Lesson 2: Configuring Internet Explorer CHAPTER 12 633 Medium blocks most automatic pop-up windows. The Low setting allows pop-ups only from secure sites, and the High setting blocks all pop-ups. Exceptions are sites where the Pop-Up Blocker does not block pop-ups. Figure 12-31 shows exceptions for the sites http://www.contoso.com and http://www.tailspintoys.com. Allowing pop-up information to display in the information bar allows users to view a pop-up window if necessary. Unless you configure the High setting, Internet Explorer does not block pop-ups from sites that are in the Local Intranet or Trusted Sites security zone. The default Windows 7 settings allow users without administrative privileges to modify the Pop-Up Blocker settings through the Pop-Up Blocker Settings control panel. FIGURE 12-31 Pop-Up Blocker settings Configuring SSL Certificates SSL certificates provide two useful functions for users of Web browsers. SSL certificates allow users to verify the identity of the Web site to which they are connecting and ensure that communication between the browser and the Web site is secured through encryption. When a user browses to a site that is protected by an SSL certificate, a gold lock icon is displayed in the address bar to indicate that the connection is secure. Users are able to click this gold lock icon to view information about the Web site, as shown in Figure 12-32. Clicking the View Certificates item on the Website Identification pop-up allows you to view details of the certificate. These details include which certificate authority (CA) issued the certificate, when the certificate issue date, when the certificate expires, and the identity of the root CA that is at the top of the certification path. Clicking the Should I Trust This Site? item provides general advice on whether you should trust the Web site. 6 3 4 CHAPTER 12 Windows Update and Windows Internet Explorer FIGURE 12-32 Web site identification information Internet Explorer provides a warning when you navigate to a secure Web site where there is a problem with the SSL certificate. For example, in Figure 12-33, the name that is on the certificate used on the Web site https://www.contoso.com is not www.contoso.com. Internet Explorer blocks navigation to this Web site automatically. A user needs to click the Continue To This Website (Not Recommended) item to navigate to the Web site. This problem can arise if a Web site has recently changed its name and is still using the certificate related to its old name. Alternatively, it could be that the domain has been hijacked or some other problem has occurred with the site that would affect security. You should advise users to be cautious if they encounter this error, and they should definitely not provide sensitive information to a Web site where the SSL certificate and the Web site name do not match. This is because you are unable to verify the Web site’s identity without a proper certificate. Even if a site is legitimate, you should be cautious about providing sensitive information over the Internet to any organization that is unable to keep its SSL certificate up to date. FIGURE 12-33 Web site certificate problem Lesson 2: Configuring Internet Explorer CHAPTER 12 635 Internet Explorer blocks navigation to a Web site if the application detects the following types of certificate errors: n Web site address does not match address in certificate This error occurs when a Web site is using a digital certificate issued to a different Web address. It often happens when an organization hosts multiple Web sites off the same server. n Web site certificate has been revoked This error indicates that the security certificate was obtained or used fraudulently by the Web site. The organization responsible for issuing the certificate has revoked the certificate, indicating that the Web site should no longer be trusted. n Web site certificate is out of date This error occurs when the current date is either before or after the certificate validity period. For example, you would receive this error for a certificate that is configured to be valid from 2100 to 2150, and you would receive this error for a different certificate that was valid from 1996 to 2000. Web sites must renew certificates with certificate authorities on a regular basis. n Web site certificate is not from a trusted source This error indicates that the Web site certificate that has been issued from a CA that is not trusted by Internet Explorer. This error occurs often with Web servers on intranet sites. If you encounter this error on an Internet site, you should not trust the Web site because many phishing sites use fake identity certificates to attempt to trick users into believing they are legitimate. You will learn more about configuring Internet Explorer to trust legitimate sources later in this lesson. n Problem found with security certificate This error occurs when Internet Explorer detects a problem with a Web site certificate that does not fall into the above categories. This error can occur if someone has tampered with the certificate, or the certificate has become corrupted. You should not trust Web sites where Internet Explorer finds a problem with the security certificate. When dealing with secure sites on non-public networks, such as a corporate intranet, you may encounter Web site certificates issued by a CA that Internet Explorer does not trust. This often occurs because organizations set up their own internal Public Key Infrastructure (PKI) to distribute certificates to internal hosts and do not need a publicly validated SSL certificate to identify an internal server. In most organizations that set up their own PKIs, clients automatically trust the issuing CAs because it is possible to publish their certificates through AD DS. You can configure Internet Explorer to trust a CA by navigating to the CA’s Web site to obtain and install its certificate. You can view the current list of certificates on the Content page of the Internet Options dialog box, as shown in Figure 12-34. You can clear currently cached SSL certificates by clicking Clear SSL State. You can view current certificates by clicking Certificates and you can view trusted CAs by clicking Publishers. You can use the Certificates or the Publishers button to import or export certificates. For example, if you had received an e-mail with the CA certificate of an organization’s internal CA, you could configure Internet Explorer to trust that CA by importing its certificate through this dialog box. 6 3 6 CHAPTER 12 Windows Update and Windows Internet Explorer FIGURE 12-34 Managing certificates eXaM tIP Understand how the functions of InPrivate Browsing and InPrivate Filtering differ. Practice InPrivate mode and Add-Ons In this practice, you examine how InPrivate Browsing works and also manage Internet Explorer add-ons. InPrivate Browsing is a feature that many people who use shared computers are interested in because they want to keep the details of their Web browsing activities hidden from other people who may use the computer. Computer Canberra must be able to connect to the Internet to complete both of the exercises in this practice. exercise 1 Exploring InPrivate Mode In this exercise, you explore the InPrivate Mode in Internet Explorer 8. InPrivate Mode reduces the amount of data stored about a browsing session. In this exercise, you browse normally, browse in InPrivate Mode, and then compare the difference. To complete this exercise, perform the following steps. 1. Log on to computer Canberra using the Kim_Akers user account. 2. Open Internet Explorer from the Taskbar. If you are presented with the Welcome To Internet Explorer 8 Wizard, click Ask Me Later. 3. Ensure that only one tab is open. In the address bar, type the address http://www.bing.com and then press Enter. Lesson 2: Configuring Internet Explorer CHAPTER 12 637 4. In the search engine text box, type 70-680 site:microsoft.com and then click the search button. This should produce a result similar to that shown in Figure 12-35. FIGURE 12-35 Searching for 70-680 5. Click the TS: Windows 7, Configuring link. This takes you to the Web page for the 70-680 TS: Windows 7, Configuring exam. On the right side of the page, under Related Services, click E-Reference Libraries. This opens the E-Reference Libraries page. 6. From the Safety menu, click Delete Browsing History. In the Delete Browsing History dialog box, ensure that all items are selected, as shown in Figure 12-36, and then click Delete. FIGURE 12-36 Delete Browsing History dialog box 6 3 8 CHAPTER 12 Windows Update and Windows Internet Explorer 7. Once the browsing history is deleted, close Internet Explorer. 8. Open Internet Explorer again. From the Tools menu, click Reopen Last Browsing Session. This opens the last page that you visited in the previous session, even though you deleted the browsing history. 9. Click the drop-down arrow next to the address bar and verify that all pages that you browsed to in the previous session, including the contents of the Bing.com search results, are stored within the reopened browser session, as shown in Figure 12-37. FIGURE 12-37 Last session data still available 10. Close Internet Explorer. 11. Open Internet Explorer again. From the Safety menu, click InPrivate Browsing. This opens the InPrivate Browsing window. 12. In the InPrivate Browsing window address bar, enter the address http://www.bing.com and then press Enter. 13. In the search text box, type Windows 7 site:microsoft.com and then press Enter. 14. In the search results, click the Welcome to Windows 7 link that corresponds to the Uniform Resource Locator (URL) http://www.microsoft.com/windows/windows-7/default.aspx. This opens the Windows 7 home page. 15. Close all open Internet Explorer windows. 16. Open Internet Explorer again. From the Tools menu, click Reopen Last Browsing Session. Verify that none of the pages involved in the previous session searching for Windows 7 information are present, either in the browsing history or within the previous session. 17. Close Internet Explorer. Lesson 2: Configuring Internet Explorer CHAPTER 12 639 exercise 2 Manage Internet Explorer Add-Ons In this exercise, you configure and manage add-ons for Internet Explorer. To complete this exercise, perform the following steps: 1. If you have not done so already, log on to computer Canberra with the Kim_Akers user account. 2. Open Internet Explorer. In the Tools menu, click Manage Add-ons. This opens the Manage Add-Ons dialog box. 3. Select the Search Providers option and then click the Find More Search Providers item. This causes Internet Explorer to navigate to a Web page that hosts an add-on gallery. In the Add-on Gallery, select a search provider and then click Add To Internet Explorer. In the Add Search Provider dialog box, shown in Figure 12-38, click Add. FIGURE 12-38 Adding a search provider 4. Close and then open the Manage Add-ons dialog box. Verify that the search provider that you installed is now available. Select the Accelerators option and then click Find More Accelerators. Internet Explorer again navigates to the Web page that hosts an add-on gallery. This time it presents a list of accelerators. Click the Mapping category. Locate a mapping accelerator, as shown in Figure 12-39, and then click Add To Internet Explorer. 5. On the Do You Want To Add This Accelerator? page, click Add. Close and reopen the Manage Add-ons dialog box and verify that the maps accelerator that you chose has been added. 6. Click on the newly installed maps accelerator and then click Set As Default. Click Close to close the Manage Add-ons dialog box. 7. In Internet Explorer, navigate to the following URL: http://www.microsoft.com/ presspass/inside_ms.mspx. 6 4 0 CHAPTER 12 Windows Update and Windows Internet Explorer FIGURE 12-39 Selecting a search provider 8. Select the text that says One Microsoft Way Redmond, WA 98052-7329 USA 9. Click the accelerator icon and then click the map accelerator that you selected. Internet Explorer now navigates to a page that shows a map of the Microsoft campus. 10. From the Tools menu, click Manage Add-ons. Click Accelerators and then click the maps accelerator that you installed. Click on Disable to disable this accelerator. Click Close to close the Manage Add-Ons dialog box. 11. Close Internet Explorer. Lesson Summary n Compatibility View allows pages that do not render correctly in Internet Explorer 8, but which render correctly in Internet Explorer 7, to be displayed properly in Internet Explorer 8. You can configure Compatibility View manually, use a list of Web sites provided by Microsoft and updated through Windows Update, or manually configure a list of sites that Internet Explorer should use Compatibility View with. n Security settings are configured primarily by assigning sites to zones. Sites that require elevated privileges should be assigned to the Trusted Sites zone. Sites that are on Lesson 2: Configuring Internet Explorer CHAPTER 12 641 the intranet are automatically assigned to the Local Intranet zone, though this may require manual configuration in some circumstances. All other sites are assigned to the Internet zone. The Restricted Sites zone is used only for Web sites that may present security risks but must be visited. n Add-ons enhance the functionality of Internet Explorer. Users with standard permissions can add, remove, and disable add-ons unless configured Group Policy dictates otherwise. Accelerators allow users to select text on a Web page and then automatically perform another function, such as translating the text or forwarding it to their blog. Providers allow additional search providers to be added to the search window. n InPrivate Browsing stops Internet Explorer from storing information about a browsing session. InPrivate Filtering stops third-party Web sites from gaining data when browsing across multiple sites. n Internet Explorer provides warnings if a Web site’s address does not match the SSL certificate that it presents to the client, if the certificate has expired, if the certificate has been revoked, or if the certificate has become corrupt. Lesson Review You can use the following questions to test your knowledge of the information in Lesson 2, “Configuring Internet Explorer.” The questions are also available on the companion DVD if you prefer to review them in electronic form. note ANSWERS Answers to these questions and explanations of why each answer choice is correct or incorrect are located in the “Answers” section at the end of the book. 1. You are spending several weeks working as a contractor at Contoso. You attempt to connect using Internet Explorer to the timesheet Web application hosted at https://timesheet.contoso.internal. You receive a message that the Web site certificate has not been issued by a trusted source. Which of the following steps can you take to resolve this problem? a. Configure the security level of the Intranet Zone. B. Turn off the Pop-up Blocker. c. Start InPrivate Browsing and revisit the Web site. D. Visit the Contoso.internal CA using Internet Explorer and install the CA certificate. 2. Developers at your organization have come up with a custom blogging tool and accelerator that allows blogs to be posted directly to the corporate intranet. You want users to be able to highlight interesting text that they find on Web pages and blog it directly to the intranet server. You want to ensure that users do not accidentally blog using the default Blog With Windows Live accelerator. Which of the following steps 6 4 2 CHAPTER 12 Windows Update and Windows Internet Explorer should you take on each computer to accomplish this goal? (Choose all that apply; each answer forms part of a complete solution.) a. Disable the Blog With Windows Live accelerator. B. Install the custom blog accelerator. c. Set the Blog With Windows Live accelerator as the default Blog accelerator for Internet Explorer. D. Disable the custom blog accelerator. 3. You want to ensure that Internet Explorer does not display any pop-up windows except those from the site http://www.wingtiptoys.com. Which of the following Pop-Up Blocker settings should you configure on the Pop-Up Blocker Settings dialog box? (Choose all that apply; each answer forms part of a complete solution.) a. Configure http://www.wingtiptoys.com as an exception. B. Set the blocking level to Medium. c. Set the blocking level to High. D. Set the blocking level to Low. 4. Your organization has recently acquired several subsidiaries. Each subsidiary has their own separate Internet site and these sites have unique fully qualified domain names (FQDNs). All clients use Windows 7 Enterprise with the default settings. Several subsidiary intranet Web sites do not display properly in Internet Explorer on Windows 7, but they display without problems in Internet Explorer on clients running Windows XP and Windows Vista. All clients running Windows 7 are members of the same AD DS domain. Which of the following configuration changes should you make to Group Policy to resolve this problem? a. Enable the Turn Off InPrivate Browsing policy. B. Enable the Turn Off InPrivate Filtering policy. c. Enable the Turn Off Compatibility View policy. D. Configure the Use Policy List Of Internet Explorer 7 Sites policy. 5. You want to ensure that third-party Web sites that provide content to a variety of sites that you visit are not able to track you across those sites during a browsing session. Which of the following actions should you take, after starting Internet Explorer, to ensure that this does not occur? a. Start an InPrivate Browsing session B. Enable InPrivate Filtering c. Disable Pop-up Blocker D. Disable SmartScreen Filter . Figure 1 2-3 5. FIGURE 1 2-3 5 Searching for 70 -6 80 5. Click the TS: Windows 7, Configuring link. This takes you to the Web page for the 70 -6 80 TS: Windows 7, Configuring exam. On the right side of. pop-up windows. The Low setting allows pop-ups only from secure sites, and the High setting blocks all pop-ups. Exceptions are sites where the Pop-Up Blocker does not block pop-ups. Figure 1 2-3 1. Resource Locator (URL) http://www.microsoft.com /windows/ windows -7 / default.aspx. This opens the Windows 7 home page. 15. Close all open Internet Explorer windows. 16. Open Internet Explorer again.