Contents Overview Lesson: Configuring Security and Connection Settings for Internet Explorer Lesson: ppt

Contents Module 5: Configuring Internet Explorer and Application Compatibility Overview Lesson: Configuring Security and Connection Settings for Internet Explorer Lesson: Customizing and Deploying Internet Explorer Settings Lesson: Configuring Applications for Windows XP Professional 21 Lesson: Troubleshooting Applications 25 Demonstration: Viewing Dr Watson 27 Course Evaluation 30 Information in this document, including URL and other Internet Web site references, is subject to change without notice Unless otherwise noted, the example companies, organizations, products, domain names, e-mail addresses, logos, people, places, and events depicted herein are fictitious, and no association with any real company, organization, product, domain name, e-mail address, logo, person, place or event is intended or should be inferred Complying with all applicable copyright laws is the responsibility of the user Without limiting the rights under copyright, no part of this document may be reproduced, stored in or introduced into a retrieval system, or transmitted in any form or by any means (electronic, mechanical, photocopying, recording, or otherwise), or for any purpose, without the express written permission of Microsoft Corporation Microsoft may have patents, patent applications, trademarks, copyrights, or other intellectual property rights covering subject matter in this document Except as expressly provided in any written license agreement from Microsoft, the furnishing of this document does not give you any license to these patents, trademarks, copyrights, or other intellectual property  2003 Microsoft Corporation All rights reserved Microsoft, MS-DOS, Windows, Windows NT, ActiveX, Active Directory, MSDN, PowerPoint, and Windows Media are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries The names of actual companies and products mentioned herein may be the trademarks of their respective owners Module 5: Configuring Internet Explorer and Application Compatibility iii Instructor Notes Presentation: 90 minutes This module introduces students to the security and connection settings for Microsoft® Internet Explorer Students will learn the methods for deploying and enforcing Internet settings This module also provides students with information about configuring applications that are designed for earlier versions of Microsoft Windows®, and how to gather information by using the Dr Watson program error debugging utility Lab: 00 minutes There is no lab for this module After completing this module, students will be able to: ! ! Use the Internet Explorer Administration Kit ! Use Group Policy to customize and deploy Internet settings ! Configure a program that was written for an earlier version of Windows to operate on Windows XP Professional ! Required materials Configure the security and connection settings for Internet Explorer Configure the Dr Watson utility to troubleshoot applications The following materials are required for teaching this module: ! Microsoft PowerPoint® file 2285A_05.ppt ! The DemoApp.exe and Drwtsn32.log files on the Trainer Materials compact disc Important It is recommended that you use PowerPoint 2002 or later to display the slides for this course If you use PowerPoint Viewer or an earlier version of PowerPoint, all the features of the slides may not appear correctly Preparation tasks To prepare for this module: ! Read all the materials for this module ! Complete the practices ! Read the materials listed under Additional readings for each topic Document your additional readings to share with the class iv Module 5: Configuring Internet Explorer and Application Compatibility How to Teach This Module This section contains information that will help you to teach this module For some topics in this module, references to additional information appear in notes at the end of the topic Read the additional information in preparation for teaching the module and, during class, ensure that students are aware of that additional information Demonstration Pages, Practices, and Labs Explain to the students how the demonstrations, practices, and labs are designed for this course A module includes two or more lessons Most lessons include demonstration pages and a practice Demonstration pages Demonstration pages provide the steps for demonstrating a task Students not perform the tasks on these pages with the instructor, but will use these steps to perform the practice at the end of each lesson Practices After you presented the contents of the topic and demonstrated the procedures for the lesson, explain that the practice gives students a hands-on opportunity to learn all the tasks that you discussed in the lesson Lesson: Configuring Security and Connection Settings for Internet Explorer This section describes the instructional methods for teaching this lesson This lesson teaches students the basic methods of configuring Internet Explorer for security and connections Focus on the reasons for making the settings, and how to make settings on a computer-by-computer basis Why Configure Internet Explorer Settings? The slide for this topic depicts a high-level view of a secure network topology and shows that configuring the client is only a part of a corporate security policy Briefly describe: ! ! Firewall rules, and how they protect corporate computers ! How to improve Internet access by using a proxy server ! Security Zones for Internet Explorer The dangers of active content How dial-up connections from the desktop can bypass the outbound security and access features of a firewall and a proxy server To introduce security zones, briefly demonstrate the settings on the Security Zones tab and the other tabs on the Internet Options menu Indicate that students can manage certificates on the Content tab Do not discuss certificates, which are beyond the scope of this course Students will investigate the Local intranet security zone in the practice for this lesson, so focus your demonstrations of security zones on the other options When you describe the security options in a security zone, refer to discussions about harmful content from the previous topic Module 5: Configuring Internet Explorer and Application Compatibility v Connection Settings for Internet Explorer This topic gives students an understanding of the connections that are used for dial-up and virtual private network (VPN) access, and why such connections are typically not used in a local area network (LAN) Concentrate on a proxy configuration for the dial-up connections, the VPN connections, and the LAN settings Briefly demonstrate how to set up a proxy server for different protocols, but advise students that they will usually configure a single proxy for all protocols Practice: Protecting Clients from Active Content Explain to students that practices provide hands-on learning of the tasks that are presented in this lesson In this practice, students will use Internet options If time permits, encourage students to investigate settings that are not presented in the practice Estimated time to complete this practice: 10 minutes Lesson: Customizing and Deploying Internet Settings Methods for Customizing and Deploying Internet Explorer Settings In this lesson, introduce the following methods for maintaining the Internet Explorer security options that you configured manually in the previous lesson, and discuss when you might use them Note that the first two items are located in the Internet Explorer Administration Kit (IEAK): ! ! IEAK Profile Manager, which maintains the deployed browsers ! How to Customize Internet Explorer Internet Explorer Customization Wizard (IECW), which creates custom packages for distributing Internet Explorer Group Policy Management Console, which provides maintenance of Internet Explorer settings, but requires Microsoft Active Directory® directory service and Group Policy In this topic, describe the IECW and how it creates browser packages Before teaching this topic, download IEAK SP1 from: http://www.microsoft.com/ windows/ieak/downloads/ieak6/download.asp After downloading the IEAK, familiarize yourself with the versions and licensing of the kit For this course, the corporate license is installed on student computers, and the automatic version synchronization (AVS) has run once so that the practice will work If you want to provide a brief demonstration of IEAK, select Flat for the Media Selection and use Connections Customization for the feature selection Students will use Security Zones and Content ratings in the practice Discuss the concepts of Group Policy, and how the linking of Group Policy objects to appropriate container objects in Active Directory enforces settings and software configuration for all objects in the Active Directory container Explain that, by using the Internet Explorer Maintenance (IEM) extension to Group Policy, students can maintain browsers by making settings that Group Policy objects can deploy Reiterate that the IEM extension requires Active Directory vi Module 5: Configuring Internet Explorer and Application Compatibility Practice: Configuring Internet Explorer Settings by Using Internet Explorer Customization Wizard In this practice, students will use the IECW to configure Internet Explorer settings Important This practice is optional Configuring the Internet Explorer Customization Wizard during setup requires an Internet connection Verify that IEAK is installed and configured properly prior to the students running this practice Demonstration: Using Group Policy In this demonstration, use the Group Policy Management Console (GPMC) to demonstrate the use of Group Policy The GPMC consists of IEM, which is a Microsoft Management Console (MMC) extension, and a set of scriptable interfaces for managing Group Policy Describe GPMC to your students, and advise them that GPMC is a separate component from Windows Server 2003 To prepare for this demonstration, familiarize yourself with how the console works, and complete all the steps in the demonstration before teaching this module Guidelines for Configuring Internet Explorer In this topic, discuss the best practices for configuring Internet Explorer Best practices include setting restrictions that apply an organization’s acceptable-use policy Best practices must also include enforcing settings by disabling a user’s ability to change the browser’s security-related settings Discuss the policies of the students’ organizations to give students an opportunity to learn from each other Lesson: Configuring Applications for Microsoft Windows XP Professional In this lesson, explain to students that you have finished the discussion about security issues with browsers, and that this lesson addresses information about applications What Is Program Compatibility? Program compatibility involves applying small pieces of code that enable programs written for earlier versions of Windows to run on Windows XP Professional Show students that they can ensure program compatibility either manually or by using a wizard Demonstrate the manual method by using Microsoft Notepad How to Use the Program Compatibility Wizard In this topic, describe how to run the Program Compatibility Wizard Lesson: Troubleshooting Applications In this lesson, introduce students to the Windows application debugger, Dr Watson, and show them how to read Dr Watson log files What Is Dr Watson? In this topic, describe the Dr Watson utility and how to use it It is unlikely that students are application developers, so focus on using Dr Watson to diagnose problems and create reports for support organizations The examples in the text are also located in a log file on the Trainer Materials compact disc Demonstration: Viewing Dr Watson In this demonstration, show students how to open the Dr Watson for Windows dialog box and how to view the log file Point out the different parts of the file, including the application exception, system information, task list, module list, state dump, and symbol table Module 5: Configuring Internet Explorer and Application Compatibility vii Assessment Assessment questions for this module are located on the Student Materials compact disc You can use them as pre-instruction assessments to help students identify areas of difficulty, or you can use them as post-instruction assessments to validate learning Consider using assessments to reinforce learning at the end of the day You can also use assessments at the beginning of the day to review information that you taught on the previous day Module 5: Configuring Internet Explorer and Application Compatibility Overview *****************************ILLEGAL FOR NON-TRAINER USE****************************** Introduction In this module, you will learn how to configure security and connection settings for Internet Explorer to ensure that users have appropriate access to the Internet and intranet You will also learn how to configure applications so that they are compatible with Microsoft® Windows® XP Professional Objectives After completing this module, you will be able to: ! Configure security and connection settings for Internet Explorer ! Use the Internet Explorer Administration Kit (IEAK) and Group Policy to customize and deploy Internet settings ! Configure applications written for earlier versions of Windows to operate on computers running Windows XP Professional ! Configure the Dr Watson debugging utility to troubleshoot applications Module 5: Configuring Internet Explorer and Application Compatibility Lesson: Configuring Security and Connection Settings for Internet Explorer *****************************ILLEGAL FOR NON-TRAINER USE****************************** Introduction Your organization’s acceptable-use policy describes when users may download and run software from other hosts, and whether application components must be digitally signed Configure Internet Explorer to support this policy, to support and augment network security, and to protect individual users’ desktop computers Lesson objectives After completing this lesson, you will be able to: ! Describe the reasons to configure security and connection settings for Internet Explorer ! Describe Internet Explorer security options ! Configure security and connection settings for Internet Explorer 16 Module 5: Configuring Internet Explorer and Application Compatibility Demonstration: Using Group Policy *****************************ILLEGAL FOR NON-TRAINER USE****************************** Introduction In this demonstration, the instructor shows you how use the Internet Explorer Group Policy Management Console GPMC overview GPMC simplifies the management of Group Policy by providing a single solution for multiple management tasks Before using GPMC, the user should set up a reference computer, thereby allowing a user to import the current settings without modifying them when the user creates the installation package This is useful because if the user uses GPMC to change some settings, such as security zones, the settings also change on the computer that is running GPMC The GPMC provides: ! ! Backup and restore of Group Policy objects (GPOs) ! Import and export, and copy and paste of Group Policy objects ! Simplified management of Group Policy–related security ! HTML reporting of GPO settings and Resultant Set of Policy (RSoP) data ! Installing the GPMC A user interface that makes Group Policy easy to use Scripting of GPO operations that are exposed in GPMC, but not scripting of settings with a GPO In this demonstration, the instructor will use the instructor’s Windows XP Professional computer to install GPMC and save the console Click Start and then click Run In the Open textbox, type \\London\Setup\GPMC.msi and then click OK On the Welcome to the Microsoft Group Policy Management Console Setup Wizard page, click Next On the License Agreement page, click I Agree, and then click Next A dialog box displays indicating that QFE Q326469 must be installed Click OK Module 5: Configuring Internet Explorer and Application Compatibility 17 On the Welcome to the Windows XP Q326469 Setup Wizard page, click Next On the License Agreement page, click I Agree, and then click Next On the Completing the Windows XP Q326469 Setup Wizard page, click Finish On the Completing the Microsoft Group Policy Management Console Setup Wizard page, click Finish Viewing Internet Explorer computer configuration Click Start and then click Run In the Open textbox, type GPMC.msc and then click OK Expand Forest: nwtraders.msft, expand Domains, and then expand nwtraders.msft Right-click any GPO in the nwtraders.msft domain and click Edit Expand Computer Configuration, view the settings under Administrative Templates, Windows Components, and Internet Explorer Explain to students that this section of the Group Policy editor is used to restrict certain browser activities, and describe what the user is allowed to change Double-click Security Zones: Use only machine settings, and click the Explain tab Describe the use of this setting Move the Security Zone dialog box so that it does not hide the elements in the Settings pane Repeat the previous steps for the other settings as required In the Security Zone dialog box, you can click Next Setting to avoid having doubleclicking elements Note When you click a setting, the appropriate item is highlighted in the Settings pane Viewing Internet Explorer user configuration Expand User Configuration, view the settings under Administrative Templates, Windows Components, and Internet Explorer Click the Internet Explorer folder and expose settings that are not visible in the tree Click several subfolders and expose other settings Setting security zones Expand User Configuration, view the settings under Windows Settings, Internet Explorer Maintenance, and Security In the right pane, double-click Security Zones and Content Ratings Under Security Zones and Privacy, click Import the current security zones and privacy settings, and then click Modify Settings Note GPMC changes the settings on the computer where it is running 18 Module 5: Configuring Internet Explorer and Application Compatibility View the other subfolders, including Connection Note By importing connection settings, you also import the information in Automatic Browser Configuration and Proxy Settings Exit the GPMC Module 5: Configuring Internet Explorer and Application Compatibility 19 Guidelines for Configuring Internet Explorer *****************************ILLEGAL FOR NON-TRAINER USE****************************** Guidelines To protect your network from potentially dangerous Internet content, consider the following: ! ! Restrict cookies Because cookies often track private information, you can disable cookies on your computer By disabling all cookies, however, you cannot access some sites You can specify which cookies to block or which to allow in Internet Explorer ! Use an online virus checker By checking files that are copied to your computer, a virus checker protects your computer and network from malicious content while you browse the Internet ! Enforcing Web browser settings Restrict active content You can specify in Internet Explorer how you want to download and run active content For example, you can specify trusted sources for necessary controls Disable users’ ability to change Internet Explorer security-related settings Users often attempt to configure settings manually In Internet Explorer, misconfigured security-related settings could allow harmful content into the network Your organization’s acceptable-use policy usually describes when users may download and execute software from other hosts; limitations on the kinds of information that users may include in e-mail messages; and whether application components must be digitally signed You can enforce some of these Web client settings in either the Active Directory directory service by using Group Policy or in Internet Explorer by using the IEAK You can use the IEAK to create customized browsers with preset options, including security zone, proxy settings, and privacy settings that users cannot modify 20 Module 5: Configuring Internet Explorer and Application Compatibility Additional reading For more information about Group Policy, see the article Group Policy on the Microsoft Technet Web site at: http://www.micrososft.com/technet/ prodtechnol/windowsserver2003/management/gp/default.asp Module 5: Configuring Internet Explorer and Application Compatibility 21 Lesson: Configuring Applications for Windows XP Professional *****************************ILLEGAL FOR NON-TRAINER USE****************************** Introduction Users in your organization may require applications that were developed for earlier versions of Windows If a user has problems with an application that worked on an earlier version of Windows, use the Program Compatibility feature in Windows XP Professional to select and test settings that may fix the problem Lesson objectives After completing this lesson, you will be able to: ! Describe the Program Compatibility feature in Windows XP Professional ! Use the Program Compatibility feature to configure application compatibility 22 Module 5: Configuring Internet Explorer and Application Compatibility What Is Program Compatibility? *****************************ILLEGAL FOR NON-TRAINER USE****************************** Overview If you experience problems with a program that worked correctly on an earlier version of Windows, the Program Compatibility Wizard helps you to select and test compatibility settings that can fix those problems The wizard resolves the most common issues that prohibit earlier versions of programs from working correctly If you run a program and it does not function properly, it is recommended that you run the program in one of the compatibility environments You can also manually set the compatibility properties for a program The settings are the same as the options in the Program Compatibility Wizard You can use the Program Compatibility Wizard to test your programs in different modes (software environments) For example, if the program was designed to run on Microsoft Windows 95, you are prompted to set the compatibility mode to Windows 95 and again try running your program If the test succeeds, the program will start in that mode each time Program Compatibility mode supports the following operating systems: ! ! Microsoft Windows NT® (Service Pack 5) ! Microsoft Windows 98 ! Microsoft Windows Millennium Edition ! Example Windows 95 Microsoft Windows 2000 If an application does not function correctly under Windows XP Professional, try different settings, such as switching the display to 256 colors and the screen resolution to 640 x 480 pixels After selecting the application, you can run the program to test the settings If the test is not successful, try different compatibility settings Module 5: Configuring Internet Explorer and Application Compatibility Additional reading For more information about application compatibility technologies and the Application Compatibility Toolkit, see the Windows XP Application Compatibility Technologies home page at: http://www.microsoft.com/ WINDOWSXP/pro/techinfo/planning/appcompat/default.asp 23 24 Module 5: Configuring Internet Explorer and Application Compatibility How to Use Program Compatibility *****************************ILLEGAL FOR NON-TRAINER USE****************************** The Program Compatibility Wizard creates a temporary data file that contains information about the application, the program compatibility settings, and whether it solved the problems You may send this data file to Microsoft because Microsoft is building a database of programs that work and not work with program compatibility settings To run the Program Compatibility Wizard: ! Click Start, point to All Programs, click Accessories, and then click Program Compatibility Wizard To set the compatibility properties for a program manually: On the Start menu, right-click the program shortcut, and then click Properties Click the Compatibility tab, and then change the compatibility settings for your program Additional reading For more information about troubleshooting program compatibility, see the article, Using Program Compatibility Mode, at: http://www.microsoft.com/ windowsxp/pro/using/howto/gethelp/appcompat.asp For more information about setting compatibility properties manually, see “Getting older programs to run on Windows XP” in the Windows XP documentation To download the Application Compatibility Toolkit, see the Microsoft Web site at http://msdn.microsoft.com/compatibility Module 5: Configuring Internet Explorer and Application Compatibility 25 Lesson: Troubleshooting Applications *****************************ILLEGAL FOR NON-TRAINER USE****************************** Introduction If you cannot resolve a problem with an application, you can collect and send information about the problem to a technical support group for diagnosis You can use Dr Watson, a program error debugger, to detect information about system errors and record the information in a log file After completing this lesson, you will be able to: ! Describe how Dr Watson works ! Configure Dr Watson to troubleshoot applications 26 Module 5: Configuring Internet Explorer and Application Compatibility What Is Dr Watson? *****************************ILLEGAL FOR NON-TRAINER USE****************************** Definition Dr Watson for Windows is a program error debugger To diagnose a program error, technical support groups require the information that Dr Watson obtains and logs Dr Watson works most efficiently when you can reproduce an error Run Dr Watson and configure appropriate settings Try to reproduce the error, and then use the information in the Dr Watson log file to diagnose the cause of the error For intermittent problems, run Dr Watson constantly The default location of the log file is C:\Documents and Settings\All Users\ Application Data\Microsoft\Dr Watson Additional reading For more information about changing Dr Watson settings, see the Dr Watson product documentation Module 5: Configuring Internet Explorer and Application Compatibility 27 Demonstration: Viewing Dr Watson *****************************ILLEGAL FOR NON-TRAINER USE****************************** Introduction In this demonstration, the instructor will show you how to configure options for Dr Watson and then view a Dr Watson log file Configuring Dr Watson To open the Dr Watson dialog box: On the Start menu, click Run In the Run window, type drwtsn32 and then click Open In the Dr Watson for Windows dialog box, select: • The log file path • The crash dump path • The number of instructions and errors to save in the file • The crash dump type • Options for notification when an application error occurs • Any errors in the log file Using the dialog box to view a log file You can view the log file by using the Dr Watson for Windows dialog box or by opening the file Continue the configuration procedure as follows: In the Application Errors window, if an error file exists, click an error file Click View and see the log file for that particular application Opening a log file Open Windows Explorer and browse to the log file location Open the log file with Notepad 28 Module 5: Configuring Internet Explorer and Application Compatibility Examining the log file Open the drwtsn32.log file on the Trainer Materials compact disc using the Windows Explorer method View the following areas: ! Application exception occurred Application exception occurred: App: C:\Windows\System32\hkcmd.exe (pid=3980) When: 3/20/2003 @ 14:43:39.000 Exception number: c0000005 (access violation) ! System information * > System Information < * Computer Name: EVO310XP User Name: IM7User Terminal Session Id: Number of Processors: Processor Type: x86 Family 15 Model Stepping Windows Version: 5.1 Current Build: 2600 Service Pack: Current Type: Uniprocessor Free Registered Organization: Registered Owner: ! List of tasks * > Task List < * System Process System 624 smss.exe 688 csrss.exe 712 winlogon.exe 756 services.exe 768 lsass.exe 936 svchost.exe 1036 svchost.exe ! List of modules * > Module List < * (0000000000400000 - 000000000041f000: C:\Windows\System32\hkcmd.exe (0000000000900000 - 0000000000925000: C:\Windows\System32\igfxdev.dll (00000000009d0000 - 0000000000a1e000: C:\Windows\System32\igfxsrvc.dll (0000000010000000 - 000000001001d000: C:\Windows\System32\hccutils.DLL (000000005ad70000 - 000000005ada4000: C:\Windows\System32\uxtheme.dll (0000000070a70000 - 0000000070ad4000: C:\Windows\system32\SHLWAPI.dll Module 5: Configuring Internet Explorer and Application Compatibility ! 29 State dump * > State Dump for Thread Id 0xbc0 < * eax=0077006f ebx=00000104 ecx=02020e0e edx=00092f0e esi=00000001 edi=00000000 eip=01010586 esp=00c7e030 ebp=00c7f360 iopl=0 ei ng nz ac po cy cs=001b ss=0023 ds=0023 es=0023 fs=0038 gs=0000 efl=00000297 function: ieak6wiz 0101056b fd 0101056c ffff 0101056e 50 0101056f ff3570e80301 [ieak6wiz+0x3e870 (0103e870)] 01010575 ff15e8130001 [ieak6wiz+0x13e8 (010013e8)] 0101057b 83f804 0101057e 74c2 (01010542) 01010580 33f6 01010582 5b 01010583 8b45fc FAULT ->01010586 8b08 ds:0023:0077006f=???????? 01010588 8d55f8 0101058b 52 ! std ??? push push eax dword ptr call dword ptr cmp jz eax,0x4 ieak6wiz+0x10542 xor pop mov mov esi,esi ebx eax,[ebp-0x4] ecx,[eax] lea push edx,[ebp-0x8] edx add add add [eax],al [eax],al [eax],al Symbol table function: 7ffe02f2 0000 7ffe02f4 0000 7ffe02f6 0000 *SharedUserSystemCall: 7ffe02f8 0000 7ffe02fa 0000 7ffe02fc 0000 7ffe02fe 0000 7ffe0300 8bd4 7ffe0302 0f34 nv up add [eax],al add [eax],al add [eax],al add [eax],al mov edx,esp sysenter 30 Module 5: Configuring Internet Explorer and Application Compatibility Course Evaluation *****************************ILLEGAL FOR NON-TRAINER USE****************************** Your evaluation of this course will help Microsoft understand the quality of your learning experience At a convenient time before the end of the course, please complete a course evaluation, which is available at http://www.CourseSurvey.com ... configure security and connection settings for Internet Explorer ! Describe Internet Explorer security options ! Configure security and connection settings for Internet Explorer Module 5: Configuring. .. to: ! Configure security and connection settings for Internet Explorer ! Use the Internet Explorer Administration Kit (IEAK) and Group Policy to customize and deploy Internet settings ! Configure... Configuring Internet Explorer and Application Compatibility Lesson: Configuring Security and Connection Settings for Internet Explorer *****************************ILLEGAL FOR NON-TRAINER USE******************************