Trying to read non-local HTML Help files since Security Bulletin MS05-026 has always been a very frustrating process.
First, there is the common ‘Oh oh, you’re opening a potentially dangerous file’ popup:
Well, yes. I want to, it’s already stored on my network. I put it there. In fact, I already unblocked the content when I downloaded the file.
But still I get a blank page in the Helpfile:
So let’s go check the KB Article page to see what we can do.
Ah. While there is a helpful section explaining the registry keys needed to Make Things Work again regeditting manually is not everyones favourite pastime:
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\HHRestrictions]
"MaxAllowedZone"=dword:00000001
"UrlAllowList"="\\\\alt-92.net"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\ItssRestrictions]
"MaxAllowedZone"=dword:00000001
"UrlAllowList"="\\\\alt-92.net"
No, the double \\ are no mistake. You need to escape backslashes.
Now repeat for every computer. Wash, rinse, repeat.
Time to get busy.
Using GPOs seems a likely solution. In fact, the KB article references GPO’s but in a very nasty way.
So why not use Vista’s new GPO Preferences?
To start off, create a new GPO (appropriately named GP_HTMLHelpFix ).
Dig down into the Computer Configuration tree, until you reach Preferences> Windows Settings > Registry.
Create new entries for the values needed:
You can use the UrlAllowList setting to enter DFS roots or local intranet domain.
After linking the Computer GPO to the proper OU and doing a gpupdate, you should see the results in the Registry Editor:
The above approach works in most cases. Except.. it’s still not working.
As it turns out, I not only need to configure the registry keys, but also need to properly configure Internet Options to include the namespace in the local Intranet Zone.
Apparently, there is a problem in IE7 listed in MSKB article 941001.
If you configure a policy setting to a value other than the default value, a local site may appear as “Local Intranet” even though you expect it to appear as “Internet,” or vice versa.
The default settings which should work but don’t:
So let’s tick off Autodetect, tick “Include all Network paths (UNCs)” since a drivemapping is also UNC..
Click Advanced, and enter the domain as a file://-based UNC path..
Re-tick autodetect, with the settings enabled and ‘Ok’ your way though.
Import these settings in the appropriate GPO object to control IE settings if you have them.
Bonus: Use a WMI filter to exclude or include the operating systems you wish to apply these settings to. The Filter shown ensures the GPO only applies to XP desktops and Vista RTM or SP1 desktop machines, and not to any 2000 Pro or 2003 Server machines that inadvertently stray out of their OU.
By the way:
It worked!
