Endpoint Integration Guide › Endpoint Hardening › Hardening Internet Explorer Endpoints › Prevent Unauthorized Changes to the Internet Explorer Add-on List

Prevent Unauthorized Changes to the Internet Explorer Add-on List

Use the Add-on List policy setting to prevent users from uninstalling the CA DataMinder Internet Explorer agent on endpoints. To additionally disallow all add-ons that are not included in the list, use it with the 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting.

Log on to the computer that is your domain controller. If you have multiple domain controllers, perform the following steps on each one.

Follow these steps:

1. Launch the Local Group Policy Editor by typing "gpedit.msc" in the Run box.
2. Browse to the following category:

   Computer Configuration\Administrative Templates\Windows Components\
     Internet Explorer\Security Features\Add-on Management.
   

3. Right-click the ‘Add-on List’ setting and choose Properties.

   The Properties dialog opens.

4. Click Enabled to view the enabled add-ons and then click Show.

   The Show Contents dialog opens.

5. Click Add and enter the following information for the CA DataMinder Internet Explorer agent:

   Value Name

   Defines the CLSID (class identifier) of the add-on you want to include on the Add-on list. You obtain the CLSID for an add-on by reading the OBJECT tag from a web page on which the add-on is referenced.

   Value

   Specifies whether Internet Explorer denies or allows the add-on.

   0

   Specifies that this add-on is disabled and users cannot manage it through the Add-on Manager.

   1

   Specifies that this add-on is enabled and users cannot manage it through the Add-on Manager.

   2

   Specifies that this add-on is enabled and users can manage it through the Add-on Manager.

   Example: Enter the CLSID for the CA DataMinder Internet Explorer agent as Value Name: {521fdca1-d5c5-11d4-b613-000102027bbb}. To prevent users from disabling the CA DataMinder Internet Explorer agent, enter 1 as Value.

Note: If you disable the Add-on List policy setting, the list is deleted. If the 'Deny all add-ons unless specifically allowed in the Add-on List' policy setting is active, but no add-ons are on the Add-on List, users cannot use any add-ons.