How to Stop IE8 through WSUS

blockinginternet-explorer-8wsus

Currently I have a two domain enviroment of vista with all machines calling into WSUS. The with the recent advent of IE8 being avaliable through WSUS that's been great. However I want to stop IE8 from being adverstied and for the life of me I can't find it in WSUS. There are plenty of blocker tool kits out there but they are regestry settings on the local machine and sadly my enviorment is large enough that going and touching each machine(darn you UAC!) is unfeasable at best.

Has anyone been able to stop WSUS from advertising IE8 and can point me in the direction of how to do this?

Thank you in advance

Best Answer

Part of an auditable WSUS deployment is making sure that your clients don't automatically get their updates from anywhere else. A GPO that directs their Automatic Updates service to your WSUS server is essential.

By default, WSUS will wait for you to approve newly received updates before they're advertised to clients. If you haven't approved the IE8 packages, they won't be advertised.

Based on your problem description, either your clients are getting IE8 from somewhere other than your WSUS server (i.e. Microsoft's Windows Update service) or your WSUS server auto-approved the IE8 deployment package.

Related Solutions

Stop IE8 renaming files to .zip when downloading

First some background..

Your web server is determining that the file is a valid ZIP archive by using some MIME magic. So it delivers the HTTP response with the following header:

Content-Type: application/zip

When IE8 receives the file it has already been told that it is a ZIP. Then, when in it's default security setting of "Open files based on content, not file extension", it looks up a designated extension for that content type from the registry at HKEY_CLASSES_ROOT\MIME\Database\Content Type.

There are a couple of ways that you could attack this. You could amend either of the two variables on the local machine above. But I certainly wouldn't recommend changing local machine settings wherever possible - it's hackish and won't scale. The best solution would be to amend the web server either by:

Setting up a static MIME declaration for the file's original extension to be sent as application/octet-stream. This will prompt the file to be deliver as straight binary, with no content information.
Serving the files with the header Content-Disposition: attachment which will cause IE to respect the filename specified by the web server. This may not be so simple depending on your platform though.

WSUS will not update or install updates on new workstations

Have you updated group policy to point the workstations to the new WSUS server?

Intranet Microsoft Update Service Location - located in Computer Configuration / Administrative Templates / Windows Components / Windows Update

Best Answer

Related Solutions

Stop IE8 renaming files to .zip when downloading

WSUS will not update or install updates on new workstations

Related Topic