Internet Explorer Maintenance

This section provides help for administering Microsoft Internet Explorer on Windows 2000 and Windows XP and concepts related to browser maintenance.

  • Administering Microsoft Internet Explorer
  • Internet Explorer Concepts


Administering Microsoft Internet Explorer

You can use Group Policy to administer and customize Microsoft Internet Explorer on Windows 2000 and Windows XP computers. For example, you can set the user's home page and customize the user's favorite links.

For more information, see the following topics:

  • Use Group Policy to Administer Internet Explorer
  • Export Group Policy Settings for Internet Explorer
  • Internet Explorer Concepts

To customize Internet Explorer before deployment or to administer Internet Explorer on other operating systems, you can use the Profile Manager. The Profile Manager is part of the IEAK, which is available in the Windows 2000 and Windows XP Resource Kit and on the Microsoft Windows Web site.

You can administer the following areas using Group Policy.

Browser User Interface

Customize the user interface and the appearance of the browser.

  • Browser Title
  • Internet Explorer Animated Logo
  • Custom Logo and Animated Bitmaps

Connection Settings

Preset and control the user's connection settings, such as dial-up and local area network (LAN) connections.

  • Connection Settings
  • Automatic Configuration
  • Proxy Settings
  • User Agent String

Custom URLs

Specify the URLs that will appear in your user's browser, such as the Search page, the Home page, and on the Favorites list.

  • Favorites and Links
  • Important URLs

Security

Preset and control the user's security settings, such as security zones and content ratings.

  • Security Zones and Content Ratings
  • Authenticode Settings

Program Associations

Specify which Internet programs are used by default for common Internet tasks, such as reading e-mail or viewing newsgroups.

  • Programs


Automatic Configuration

You can assign URLs to files that will automatically configure Internet Explorer. This feature is helpful if you want to control the settings of several users from one central location.

You can configure options by using .ins files, also known as IEAK profiles. Using .ins files, you can include standard proxy settings. You can also specify script files in .js, .jvs, or .pac format that enable you to configure and maintain advanced proxy settings.

Network servers using Domain Name System (DNS) and Dynamic Host Configuration Protocol (DHCP) can automatically detect and configure a browser's settings when the user first starts the browser on a network. For more information, see Automatic Detection and Configuration of Browser Settings.

To automatically detect browser settings, select the Automatically detect configuration settings check box.

If you specify URLs for both automatic configuration and automatic proxy (auto-proxy), the auto-proxy URL will be incorporated into the .ins file. The correct form for the URL is http://share/test.ins.

Enable Automatic Configuration
To use automatic configuration and set the interval for updates, select this check box.
Automatically configure every xx minutes
Specify the interval in minutes for the automatic configuration feature. If you enter zero, or don't enter a value, automatic configuration happens only when the user's computer is restarted.
Auto-config URL (.ins file)
Type the URL for the .ins file you want in this box.
Auto-proxy URL (.js, .jvs, or .pac file)
Type the URL for the autoproxy script in

For more information about auto-proxy files, see JavaScript or JScript Auto-Proxy Example Files.


Browser Title

You can customize the text that appears in the title bars of Internet Explorer and Outlook Express. The Outlook Express title bar is updated whether you include Outlook Express in your package or it is already installed on your users' computers. Type the text that you want to display. It will be added after the phrase "Microsoft Internet Explorer provided by" or "Outlook Express provided by."

Note

  • When you select a bitmap, make sure that the colors contrast with the text. This ensures a high level of readability for your users.

To customize title bars

  1. Select the Customize Title Bars check box.
  2. Type the text you want in the Title bar text box.


Toolbar Customizations

You can personalize the toolbar that appears in your users' browser, giving you flexibility and design opportunities. The elements you can work with include the toolbar background and the appearance of the icons for the standard toolbar buttons, such as Search and History.

To customize the toolbar further, you can change the appearance and number of additional buttons. Your ability to specify the script or program that the buttons launch gives you an additional level of control over the toolbar included in your custom package. For more information about designing custom programs, see the MSDN Online Web Workshop.

Background
Click Use Windows default toolbar background bitmap when you are not customizing the background. To customize the background, click Customize toolbar background bitmap, and then specify the name and location of the bitmap file.
Buttons
When you work with custom toolbar buttons, you can add your own button icons, the script file or executable associated with each button, and the location of the toolbar icon files. After adding buttons, you can return to the Toolbar Customizations page of the wizard to edit or remove them whenever you want.
Delete existing toolbar buttons, if present
To delete all of the toolbar buttons in the users' browser, except the standard buttons that are installed with Internet Explorer, select this check box. This option is available only to corporate administrators.

Notes

  • The toolbar background should be the size of the toolbar and light enough to show black text.
  • If you enable themes in Windows, your custom toolbar background is ignored. To use a custom toolbar background, switch to the Windows Classic theme.
  • Selecting the Delete existing toolbar buttons, if present check box deletes only the buttons that were added manually. The standard buttons installed with Internet Explorer remain.

To add a custom toolbar button

  1. Click Add.
  2. In the Toolbar caption (required) box, type the text that should appear when users hover over the toolbar button. You must specify a caption or label for the button. The recommended maximum length is 10 characters.
  3. In the Toolbar Action, as script file or executable (required) box, type the name of the script file or executable file, or click Browse to find it. You must specify the script or executable file that runs when users click the toolbar button.
  4. In the Toolbar color icon (required) box, Type the name of the file that represents the button in its active state, or click Browse to find the file. You must specify a color icon for the button that appears on the toolbar. The icon consists of 20-by-20 pixel images for active and inactive states. For more information, see the MSDN Online Web Workshop.
  5. In the Toolbar grayscale icon (required) box, type the file name and location of the grayscale icon for the toolbar that appears on black-and-white monitors, or click Browse to find the file. You must specify a grayscale icon for the button that appears on the toolbar.
  6. Select the This button should be shown on the toolbar by default check box to display the toolbar button in the users' browser by default.

Notes

  • When you indicate the location of bitmaps, scripts, and applications, you specify the address as well as the file name.
  • For more information showing how branding is applied to your customized browser, see the Internet Explorer Administration Kit help.

To edit a custom toolbar button

  1. In the list of custom toolbar buttons, click the button that you want to work with. Then click Edit.
  2. Edit the information you want to change.

To delete a custom toolbar button

  1. In the list of toolbar buttons, click the item that you want to delete.
  2. Click Remove. The toolbar button is immediately removed from the list. When your users install your custom Internet Explorer package, the button is not available.


Connection Settings

You can preset connection settings for your users by importing the connection settings from your computer.

To see which settings you are importing, click the Tools menu in the browser, click Internet Options, and then click the Connections tab. Click Settings to view dial-up settings, and click LAN Settings to view network settings. The address for automatic configuration is not imported, however.

Do not customize Connection Settings
Click this option if you do not want to preset your users' customization settings.
Import the current Connection Settings from this machine
Click this option if you want to preset your users' customization settings to use the values imported from your computer. If the settings from your computer are not the settings you want to use, click Modify Settings to change them here.
Delete existing Dial-up Connection Settings
If you are a corporate administrator, select this check box to clear the existing settings on your users' computers.

Note

  • If you are a corporate administrator, you can also use system policies and restrictions to determine whether users can change their connection settings. You can set policies and restrictions in Stage 5 of the Internet Explorer 6 Customization Wizard or through automatic configuration. For more information, see the Internet Explorer Administration Kit help.


Favorites and Links

You can customize the Favorites folder and the Links bar by adding links to sites related to your company or services. For example, if you are an ICP specializing in entertainment, you can provide links for entertainment-related sites.

The Links bar appears by default at the top of the user's screen and provides a set of default links. You can add links to the default folders or add new folders. When a user clicks Favorites, the Favorites list appears on the left side of the window.

Place Favorites and links at the top of the list in the order specified below
Select this check box to specify that the Favorites and links you choose should be moved to the top of the users' Favorites list, making them easier for users to find. When you select this option, the Up and Down buttons become available.
Delete existing Favorites and Links, if present
If you are a corporate administrator, you can select this check box to delete the items on the users' Favorites and Links lists. It is recommended that you use this setting with caution, because it removes the links and favorites that your users set up.
Only delete the favorites created by the administrator
If you are a corporate administrator, you can select this check box to delete only the items on your users' Favorites and Links lists that you set up for them.
Delete existing channels, if present
If you are a corporate administrator, you can delete existing channels on your users' computers by selecting this check box.

Notes

  • To test a link, click the URL in the list, and then click Test URL.
  • You can add up to 200 links to the Favorites folder.
  • To remove an item from the Favorites list or Links bar, click the item, and then click Remove.
  • For an illustration showing how branding and customized links are applied to your customized browser, see the Internet Explorer Administration Kit help.

To manually add a folder to the Favorites list or Links bar

  1. Select Favorites, Links, or a folder within Favorites or Links, and then click Add Folder.
  2. Type the name of your folder in the Name box. This can be a friendly name that helps the user recognize what types of links are in the folder.

To import a folder of links from your machine to the Favorites list or Links bar

  1. Click the title Favorites or Links, and then click Import.
  2. In the Browse for Folder dialog box, locate and click the folder of desired links on your machine. These links are most likely located in the \Windows\Favorites folder.

To add a Web page to the Favorites list or Links bar

  1. Click Favorites, Links, or a folder within Favorites or Links, and then click Add URL.
  2. In the Details dialog box, type a name for this Web page in the Name box. This can be a friendly name that helps the user recognize what the link refers to.
  3. Type the destination of your link in the URL box.
  4. To specify a 16-by-16 pixels custom icon for this link, type the name of the bitmap file in the Icon box, or click Browse to locate it.
  5. If you are a corporate administrator, you can make this page available to users who are not connected to the Internet by selecting the Make available offline check box. This option is often helpful for users with laptop computers.
  6. Click OK to close the Details dialog box.


Important URLs

You can specify the URLs for your home, search, and online support pages.

Home page URL
The home page, sometimes known as the start page, appears when the user clicks the Home button. Internet Explorer can show a default home page, or you can specify a URL for your own page.

If you want to customize the home page, select the Customize Home page URL check box. Type the URL for the home page that you want to use in the Home page URL box.

Search bar URL
The Search bar appears on the left side of the screen. The Search bar allows your users to see the search query and search results at the same time. It comes with a choice of search engines. If you want to customize the Search bar URL, select the Customize Search bar URL check box. Then type the URL in the Search bar URL box.
Online support page URL
In Internet Explorer, support information is available when users click Help and then click Online Support. It is recommended that you develop a support page and then make it available to your users.

If you want to customize the support page, select the Customize Online support page URL check box. Then type the URL of your custom support page in the Online support page URL box.


Custom Logo and Animated Bitmaps

The Internet Explorer logo in the upper right corner of the browser appears in two states: static when no action is taking place and animated when the browser is in use. You can replace the logo bitmaps with your own animated or static bitmaps.

Customizing static logos

If you use a static bitmap, it appears without animation whether or not any action is taking place in the browser.

To use your own static logo, you first create two bitmaps. One should be 22-by-22 pixels and the other 38-by-38 pixels. Then you specify the path to the logos in the Small (22x22) bitmap and Large (38x38) bitmap text boxes.

Customizing animated logos

If you use an animated bitmap, the first frame appears static when no action is taking place in the browser. The remaining frames appear animated when the browser is in use.

To use your own animated logo, you first create two animated bitmaps. One should be 22-by-22 pixels and the other 38-by-38 pixels. Then you specify the path to the logos in the Small (22x22) bitmap and Large (38x38) bitmap text boxes.

You can find sample animated bitmaps in the \<IEAK program folder>\Toolkit\ folder of the IEAK Toolkit.

Notes

  • Two tools are included with the IEAK to help you create customized animated bitmaps for your browser. One tool is used to stack bitmaps in the formats described above, while the other tool previews the animation.
  • For more information showing how branding is applied to your customized browser, see the Internet Explorer Administration Kit help.


Programs

Program settings consist of settings that control which programs are used by default. If you customize many programs, importing the files from your work machine can save time and make your users' settings consistent.

Do not customize Program Settings
Skip customizing settings for your users' programs. These settings include specifying the default e-mail program and HTML editor.
Import the current Program Settings
Copy the program settings from your work computer to your users' computers. To change the settings you are importing, click Import the current Program Settings, and then click Modify Settings.


Proxy Settings

You can specify which proxy servers your users connect to.

Enable proxy settings
Select this check box to use proxy servers for any of the listed services.
Address of proxy
Type the address of the proxy server for a service.
Port
Type the port number, which in many cases is 80.
Use the same proxy server for all addresses
Select this check box to use the same settings for all services.
Do not use proxy server for addresses beginning with
In certain cases, you may not want to use a proxy server, such as for addresses on your corporate intranet. You can enter specific addresses in this box. Use a semicolon to separate entries.
Do not use proxy server for local (intranet) addresses
Select this check box to bypass proxy servers for all addresses on your intranet.


Security

You can use certification authorities and Authenticode to help manage security.

You can use certification authorities to control the sites where users can download certain content, such as ActiveX controls and Java applets. A site authority is a form of digital certificate for an Internet site. Based on Authenticode technology, it shows where programs come from and verifies that they were not altered.

Do not customize certification authorities
Click this option if you do not want to customize certification authorities. You can still customize Authenticode security information.

You can import certification authorities settings from your computer. If you want to modify the settings that you will apply to your users' computers, click Import current certification authorities, and then click Modify Settings.

You can then use Certificate Manager to view and manage your certification authorities information. Certificates can apply to network server authentication, network client authentication, secure e-mail authentication, and software publishing.

Do not customize Authenticode Security
Click this option if you do not want to customize Authenticode security information.

You can use Authenticode to designate software publishers and credentials agencies as trustworthy. You can also import these settings from your computer. If you want to modify the settings that you will apply to your users' computers, click Import current Authenticode Security information, and then click Modify Settings.


Security Zones and Content Ratings

Manage security zones and content ratings for Internet Explorer to prevent users from viewing content that may be considered offensive. Content ratings provide a way to help you control the types of content that your computer can access on the Internet. You can adjust the settings to reflect what you think is appropriate content in four areas: language, nudity, sex, and violence.

Do not customize security zones
Skip customizing settings for each security zone.
Import the current security zone settings
If you want to import the settings from your computer, click Import the current security zone settings. To change settings you are importing, click Modify Settings. Using System Policies and Restrictions, you can also specify whether users will be able to change their security settings.
Do not customize content ratings
Skip customizing content ratings in the areas of language, nudity, sex, and violence.
Import the current content ratings settings
If you want to import the settings from your computer, click Import the current content ratings settings. Click Modify Settings to change settings you are importing. You can then modify your settings using Content Advisor.

Notes

  • Content Advisor uses very cautious rating standards when you first enable it. You can adjust these settings to match your own preferences.
  • Not all Internet content is rated. If you choose to allow others to view unrated sites, some of those sites could contain inappropriate material.


User Agent String

Some companies track site statistics, such as how many times their content is accessed and by which types of Web browsers. This is done with a user agent string, which provides information to the Web server about the users' Web browsers. In Group Policy, you can customize a portion of the user agent string.

Custom string to be appended to user agent string
The string you type in this box is appended to the user agent string for the customized browser. You do not need to customize the user agent string unless you want to track the usage of your custom browser and you gather browser statistics from other Web sites. Be aware that other companies that track site statistics will see the customized string.

You can add characters to the end of the user agent string to customize it.

Your customized string will appear in any statistics that include the user agent string. Be aware that other companies that track statistics will see your customized string. Avoid using a string that you don't want others to see.

Here's an example of a user agent string:

Mozilla/4.0(compatible; MSIE 5.0; Windows NT; YourCustomString)


Internet Explorer 6 Concepts

The following topics can help you prepare to administer Internet Explorer on Windows 2000 and Windows XP.

  • Automatic Detection of Browser Settings
  • Customizing the Search Assistant
  • Designing Toolbar Icons for Internet Explorer 6
  • Internet Explorer 6 Security


Automatic Detection of Browser Settings

With automatic detection, you can configure the browser when it is started, even if you did not customize it before deployment. For example, if a user downloads a non-customized browser from the Internet, instead of installing a customized version from the corporate servers, automatic detection can configure and customize it when it is started.

Automatic detection of browser settings, which is based on Web Proxy AutoDiscovery (WPAD), is supported by both DHCP (Dynamic Host Configuration Protocol) and DNS (Domain Name System). With the appropriate settings, DHCP and DNS servers can automatically detect and configure browser settings.

This feature builds on existing automatic configuration technologies, in which a browser can be configured from a central location with an automatic configuration URL (.ins file) or a Javascript proxy configuration (.js, .jvs, or .pac) file.

To enable automatic browser configuration

  1. Start Group Policy.
  2. Double-click Connection.
  3. Double-click Automatic Browser Configuration.
  4. Complete the information as follows, and then click OK.
Automatically detect configuration settings
Select this check box to detect whether your users' settings differ from the configuration you set up.
Enable Automatic Configuration
Select this check box to maintain browser settings after deployment.
Automatically configure every xx minutes
Specify the number of minutes between updates. To update each time users start Internet Explorer, leave this field blank.
Auto-config URL (.INS file)
Type the path to the .Ins file that contains your browser settings. The correct format is http://share/test.ins.
Auto-proxy URL (.JS, .JVS, or .PAC file)
Type the path to the autoproxy script in this box. For more information about autoproxy files, see JavaScript or JScript Auto-Proxy Example Files.

Automatic Detection of Browser Settings for DHCP and DNS

A DHCP server enables the administrator to centrally specify global and subnet-specific TCP/IP parameters and to define parameters for clients by using reserved addresses. When a client computer moves between subnets, it is automatically reconfigured for TCP/IP when the computer is started.

DNS is a set of protocols and services on a TCP/IP network that allow users to search for other computers using hierarchical user-friendly names, often known as "hosts," instead of numeric IP addresses.

Using DHCP with automatic detection works best for LAN (local area network)-based clients, while DNS enables both LAN-based and dial-up users to detect their settings. Although DNS can handle network and dial-up users, DHCP provides for faster access to LAN users and allows greater flexibility in specifying configuration files.

To enable automatic detection of browser settings, you need to configure specific settings on DNS servers, DHCP servers, or both.

Enabling automatic detection of browser settings on DHCP

To set up automatic detection of browser settings on a DHCP server, you need to create a new option type with a code number of 252.

The following procedure shows how you can use the Microsoft DHCP Manager running on Windows NT 4.0 to create a new DHCP option; the option can be global or apply to a specific scope. If the Microsoft DHCP Manager is not installed, consult your Microsoft NT 4.0 documentation for instructions on how to install it.

To add a new DHCP option type

  1. On the DHCP Options menu, click Defaults.
  2. In the Option Class list, click the class for which you want to add a new option type, and then click New.
  3. In the Name box, type a new option name.
  4. In the Data Type list, click the String data type.
  5. For the default value of the string, type the URL that points to your configuration file. This file can be a .pac, .jvs, .js, or .ins configuration file.

    Examples:

    • http://www.fabrikam.com/webproxy.pac
    • http://marketing/config.ins
    • http://###.#.###.#/account.pac
  6. In the Identifier box, type the code number 252 to associate with this option type.
  7. In the Comment box, type a description.

Enabling automatic detection on DNS

To enable automatic detection of browser settings on DNS, you need to configure either the host record or CNAME "alias" record in the DNS database file.

Host Record

A host record is used to statically associate host (computer) names to IP addresses within a zone. A host record contains entries for all hosts that require static mappings, such as work stations, name servers, and mail servers.

The syntax is: <host name> IN A <ip address of host>

For example:

Host Name |  |  | Host Address
corserv | IN | A | 192.55.200.143
nameserver2 | IN | A | 192.55.200.2
mailserver1 | IN | A | 192.55.200.51

CNAME Record

These records are sometimes called "aliases" but are technically referred to as "canonical name" (CNAME) entries. These records allow you to use more than one name to point to a single host. Using canonical names makes it easy to do such things as host both an FTP server and a Web server on the same computer.

To configure a DNS database file for automatic detection of browser settings

  • In the DNS database file, enter a host record named wpad that points to the IP address of the Web server that contains the .pac, .jvs, .js, or .ins automatic configuration file.

    Or, enter a CNAME alias named wpad that points to the name (the resolved name, not the IP address) of the server that contains the .pac, .jvs, .js, or .ins automatic configuration file.

Notes

  • After the record is added and the database file is propagated to the server, the DNS name wpad.domain.com should resolve to the same computer name as your server that contains the automatic configuration file.

  • When using DNS, Internet Explorer constructs a default URL template based on the host name wpad. For example, http://wpad.domain.com/wpad.dat.

    Therefore, on the Web server wpad, you must set up a file or redirection point named wpad.dat, which delivers the contents of your automatic configuration file.


Customizing the Search Assistant

The Microsoft Windows Search Assistant provides users with a single, unified search experience across different types of searches. It is a task-based searching tool that allows users to specify the type of information they are looking for instead of the search engine they want to use. The Search Assistant opens in the Search bar in the left side of the browser when the user clicks the Search button.

You can customize the Search bar to suit the needs of your organization. To do so, you specify the URL for the Search bar in the Internet Explorer section of Group Policy.

The Search bar can be customized using the same functionality that is possible in the Internet Explorer browser. This includes JScript (compatible with ECMA 262 language specification), Visual Basic Scripting Edition (VBScript), ActiveX controls, Dynamic HTML, framesets, cascading style sheets (CSS), and so on.

The search results typically appear in the Search bar. It's critical for users to be able to easily use the results of any search service. You can use the Search bar functionality to store detailed information such as text abstracts, URLs, or file size. This information is contained in the ToolTips that appear when the mouse pointer hovers over a result. This helps keep the results page simple and provides detailed information when needed.

For information about customizing the Search Assistant, see the rest of this topic. For more information about scripting and Dynamic HTML, see the the MSDN Online Web site.

Techniques for customizing the Search Assistant

The Search Assistant can be customized to meet specific searching needs. For example, additional information about search results can be stored within ToolTips, and search results can be highlighted on a particular Web page.

Search hit highlighting

Building customized Search Guides to search Web pages for a word or phrase is easy in Internet Explorer 6. The new NavigateAndFind method loads a specified Web page and scans the document for a match to the provided string. If a match is made, the string in the document is highlighted.

The following example opens the Microsoft Web site and searches for the words "Microsoft Corporation."

window.external.NavigateAndFind("http://www.microsoft.com","Microsoft Corporation");

ToolTips/abstracts

To help conserve space in the browser window and to improve the readability of search results, Internet Explorer enables you to define the specific information about a given link that should be included in a ToolTip. You do this by defining the TITLE= attribute of an HTML anchor tag.

The following example provides more information about the link:

<A HREF="http://www.alpineskihouse.com/" TITLE="Latest sports news and scores, updated hourly. Interviews with winning players"> alpineskihouse - Latest sports news</A>

Point to this link to see how the results would appear: Latest sports news

New lines in ToolTips

The ToolTip automatically breaks lines at three inches and can contain at least a paragraph of text. However, no more than 1,024 characters are allowed within the ToolTip text. You can also force a new line or tab spaces in the abstract by using the reserved characters &#10; and &#13 for carriage return and line feed, and &#09 for tab spaces.

The following example includes a carriage return and a line feed after line 1 of the ToolTip:

<A HREF="http://www.microsoft.com"
TITLE="The text that will be displayed on line1&#10;&#13;
The text that will be displayed on line2&#10;
&#09;The text that will be displayed on line3&#10;
&#09;The text that will be displayed on line4">
Using multiple lines in ToolTips</A>

Point to this link to see how the results would appear: Using multiple lines in ToolTips


Designing Toolbar Icons for Internet Explorer 6

To create a toolbar icon, you will need to provide each image in two sizes for two toolbar states (grayscale for the default state and color for the active state, when the user's mouse is pointing to it), and in two color depths. The following is a summary of the images that are needed:

  • One 20-pixel-by-20-pixel color image (256-color Windows half-tone palette)
  • One 20-pixel-by-20-pixel gray image (256-color Windows half-tone palette)
  • One 20-pixel-by-20-pixel color image (16-color Windows palette)
  • One 20-pixel-by-20-pixel gray image (16-color Windows palette)
  • One 16-pixel-by-16-pixel color image (16-color Windows palette)
  • One 16-pixel-by-16-pixel gray image (16 color Windows palette)

These images would look like the following:

Images needed for icons

Designing toolbar icons

Here are some general points to keep in mind when designing toolbar icons:

  • Make sure the visual transitions between your default and active images are smooth. An easy way to test this is to create separate layers for the default and active images in a photo imaging program so that you can view the images on top of each other.
  • When you design 16-color icons, use the Windows 16-color palette. For both the default and active states, there should be a black border around the icon. Exceptions are where the readability of the image may be affected, such as for an arrow or an "X." The images should have little shading and appear flat.
  • When you design 256-color icons, use the Windows half-tone palette. For both the default and active states, the icons should have icon-style borders with gray or color top and left borders and black bottom and right borders. They can have more shade and visual depth than 16-color images, with a light source from the upper left and shading where appropriate.

Creating .ico files

You will need to create two .ico files for one icon:

  • The first .ico file contains the active images (color) in both sizes and color depths.
  • The second .ico file contains the default images (grayscale) in both sizes and color depths.

It is recommended that you use a graphics program to draw your icons and a development environment, such as Microsoft Visual C++ Development Studio, to create the .ico files.

The two icon files would contain the following graphics:

Drawing your images

  1. After drawing your images in a graphics program, place the 16-color and 256-color images in separate files.
  2. Index each file to the appropriate palette, either the Windows 16-color palette or the Windows half-tone palette.
  3. Save each file as a .bmp.

Creating your icon files in Visual C++:

  1. Open each .bmp file.
  2. On the File menu, click New, and then click Icon. By default, the icon window that opens displays a standard 32-pixel-by-32-pixel device image.
  3. In the Icon window, click New Device Image. Click Custom, and then create these image devices:
    • One 22-pixel-by-20-pixel 16-color image
    • One 22-pixel-by-20-pixel 256-color image
    • One 18-pixel-by-16-pixel 16-color image

    Note that the device images are two pixels wider than the images, which reflects the actual width of the button. Center your images in the device image area.

  4. Delete the default 32-pixel-by-32-pixel device image.
  5. Copy and paste the color images from your .bmp files into the appropriate device image size and color depth.
  6. To make the background transparent, select the transparent color in the color palette and fill the background of each image where you want transparency.
  7. Save this file as an .ico file.
  8. To create your default (grayscale) .ico file, follow the same steps.


Internet Explorer 6 Security

You can use Internet Explorer 6 to control security through Authenticode publishers and security zones. You can also set ratings for the content your users view.

About security zones

The Internet Explorer 6 security options enable you to assign specific Web sites to various zones, depending on how much you trust the content of the Web site.

When you install Internet Explorer 6, the following security zones are set up:

  • An Internet zone that by default contains all Internet sites
  • A Local Intranet zone for computers connected to a local network
  • A Trusted Sites zone, to which you can assign sites you trust
  • A Restricted Sites zone, to which you can assign sites you don't trust
  • A My Computer zone, which contains the files on the local computer

Note

  • You can configure the My Computer zone only from Group Policy or the IEAK; these settings are not available in the browser interface. It is recommended that you generally use the default settings for this zone unless your organization has a specific requirement. Lower security settings could result in security risk, whereas higher security settings could impair functionality.

Default settings

The following four default settings can be applied to these zones: High, Medium, Medium-low, and Low. In addition, you can set custom security levels for each zone.

You can view all the security settings by clicking the Internet icon in Control Panel, and then clicking the Security tab.

Remember, security on the Internet is as good as your settings. Internet Explorer 6 provides you with the information you need to make good security decisions and with flexible tools to implement those decisions.

You can set security options, and determine whether your users can change these settings. If you do not set the security options, then you might want to recommend the optimum security level for your users based on your organization's needs and your users' level of expertise.

Setting up the Internet zone

The Internet zone consists of all sites not included in any of the other zones. By default, the Internet zone is set to the Medium security level. If you are concerned about possible security problems browsing the Internet, you might want to change the setting to High. If you raise the security setting, some Web pages will not be allowed to perform certain potentially hazardous operations, although this could prevent some useful functionality from working and some pages might appear not to be working properly.

You can choose custom settings to control each individual security decision for the zone. To do this, click the Internet icon in Control Panel, click the Security tab, and then click Custom Level.

Adding sites to the Trusted Sites and Restricted Sites zones

There are two zones available to which you can assign specific Web sites that you trust more or less than those in the Internet zone or the Local Intranet zone. To add sites to these zones, first choose the zone, and then click Sites.

The Trusted Sites zone is assigned a Low security setting by default. It is intended for highly trusted sites, such as companies that you frequently do business with, sometimes known as an "extranet." If you assign a site to the Trusted Sites zone, the site will be allowed to perform more powerful operations. Also, Internet Explorer asks you to make fewer security decisions. Add a site to this zone only if you trust all of its content never to do anything harmful to your computer. For the Trusted Sites zone, we strongly recommend that you use the HTTPS: protocol or otherwise ensure that connections to the site are secure.

The Restricted Sites zone is assigned a High security setting by default. If you assign a site to the Restricted Sites zone, the site will be allowed to perform only minimal, very safe operations. This zone is for the rare case of a site you don't trust. To ensure a high level of security for content that isn't trusted, many pages in this zone will not function properly.

Setting up the Local Intranet zone (for network administrators)

To be secure, the Local Intranet zone must be set up in conjunction with the proxy server and firewall. All sites in the zone should be "inside the firewall," and proxy servers should be configured so that they do not allow an external DNS name to be resolved to this zone. Configuring the client zone security requires a detailed knowledge of the existing network configuration, proxy servers, and secure firewalls. If you don't know this information, contact your network administrator.

By default, the Local Intranet zone consists of local domain names and those set in proxy override on the Connections tab. You can configure these settings on the Connection Settings screen. Note that multiple connection settings can now be configured for each user. The network administrator should confirm that these settings are indeed secure for the installation or adjust the settings to be secure.

When setting up the zone, you can specify which categories of URLs should be considered. You can also add specific sites to the zone.

To specify categories of URLs to include in the zone from the browser

  1. On the Tools menu in Internet Explorer, click Internet Options, and then click the Security tab.
  2. Click the Local Intranet zone, and then click Sites.
  3. Select the following check boxes that apply:

    Include all local (intranet) sites not listed in other zones
    Include all sites that bypass the proxy server
    Include all network paths (UNCs)

Note

  • To add a specific site to this zone, click Advanced, type the URL, and then click Add. To require that server verification be used, select the Require server verification (https:) for all sites in this zone check box.

Local Intranet zone options

The following rules apply to the Local Intranet zone options. Note that adding a site to any zone takes precedence over the following rules:

  • Include all local (intranet) sites not listed in other zones: Intranet sites have names that do not include dots (for example, http://local). A site name such as http://www.microsoft.com/ is not local because it contains dots. This site would be assigned to the Internet zone. The intranet site name rule applies to file: as well as http: URLs.
  • Include all sites that bypass the proxy server: Typical intranet configurations use a proxy server to access the Internet with a direct connection to intranet servers. This setting uses this kind of configuration information to distinguish intranet from Internet content for purposes of zones. If the proxy server is otherwise configured, you should clear this option and use other options to designate files that are assigned to the Local Intranet zone. In systems that do not have a proxy server, this setting has no effect.
  • Include all network paths (UNCs): Network paths (for example, \\local\file.txt) are typically used for local network content that should be included in the Local Intranet zone. If there are network paths that should not be in the Local Intranet zone, you should clear this option and use other options to designate files that are assigned to the Local Intranet zone. For example, in certain Common Internet File System (CIFS) configurations, it is possible for a network path to reference Internet content.

After the Local Intranet zone is confirmed secure, consider changing the zone's security level to Medium-Low or Low to enable a wider range of powerful operations to be performed. It is also possible to adjust individual security settings in the Custom Settings dialog box.

If there are parts of your intranet that are less secure or otherwise not trustworthy, they can be excluded from this zone by assigning them to the Restricted Sites zone.

The Local Intranet zone is intended to be configured via Group Policy or the IEAK, although you can also use the options on the Security tab in the Internet Properties dialog box.

Working with domain name suffixes

If you want to be able to reference a Web server by using a shorter version of its address that doesn't include the domain, you can use a domain name suffix. For example, a Web server named sample.microsoft.com can be referenced as sample; the same content can also be accessed by entering http://sample.microsoft.com/ or http://sample.

To set this up, you must add the domain suffix to the TCP/IP properties domain suffix search order by carrying out the following steps:

  1. Right-click the My Network Places icon, and then click Properties.
  2. Click TCP/IP, and then click Properties.
  3. Click the DNS Configuration tab, and then in the Domain Suffix Search Order area, add the information you want.

It's important to set up security zones correctly for this configuration. By default, the URL without dots (http://sample) is considered to be in the Local Intranet zone, while the URL with dots (http://sample.microsoft.com) is considered to be in the Internet zone. Therefore, when you use such a configuration and there is no proxy server bypass to clearly assign the content to the proper zone, you need to change the zone settings.

Depending on whether the content accessed by the domain suffix is intranet or Internet content, you need to assign the ambiguous site URLs to the appropriate zones. To assign URLs such as http://sample to the Internet zone, clear the Include all local (intranet) sites not listed in other zones check box for the Local Intranet zone, and include the site in the site list for the zone.

Other notes about security that apply to all zones

Web content can be addressed either via Domain Name System (DNS) name or by Internet Protocol (IP) address. For sites that use both, it is important to configure both references to the same zone. In the common cases, the Local Intranet sites are identifiable by either local name or by IP addresses in the proxy bypass list; all other names and IP addresses would be mapped to the Internet zone. However, if a site name is entered into the Trusted Sites or Restricted Sites zone list but its IP address range isn't, then the site may be treated as part of the Internet zone if it is accessed by the IP address.

It is important to understand that a user could copy content from one zone to another, potentially increasing or decreasing the level of security intended for the content.

If you are using automatic configuration, and you are supporting both Internet Explorer 6 and Internet Explorer 4.0 with the same automatic configuration file, some security settings that differ between the versions will not be configured on Internet Explorer 4.0.


JavaScript or JScript Auto-Proxy Example Files

The following scripts provide examples of how a .pac file could be used to specify an auto-proxy URL. To use these functions, you must change the proxy names, port numbers, and IP addresses.

Notes

  • The isInNet() ,isResolvable(), and dnsResolve() functions query a DNS server.
  • References to Object Model objects, properties, or methods cause the Proxy Auto-Configuration file to fail silently. For example, the following references - window.open(...), alert(...), password(...) - all cause the Proxy Auto-Configuration file to fail on Internet Explorer.

Example 1: Local hosts connect direct, all others connect via proxy

The following function checks to see whether the host name is a local host, and if it is, whether the connection is direct. If the host name is not a local host, the connection is through the proxy (proxy).

function FindProxyForURL(url, host)
  {
    if (isPlainHostName(host))
      return "DIRECT";
    else
      return "PROXY proxy:80";
  }

The isPlainHostName() function checks to see if there are any dots in the host name. If so, returns false, else returns true.

Example 2: Hosts inside the firewall connect direct, outside local servers connect via proxy

The following function checks to see whether the host is either a "plain" host name (meaning the domain name is not included) or part of a particular domain (.company.com) but the host name is not either www or home.

function FindProxyForURL(url, host)
  {
    if ((isPlainHostName(host) ||
       dnsDomainIs(host, ".company.com")) &&
      !localHostOrDomainIs(host, "www.company.com") &&
      !localHostOrDoaminIs(host, "home.company.com"))

      return "DIRECT";
    else
      return "PROXY proxy:80";
  }

Notes

  • The localHostOrDomainIs() function is executed only for URLs in the local domain.
  • The dnsDomainIs() function returns true if the domain of the host name matches the domain given.

Example 3: If host is resolvable, connect direct, else connect via proxy

The following function asks the DNS server to try to resolve the host name passed to it. If it can, then a direct connection is made. If it cannot, the connection is made via proxy. This is useful when an internal DNS server is used to resolve all internal host names.

function FindProxyForURL(url, host)
  {
    if (isResolvable(host))
      return "DIRECT";
    else
      return "PROXY proxy:80";
  }

See note on the isResolvable() function at the top of the page.

Example 4: If host is in specified subnet, connect direct, else connect via proxy

The following function compares a given IP address pattern and mask with the host name. This is useful if certain hosts in a subnet should be connected directly and others should be connected via proxy.

function FindProxyForURL(url, host)
  {
    if (isInNet(host, "999.99.9.9", "255.0.255.0"))
      return "DIRECT";
    else
      return "PROXY proxy:80";
  }

See note on the isInNet() function at the top of the page.

The isInNet(host, pattern, mask) function returns true if the host IP address matches the specified pattern. The mask indicates which part of the IP address to match (255=match, 0=ignore).

Example 5: Determine connection type based on host domain

The following function specifies a direct connection if the host is local. If the host is not local, this function determines which proxy to use based on the host domain. This is useful if the host domain name is one of the criteria for proxy selection.

function FindProxyForURL(url, host)
  {
    if (isPlainHostName(host))
      return "DIRECT";
    else if (shExpMatch(host, "*.com"))
      return "PROXY comproxy:80";
    else if (shExpMatch(host, "*.edu"))
      return "PROXY eduproxy:80";
    else
      return "PROXY proxy";
  }

The shExpMatch(str, shexp) function returns true if str matches the shexp using shell expression patterns.

Example 6: Determine connection type based on protocol being used

The following function extracts the protocol being used and makes a proxy selection accordingly. If no match is made on the protocol, then a direct connection is made. This is useful if the protocol being used is one of the criteria for proxy selection.

function FindProxyForURL(url, host)
  {
      if (url.substring(0, 5) == "http:") {
        return "PROXY proxy:80";
      }
      else if (url.substring(0, 4) == "ftp:") {
        return "PROXY fproxy:80";
      }
      else if (url.substring(0, 7) == "gopher:") {
        return "PROXY gproxy";
      }
      else if (url.substring(0, 6) == "https:") {
        return "PROXY secproxy:8080";
      }
      else {
        return "DIRECT";
      }
  }

The substring() function extracts the specified number of characters from a string.

Example 7: Determine proxy setting by checking to see if host name matches IP address

The following function makes a proxy selection by translating the host name into an IP address and comparing it to a specified string.

function FindProxyForURL(url, host)
  {
      if (dnsResolve(host) == "999.99.99.999") { // = http://secproxy
        return "PROXY secproxy:8080";
      }
      else {
        return "PROXY proxy:80";
      }
  }

See note on the dnsResolve() function at the top of the page.

Example 8: If host IP matches specified IP, connect via proxy, else connect direct

The following function is another way to make a proxy selection based on specifying an IP address. This example, unlike Example 7, uses the function call to explicitly get the numeric IP address (Example 7 uses the dnsResolve() function to translate the host name into the numeric IP address).

function FindProxyForURL(url, host)
  {
      if (myIpAddress() == "999.99.999.99") {
        return "PROXY proxy:80";
      }
      else {
        return "DIRECT";
      }
  }

The myIpAddress() function returns the IP address (in integer-dot format) of the host that the browser is running on.

Example 9: If there are any dots in the host name, connect via proxy, else connect direct

The following function checks to see how many dots are in the host name. If there are any dots in the host name, make a connection via proxy. If there are no dots in the host name, make a direct connection. This is another way to determine connection types based on host name characteristics.

function FindProxyForURL(url, host)
  {
      if (dnsDomainLevels(host) > 0) { // if the number of dots in host > 0
        return "PROXY proxy:80";
      }
        return "DIRECT";
  }

The dnsDomainLevels() function returns an integer equal to the number of dots in the host name.

Example 10: Specify days of the week to connect via proxy, other days connect direct

The following function determines the connection type by specifying days of the week that are appropriate for a proxy. Days that do not fall between these parameters use a direct connection. This function could be useful in situations where you might want to use a proxy when traffic is heavy and allow a direct connection when traffic is light.

function FindProxyForURL(url, host)
  {
    if(weekdayRange("WED", "SAT", "GMT"))
     return "PROXY proxy:80";
    else
     return "DIRECT";
  }

The weekdayRange( <day1> [,<day2>] [,<fGMT>] ) function returns whether the current system time falls within the range specified by the parameters <day1>, <day2>, and <fGMT>. Only the first parameter is necessary. The GMT parameter sets the times to be taken in GMT rather than in the local time zone.


Export Group Policy Settings for Internet Explorer

You can use Group Policy to export all of the Internet Explorer settings to an .ins file, and if necessary, to cabinet (.cab) files. These settings can then be used for automatic configuration on computers that run other operating systems.

  1. In Group Policy, right-click the Internet Explorer screen that contains the settings you want to export.
  2. Click Export Browser Settings.
  3. Type the names of the .ins file and, if applicable, the .cab files where you want to export the settings.
  4. Type the URL where the files are located on the Web server.


Starting Group Policy for Internet Explorer

You can work with Group Policy to manage Internet Explorer settings for your users. Although you can also configure these settings using the IEAK, the overall process is different. With the IEAK you are putting these settings into a custom Internet Explorer package that you can then deploy. With Group Policy, after you customize browser settings, you can skip the deployment process. When users start Internet Explorer, the automatic configuration feature updates their browser settings.

To Start Group Policy for Internet Explorer

  1. On the Start menu, click Run.
  2. In the Open box, type gpedit.msc, and then click OK.
  3. Click User Configuration, and then click Windows Settings.
  4. Double-click Internet Explorer Maintenance.

Related Topics


Use Group Policy to Administer Internet Explorer

  1. In Group Policy, click User Configuration.
  2. Click Windows Settings, and then click Internet Explorer Maintenance.
  3. Click the icon for the feature area you want to change.
  4. Click the title of the feature you want to administer.
  5. Change the settings you want.

    Your settings take effect immediately after you click OK. They are stored in the Group Policy object.

Notes

  • For more information about using Group Policy, see the Group Policy Help file.
  • You can also use Group Policy to export all of the Internet Explorer settings to an .ins file, and if necessary, to cabinet (.cab) files. For more information, see Export Group Policy Settings for Internet Explorer.


Microsoft Product Support Services on the Web

Get the latest answers to technical questions via the Internet

Support Online from Microsoft Product Support Services

If you have a technical question and can't find your answer in the Windows 2000 or Windows XP Help file, go to Microsoft Product Support Services on the Web. On one of our tailored support sites, you can easily search Microsoft Product Support Services' collection of resources including technical articles from our Knowledge Base, FAQ's, and troubleshooters to find fast, accurate answers. Support Online will gather the specific resources most likely to help you find the answer to your question.

To begin your search, go to Support Online.

If you'd like to know how to contact Microsoft directly, Support Online makes available information about all your support options, or you can check the support topics in Help.