User Rights Deployment Does Not Set Default Browser

If you use the User Rights Deployment feature of Internet Explorer 5.5 Administration Kit (IEAK) on a Windows 2000-based computer, after you restart the computer, all members of the user group receive a prompt that indicates that Internet Explorer is not the default browser. Attempts to set Internet Explorer as the default browser do not succeed, and this continues to occur until a user with administrator rights to the computer logs on.

This behavior occurs even though an administrator originally selected this option in the IEAK to force Internet Explorer to be the default browser.

During the implementation of the User Rights Deployment feature, the RunOnceEx registry key is moved to the RunOnceTemp registry key, and is registered with Windows Installer with the option Execute with Elevated Permissions enabled. During the registration, Shdocvw.dll is registered through its DLLRegister, and DLLInstall internal functions. One of the functions of these registry keys is to set up the file associations in HKEY_CLASSES_ROOT for HTMLFILE and MTHTMLFILE associations. Due to the design of this registration, Internet Explorer will not be forced as the default browser if these keys existed. This occurs so that Internet Explorer does not forcibly replace a competitors browser as the default browser just because the user installed a program that required the installation of Internet Explorer.

Through the IEAK there is an option that forces Internet Explorer to become the browser, however, this is accomplished through the Client Branding portion of the IEAK, which occurs on the first execution of the browser. Because the first execution of the browser is not performed with the Elevated Permissions, the registry keys that would be written to make Internet Explorer the default browser will not succeed on Windows 2000. This is a design issue within Windows 2000 that provides additional security to the registry. When Internet Explorer calls into Shell32.dll with the RegSetValue() function, Windows 2000 Shell32.dll will first attempt to create the key in question. If the call to RegCreateKey() does not succeed, the user does not have permissions to this key, and the operating system will return an "Access Denied" error message to the requesting application that called RegSetValue().

To resolve the issue, the following registry keys must be written during the processing of the RunOnceTemp key where C:\Program Files\Internet Explorer is the folder in which Internet Explorer is currently installed: To accomplish this, use one of the following methods:

• Use Windows 2000 Group Policies to set the key. Because the policy will write the registry keys with the System context, the logged-on user context does not matter.
• Use Microsoft Systems Management Server (SMS), or another maintenance utility to create the keys.
• Use an IEXPRESS package to write the keys, and include the IEXPRESS package as a custom component within the IEAK to execute after restarting the computer, and only if the installation of Internet Explorer was successful.

Sample INF

You can add this sample INF to an IEXPRESS Package:

Microsoft has confirmed that this is a problem in the Microsoft products that are listed at the beginning of this article.

You can use the following references for information regarding the creation, and use of the IEXPRESS package:

For information about the INF structure, please refer to Appendix H of the Internet Explorer 5.x Resource Kit. For individual commands, such as addreg, delreg, copyfiles, delfiles, and so forth, please query on MSDN for the specific command. For example, for more information about the addreg command, refer to the following hyperlink on MSDN: For information about the use of the IEXPRESS utility, please refer to the Internet Explorer Resource Kit Help File Ieakhlp.chm, which is located within the IEAK folder.