Disabling IE add-ons and toolbars with Group Policy

Software installation policy is processed before Startup Scripts are executed. Sometimes that's exactly what you want, and other times it's not. You can't change it.

When I want a startup script to run before software installation I end up using group membership to control the execution of the startup script and I end the startup script with a command to add the computer to a second group that controls software installation. The only problem with this is that, to date, I have yet to find any reliable way to restart a Windows XP or newer OS from a startup script. (Yes, yes-- I've tried a variety of methods, too. I can discuss them in detail if you'd like.) As such, this always makes this strategy require two boots to "take effect".

You mention "preferences", so I think you're looking at doing things to the user's environment via a logon script. Logon scripts are executed, obviously, after logon. If you're looking to check to see if a piece of software has been installed during the logon script query the Windows Installer "database" in the registry to see if the program is there and "bail out". You'll find the installed products in the "HKEY_CLASSES_ROOT\Installer\Products" key. Obviously, you'll have to figure out the GUID for the package you're dealing with.

Edit: Group Policy client-side extension (CSE) processing order is performed based on the value of the GUID for the client-side extension, from what I've been able to glean from documentation. It looks like the CSE's with numerically higher GUIDs execute later. I don't have the GUID for the "Preferences" CSE handy so I can't tell you how it should act re: running before / after other CSE's.

On Windows XP, at least, dig into HKLM\Software\Microsoft\Windows NT\CurrentVersion\WinLogon\GPExtensions and look for the CSE for "Prefernces". REGEDIT will sort those GUIDs numerically, too, so you could be able to tell, visually, if that "Preferences" CSE is going to execute before/after other CSE's.

There is no native way to do this with Group Policy.

Others will come along and suggest you write a login script for the users to set the Site to Zone Assignments locally on the machine which will still allow them to add/change sites. I think that's a really bad idea personally.

We handle this by getting Site/Deskside Support to ascertain the problem, and then submit a ticket to us to add the site. We still retain control, because as professionals we know what's best. Not the users.

Does it create a little extra administrative overhead? Yes. Is it less overhead than all the extra work required to resolve infections and outbreaks in the environment? Yes.

The way we handle that scenario is to move their Test PCs into a Test Lab OU, create and link a GPO (that only sets the Site to Zone Assignment List) specifically to that OU, and delegate Group Policy Object Editing for that GPO to a member of the Dev/QA team.

They can then edit that single GPO to their hearts content.