\Internet Explorer\InPrivate and \Administrative Templates\Windows Components\Internet Explorer\Delete Browsing History:
More detailed information about InPrivate browsing and filtering can be found here.
9. Compatibility View Settings
Compatibility View is a feature that allows the browser to display a web page that may not render correctly when viewed in the default Internet Explorer 8 Standards Mode in a mode that is more compatible with content that is not necessarily written to common Internet standards. This allows the browser to provide greater compatibility with these sites, although standards mode Web pages viewed under Compatibility View will render in Internet Explorer 7 Standards Mode rather than Internet Explorer 8 Standards Mode, and newer content written to common Internet standards may not display correctly in this mode.
This particular feature can be configured in Group Policy amongst a number of policy items that control whether or not this feature is enabled and forced for all sites that the user may visit, whether it is enabled for the Local Intranet zone (the default behavior) or whether the browser should use the latest Internet Explorer Standards Mode for the Local Intranet zone, a list of sites to be explicitly viewed under Compatibility View, etc:
10. Maximum Number of Connections per Server (for AJAX)
Internet Explorer uses a configured number of maximum persistent connections per server per session for both HTTP 1.0 and HTTP 1.1 connections, and in Internet Explorer 8 the control for this behavior has been modified so that it is configurable via Group Policy. By default, Internet Explorer 8 uses a maximum of 6 persistent connections for HTTP 1.1 and HTTP 1.0 server connections when over a high-speed or broadband connection, and a maximum of 2 persistent connections for HTTP 1.1 and 4 persistent connections for HTTP 1.0 server connections when over a low-speed or dial-up connection. It is worth noting that this is an increase from previous versions of Internet Explorer, which used 2 maximum persistent connections for HTTP 1.1 and 4 persistent connections for HTTP 1.0 server connections regardless of connection speed. These settings can be found as a set of policy items under \Administrative Templates\Windows Components\Internet Explorer\Security Features\AJAX:
More information about this change and why the decision was made to increase maximum persistent connections in Internet Explorer 8 can be found here.
If you want to learn more about Group Policy and Internet Explorer 8, or get a Group Policy Settings Reference that describes each and every policy item and its location in policy and the registry, the following links should be of assistance:
Every day we use the internet to shop, book travel and do our banking. To do this we share personal information such as our name and address, credit cards numbers and enter our passwords. We need to be able to do this with confidence, knowing that our information is being used only by the company or organization that we intended to share it with.
Many of us know that criminals are increasingly trying to steal our personal information any way they can. Some attempt to install malware on our PCs or phish for our personal information by pretending to be a legitimate organization. We hear about the importance of online security all the time, but if you’re like me, you probably think it couldn’t happen to you. We’re all savvy consumers, right?
We wanted to raise awareness of just how easy it is to fall victim to these risks and to highlight some of the ways that Internet Explorer 8 can help to protect you. That’s what our new advertising campaign, which kicked off tonight during Fox’s Lie to Me (8/7 Central) and Good Guys (9/8 Central), is all about. We thought the most powerful way to do this would be to tell the story through your eyes, our customer. There are countless real people around the world confronted with online scams every day.
To prove just how vulnerable your personal information is, Internet Explorer 8 re-recreated notorious internet scams–live, off the web– in the most street-smart city in world: New York. We used hidden cameras to film reactions of real people. In the first spot we asked people to provide very personal information in order to open a new bank account which would give them a cash reward of $500. We learned that, just as it is online, it can be hard to tell the difference between the scammer and the real thing. We filmed a lot of people and nearly all of them were convinced our “bank” was the real deal.
By the time we got to some of the more outrageous questions, folks started to be suspicious. At that point we revealed the cameras and asked everyone to personally shred the paper on which they’d written their personal information. But, ask yourself, would you have been able to spot the difference straight away?
While consumer vigilance is the most important defense against online scams like this (you can get some great hints and tips here www.microsoft.com/protect ), we can all benefit from a safety net. As a leader in web browsers, we believe it’s our responsibility to help. For example:
Internet Explorer 8 SmartScreen Filter automatically blocks web pages which look suspicious or have been reported as suspicious and warns you of the risks. Every day the SmartScreen Filter blocks 3 million suspicious pages.
Domain Highlighting also reduces risks by clearly identifying the real location of the page you are viewing and helping you check that it really is the page you were expecting and not just one that looks like the real thing.
Internet Explorer 8 also helps protect your privacy with InPrivate Browsing and InPrivate Filtering. InPrivate Filtering in Internet Explorer 8 helps protect your privacy by preventing information about the Web sites that you visit from automatically being shared with other sites.
You’ll see the ads on TV and online beginning tonight, and you can view them at www.ie8protects.com. Finally, we want to say a very big thank you to everyone who took part and was willing to be help raise awareness of this issue.
Ryan Gavin, Senior Director of Internet Explorer Product Management here at Microsoft, recently travelled to Europe to chat about Internet Explorer. As many of you know, there’s been a lot happening with Internet Explorer these past few months (which is exciting!).
To get an idea on where Internet Explorer is headed and its future with Internet Explorer 9, this video from Reuters (sorry, the embed function is disabled) gives you a good overview. Definitely check it out. Update: here is the video…
Customers are moving steadily away from IE6 to IE8, which you can see from the latest Net Applications report. In the US, Net Applications data shows Internet Explorer as a whole growing by 0.76% and IE8 showing growth of 1.34% for May. Developers are also actively encouraging their friends to upgrade to a modern browser and we of course love the campaigns people are doing to say goodbye to IE6.
Speaking of developers, we recently released the second Internet Explorer 9 Platform Preview giving developers a look at where we’re going with Internet Explorer in terms of as supporting web standards such as HTML5. You can download Internet Explorer 9 Platform Preview 2 here from the Internet Explorer 9 Test Drive website. For more on the second Internet Explorer 9 Platform Preview, see my post from earlier this month.
If after watching the video you’re looking for more information, I suggest visiting the IEBlog.
I also encourage all developers (who haven’t already done so) to download Internet Explorer 9 Platform Preview 2 and submit your feedback.
I think I have a fairly normal, modern life. I don’t have a landline telephone or a 9-to-5 schedule. I do have two mobile phones and a 100-minute-a-day commute. At work I have TweetDeck permanently open on one of my three work monitors (Outlook and Internet Explorer 8 are open on the other two). I also have two Twitter accounts, six Windows Live IDs and a Yahoo! account I haven’t checked since 2001.
And yet it’s still hard to schedule a date night (with someone with a vested interest in making it all work out) much less poker night with my friends. And since we don’t live in an alternate Life on Mars reality where everything moves at the speed of 1973, I bet pencils, paper calendars and in-person meetings don’t work so well for you either.
So, while we can’t do too much about your commute or your work-life balance, Microsoft does have a few things you might not know about that should help you pull everyone and everything together.
1. Hotmail: The new Hotmail has a wealth of features to make working together easier –even if you can’t meet up in person. There are more than 350 million active Hotmail users, sending more than 8 billion messages a day. And more than 200 million of these folks also use Windows Live Messenger. So, chances are, your social network is already on Hotmail.
Collaborating with Hotmail is about to go from easy to ridiculously easy with the launch of Office Web Apps (see below). If you send one of the 350 million Microsoft Office documents shared on Hotmail each month, the recipient will be able to view and edit the doc in the browser –even if they don’t have Microsoft Office on their computer. In my opinion, this is the coolest new feature since snap. Sharing pictures has also never been easier. You can automatically upload them to SkyDrive (which gives you 25GB of free space) and a link will be sent to the recipient or look at them as high resolution thumbnails right within your email.
2. SkyDrive: SkyDrive is probably the best Windows Live service you don’t know you have at your fingertips. It’s a virtual 25GB hard drive, and it’s yours free with a Windows Live ID. Upload anything you want and it’s safely stored. It’s great for group projects when you can’t actually meet in person.
Personal tip: I store the picture page of my passport on SkyDrive so if it’s ever lost a copy is just an internet connection away.
3. Office Web Apps: The technical preview (or beta) of Microsoft Office Web Apps is available now and the release version is coming soon. Office Web Apps are great for folks on a budget (and just about everyone in college). What’s not to love about a free, online version of Microsoft Word, Excel, OneNote and PowerPoint? Pair them with Hotmail (see above) and Sky Drive and you have a complete virtual workspace.
4. Last.fm: Finally, whether you’re flying solo or wrestling with a group, no one should have to work in silence. While not as popular as Pandora, I’m partial to Last.fm. I think the online interface is slick and the downloadable scrobbler is cool. If you’re into electronic music, the Tiësto station returns particularly groovy results.
Hit me up anytime @winashbrown on Twitter.
There’s been some coverage overnight about the security of Windows and whether or not one particular company is reducing its use of Windows. We thought this was a good opportunity to set the record straight.
There is some irony here that is hard to overlook. For starters, check out this story from Mashable a few months ago where it was reported that Yale University had halted their move to Gmail (and their move to Google’s Google Apps for Education package) citing both security and privacy concerns.
The Financial Times article states that:
Windows is known for being more vulnerable to attacks by hackers and more susceptible to computer viruses than other operating systems.
The facts don’t support the assertion.
When it comes to security, even hackers admit we’re doing a better job making our products more secure than anyone else. And it’s not just the hackers; third party influentials and industry leaders like Cisco tell us regularly that our focus and investment continues to surpass others.
An article today by InfoWorld discusses how Macs are under attack by high-risk malware – the article goes on to ask if this is a future sign of things to come for Apple and security. Microsoft makes the security of our customers a huge priority. Here are some examples of the things we are focused on to help make our customers more secure:
For more on Microsoft and our investment in security, I suggest reading the Microsoft Security Development Lifecycle Blog.
We know Internet Explorer 8 helps you stay safe while surfing the web with great features like the SmartScreen Filter which helps block malicious downloads and websites. My colleagues in Microsoft Spain have found a pretty creative way of talking about this with their new “Yoda” campaign. Using the character from Star Wars, they have launched an online campaign designed to highlight staying safe online with Internet Explorer 8. Yoda represents the “bright side” – or the Force – of the Internet that embodies Internet Explorer 8. Yoda (IE8) helps users stay away from the “Dark Side” of the Internet by keeping them protected against identity theft, cross-site scripting attacks, phishing attempts, and malware.
Visitors who visit the campaign site and are not using Internet Explorer 8 get alerted by Yoda that they are at risk and should download Internet Explorer 8 to stay safe against the “Dark Side”. The campaign website also has a ton of information on Internet Explorer 8 including how it keeps people protected, Internet Explorer browser add-ons, contests, social media downloads, and more!
The Spanish version of Gizmodo has some fun participating in the campaign – read about their experience!
And the team in Spain are clearly having fun too, and have taken the campaign to heart.
If you live in Spain, check out this campaign. If you don’t live in Spain, still check out this campaign as it’s a fun and creative way (using Star Wars) at looking at the brighter side of the Internet versus the “Dark Side”.
May the Force be with you…
For the past few months, I’ve been traveling to many corners of the world visiting customers large and small. Everywhere I went, I continued to be humbled by the overall positive feedback IT professionals gave me on the value of Windows 7 to their organization. That said, IT professionals also told me they need a thoughtful and strategic plan for how they roll out any new technology within their organizations, including Windows 7 and Office 2010. I also heard they need a tangible way to evaluate the technology’s business value in light of today’s continued economic realities. Additionally, they said they need to have a centralized way to easily manage their desktop infrastructure particularly as they are also evaluating technologies that will help them optimize their desktops such as Office 2010, Microsoft Application Virtualization (App-V) and Internet Explorer 8.
In response to this feedback we’ve created some new partner and self-service resources to help organizations assess business value and build a plan for deploying a modern desktop environment with Windows 7 Enterprise, Microsoft App-V, Internet Explorer 8 and Office 2010 Professional Plus. Here’s an overview of these resources:
Whether you have 1,000 PCs or 100,000 PCs, if you want to successfully and more quickly roll out Windows 7 Enterprise or Office 2010 Professional Plus, a Proof of Concept is highly recommended and these new resources should help you get started or move to the next stage of deployment.
You can also read more about companies that have moved through the proof of concept and pilot phases and can learn from their experiences. Sanofi-aventis, one of the largest pharmaceutical companies in the world, and O2 Ireland, a mobile phone service provider, both provide good best practice stories and you can read more in their case studies.
If you are considering deploying Windows 7, I would encourage you to take advantage of this new deployment program and learn for yourself what the combination of Windows 7 Enterprise, Office Professional Plus 2010, App-V or Internet Explorer 8 can mean for you. I highly encourage you to learn more about new deployment program options by visiting the Windows Enterprise site. If you want to start to kick the tires yourself, we have packaged guidance and resources to help you to build a technical proof of concept as a new area on our Springboard Series on TechNet, available today.

Categories
Tag Cloud
Blog RSS
Comments RSS
Last 50 Posts
Back
Back
Void « Default
Life
Earth
Wind
Water
Fire
Light 