Another XPSP3 "gotcha" regarding mapped drives

Todd Miller

With Internet Explorer 7, there was a change/error made in the way mapped
drives are treated. Mapped drives mapped to an FQDN name are always treated
as the "Internet" zone even if the drive is mapped to a server in "Intranet"
or "Trusted Sites." This causes a problem during deployment because many of
the executables you call durring OS deployment are not signed. Thus you get
an propmt warning you that the executable is not signed and are you sure you
want to run it? This should not be happening because the mapped drive should
be in the "intranet" zone where by default unsignded executables are allowed
to run without prompting.

This error was introduced to XPSP2 by Internet Explorer 7. Even though IE7
is not included in XPSP3, this bug has been transfered to systems running
XPSP3 regardless of IE version.

Microsoft has created a registry edit that corrects the problem. Visit
KB929798. Note that you DO need to make the registry edit described, however
you DO NOT need to install the KB article. The hotfix KB929798 has been
added into SP3 and IE7 cumulative updates. Why Microsoft doesn't just fix
the problem instead of adding curriously named registry keys is a topic for a
different discussion.

You will need to make that registry change before you are able to run any
unsigned executables from mapped drives

Todd Miller

This problem is more serious than I originally thought. If you install
Windows XP with SP3 and then install IE 7 (as you would likely do in an image
build scenario) then you will be left with a downlevel URLMON.DLL file that
exibits the problem described in KB929798 (mapped drives show up in Internet
zone). There does not apear to be a patch available that will bring
URLMON.DLL up to a level that allows the workaround in KB929798. KB929798
itself will not install on SP3, and the most recent update to IE7 (MS08-024)
does not sufficiently update urlmon.dll.

I have a PSS ticket open.

"Todd Miller" wrote:

> With Internet Explorer 7, there was a change/error made in the way mapped
> drives are treated. Mapped drives mapped to an FQDN name are always treated
> as the "Internet" zone even if the drive is mapped to a server in "Intranet"
> or "Trusted Sites." This causes a problem during deployment because many of
> the executables you call durring OS deployment are not signed. Thus you get
> an propmt warning you that the executable is not signed and are you sure you
> want to run it? This should not be happening because the mapped drive should
> be in the "intranet" zone where by default unsignded executables are allowed
> to run without prompting.
>
> This error was introduced to XPSP2 by Internet Explorer 7. Even though IE7
> is not included in XPSP3, this bug has been transfered to systems running
> XPSP3 regardless of IE version.
>
> Microsoft has created a registry edit that corrects the problem. Visit
> KB929798. Note that you DO need to make the registry edit described, however
> you DO NOT need to install the KB article. The hotfix KB929798 has been
> added into SP3 and IE7 cumulative updates. Why Microsoft doesn't just fix
> the problem instead of adding curriously named registry keys is a topic for a
> different discussion.
>
> You will need to make that registry change before you are able to run any
> unsigned executables from mapped drives

Todd Miller

Update. PSS has been able to repro this issue.
"Todd Miller" wrote:

> This problem is more serious than I originally thought. If you install
> Windows XP with SP3 and then install IE 7 (as you would likely do in an image
> build scenario) then you will be left with a downlevel URLMON.DLL file that
> exibits the problem described in KB929798 (mapped drives show up in Internet
> zone). There does not apear to be a patch available that will bring
> URLMON.DLL up to a level that allows the workaround in KB929798. KB929798
> itself will not install on SP3, and the most recent update to IE7 (MS08-024)
> does not sufficiently update urlmon.dll.
>
> I have a PSS ticket open.
>
> "Todd Miller" wrote:
>
> > With Internet Explorer 7, there was a change/error made in the way mapped
> > drives are treated. Mapped drives mapped to an FQDN name are always treated
> > as the "Internet" zone even if the drive is mapped to a server in "Intranet"
> > or "Trusted Sites." This causes a problem during deployment because many of
> > the executables you call durring OS deployment are not signed. Thus you get
> > an propmt warning you that the executable is not signed and are you sure you
> > want to run it? This should not be happening because the mapped drive should
> > be in the "intranet" zone where by default unsignded executables are allowed
> > to run without prompting.
> >
> > This error was introduced to XPSP2 by Internet Explorer 7. Even though IE7
> > is not included in XPSP3, this bug has been transfered to systems running
> > XPSP3 regardless of IE version.
> >
> > Microsoft has created a registry edit that corrects the problem. Visit
> > KB929798. Note that you DO need to make the registry edit described, however
> > you DO NOT need to install the KB article. The hotfix KB929798 has been
> > added into SP3 and IE7 cumulative updates. Why Microsoft doesn't just fix
> > the problem instead of adding curriously named registry keys is a topic for a
> > different discussion.
> >
> > You will need to make that registry change before you are able to run any
> > unsigned executables from mapped drives

Henno Keers

Todd,

We ran in the same issue aswell, (after upgrading 2500 systems, 2500 to come
in the summer) currently we are testing KB929798, which seem to work well,
but with SP3 coming over the horizon at the end of the year, we cannot use a
fresh slipstreamed XPSP3 to build a new image and put IE7 on top of that.
There is always the possibility to modify KB929798 to accept SP3, but that's
last resort.
Did you hear anything of PSS?

Reg, Henno

"Todd Miller" <> schreef in bericht
news:...
> Update. PSS has been able to repro this issue.
> "Todd Miller" wrote:
>
>> This problem is more serious than I originally thought. If you install
>> Windows XP with SP3 and then install IE 7 (as you would likely do in an
>> image
>> build scenario) then you will be left with a downlevel URLMON.DLL file
>> that
>> exibits the problem described in KB929798 (mapped drives show up in
>> Internet
>> zone). There does not apear to be a patch available that will bring
>> URLMON.DLL up to a level that allows the workaround in KB929798.
>> KB929798
>> itself will not install on SP3, and the most recent update to IE7
>> (MS08-024)
>> does not sufficiently update urlmon.dll.
>>
>> I have a PSS ticket open.
>>
>> "Todd Miller" wrote:
>>
>> > With Internet Explorer 7, there was a change/error made in the way
>> > mapped
>> > drives are treated. Mapped drives mapped to an FQDN name are always
>> > treated
>> > as the "Internet" zone even if the drive is mapped to a server in
>> > "Intranet"
>> > or "Trusted Sites." This causes a problem during deployment because
>> > many of
>> > the executables you call durring OS deployment are not signed. Thus
>> > you get
>> > an propmt warning you that the executable is not signed and are you
>> > sure you
>> > want to run it? This should not be happening because the mapped drive
>> > should
>> > be in the "intranet" zone where by default unsignded executables are
>> > allowed
>> > to run without prompting.
>> >
>> > This error was introduced to XPSP2 by Internet Explorer 7. Even though
>> > IE7
>> > is not included in XPSP3, this bug has been transfered to systems
>> > running
>> > XPSP3 regardless of IE version.
>> >
>> > Microsoft has created a registry edit that corrects the problem. Visit
>> > KB929798. Note that you DO need to make the registry edit described,
>> > however
>> > you DO NOT need to install the KB article. The hotfix KB929798 has
>> > been
>> > added into SP3 and IE7 cumulative updates. Why Microsoft doesn't just
>> > fix
>> > the problem instead of adding curriously named registry keys is a topic
>> > for a
>> > different discussion.
>> >
>> > You will need to make that registry change before you are able to run
>> > any
>> > unsigned executables from mapped drives

Todd Miller

PSS was able to resolve this issue.

Install in this order.

Windows XP SP3
Internet Explorer 7
Patch using latest Cumulative update for IE 7 (currently KB950759)
-- Important: When applying this patch you must use the command line switch
/b:sp2qfe -- if KB950759 has already been installed without the switch it
must be removed and then reinstalled with the switch. If you try to install
the patch with the qfe switch on a machine that already has KB950759
installed, you will get an "Incorrect OS" error message.
--after this update is installed you still need to perform the registry
edits as described in kb929798

[HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
Explorer\Main\FeatureControl\FEATURE_RESPECT_ZONEM AP_FOR_MAPPED_DRIVES_KB929798]
"*"=dword:00000001

you could also limit this a little as "explorer.exe"=dword:00000001
and "iexplore.exe"=dword:00000001

instead, but I prefer to just do "*" - everything and be done with it.


"Henno Keers" wrote:

> Todd,
>
> We ran in the same issue aswell, (after upgrading 2500 systems, 2500 to come
> in the summer) currently we are testing KB929798, which seem to work well,
> but with SP3 coming over the horizon at the end of the year, we cannot use a
> fresh slipstreamed XPSP3 to build a new image and put IE7 on top of that.
> There is always the possibility to modify KB929798 to accept SP3, but that's
> last resort.
> Did you hear anything of PSS?
>
> Reg, Henno
>
> "Todd Miller" <> schreef in bericht
> news:...
> > Update. PSS has been able to repro this issue.
> > "Todd Miller" wrote:
> >
> >> This problem is more serious than I originally thought. If you install
> >> Windows XP with SP3 and then install IE 7 (as you would likely do in an
> >> image
> >> build scenario) then you will be left with a downlevel URLMON.DLL file
> >> that
> >> exibits the problem described in KB929798 (mapped drives show up in
> >> Internet
> >> zone). There does not apear to be a patch available that will bring
> >> URLMON.DLL up to a level that allows the workaround in KB929798.
> >> KB929798
> >> itself will not install on SP3, and the most recent update to IE7
> >> (MS08-024)
> >> does not sufficiently update urlmon.dll.
> >>
> >> I have a PSS ticket open.
> >>
> >> "Todd Miller" wrote:
> >>
> >> > With Internet Explorer 7, there was a change/error made in the way
> >> > mapped
> >> > drives are treated. Mapped drives mapped to an FQDN name are always
> >> > treated
> >> > as the "Internet" zone even if the drive is mapped to a server in
> >> > "Intranet"
> >> > or "Trusted Sites." This causes a problem during deployment because
> >> > many of
> >> > the executables you call durring OS deployment are not signed. Thus
> >> > you get
> >> > an propmt warning you that the executable is not signed and are you
> >> > sure you
> >> > want to run it? This should not be happening because the mapped drive
> >> > should
> >> > be in the "intranet" zone where by default unsignded executables are
> >> > allowed
> >> > to run without prompting.
> >> >
> >> > This error was introduced to XPSP2 by Internet Explorer 7. Even though
> >> > IE7
> >> > is not included in XPSP3, this bug has been transfered to systems
> >> > running
> >> > XPSP3 regardless of IE version.
> >> >
> >> > Microsoft has created a registry edit that corrects the problem. Visit
> >> > KB929798. Note that you DO need to make the registry edit described,
> >> > however
> >> > you DO NOT need to install the KB article. The hotfix KB929798 has
> >> > been
> >> > added into SP3 and IE7 cumulative updates. Why Microsoft doesn't just
> >> > fix
> >> > the problem instead of adding curriously named registry keys is a topic
> >> > for a
> >> > different discussion.
> >> >
> >> > You will need to make that registry change before you are able to run
> >> > any
> >> > unsigned executables from mapped drives
>

Henno Keers

Brilliant....

I will try this one tomorrow....

Thanks so far.

Reg, Henno.

"Todd Miller" <> schreef in bericht
news:...
> PSS was able to resolve this issue.
>
> Install in this order.
>
> Windows XP SP3
> Internet Explorer 7
> Patch using latest Cumulative update for IE 7 (currently KB950759)
> -- Important: When applying this patch you must use the command line
> switch
> /b:sp2qfe -- if KB950759 has already been installed without the switch it
> must be removed and then reinstalled with the switch. If you try to
> install
> the patch with the qfe switch on a machine that already has KB950759
> installed, you will get an "Incorrect OS" error message.
> --after this update is installed you still need to perform the registry
> edits as described in kb929798
>
> [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet
> Explorer\Main\FeatureControl\FEATURE_RESPECT_ZONEM AP_FOR_MAPPED_DRIVES_KB929798]
> "*"=dword:00000001
>
> you could also limit this a little as "explorer.exe"=dword:00000001
> and "iexplore.exe"=dword:00000001
>
> instead, but I prefer to just do "*" - everything and be done with it.
>
>
> "Henno Keers" wrote:
>
>> Todd,
>>
>> We ran in the same issue aswell, (after upgrading 2500 systems, 2500 to
>> come
>> in the summer) currently we are testing KB929798, which seem to work
>> well,
>> but with SP3 coming over the horizon at the end of the year, we cannot
>> use a
>> fresh slipstreamed XPSP3 to build a new image and put IE7 on top of that.
>> There is always the possibility to modify KB929798 to accept SP3, but
>> that's
>> last resort.
>> Did you hear anything of PSS?
>>
>> Reg, Henno
>>
>> "Todd Miller" <> schreef in bericht
>> news:...
>> > Update. PSS has been able to repro this issue.
>> > "Todd Miller" wrote:
>> >
>> >> This problem is more serious than I originally thought. If you
>> >> install
>> >> Windows XP with SP3 and then install IE 7 (as you would likely do in
>> >> an
>> >> image
>> >> build scenario) then you will be left with a downlevel URLMON.DLL file
>> >> that
>> >> exibits the problem described in KB929798 (mapped drives show up in
>> >> Internet
>> >> zone). There does not apear to be a patch available that will bring
>> >> URLMON.DLL up to a level that allows the workaround in KB929798.
>> >> KB929798
>> >> itself will not install on SP3, and the most recent update to IE7
>> >> (MS08-024)
>> >> does not sufficiently update urlmon.dll.
>> >>
>> >> I have a PSS ticket open.
>> >>
>> >> "Todd Miller" wrote:
>> >>
>> >> > With Internet Explorer 7, there was a change/error made in the way
>> >> > mapped
>> >> > drives are treated. Mapped drives mapped to an FQDN name are always
>> >> > treated
>> >> > as the "Internet" zone even if the drive is mapped to a server in
>> >> > "Intranet"
>> >> > or "Trusted Sites." This causes a problem during deployment because
>> >> > many of
>> >> > the executables you call durring OS deployment are not signed. Thus
>> >> > you get
>> >> > an propmt warning you that the executable is not signed and are you
>> >> > sure you
>> >> > want to run it? This should not be happening because the mapped
>> >> > drive
>> >> > should
>> >> > be in the "intranet" zone where by default unsignded executables are
>> >> > allowed
>> >> > to run without prompting.
>> >> >
>> >> > This error was introduced to XPSP2 by Internet Explorer 7. Even
>> >> > though
>> >> > IE7
>> >> > is not included in XPSP3, this bug has been transfered to systems
>> >> > running
>> >> > XPSP3 regardless of IE version.
>> >> >
>> >> > Microsoft has created a registry edit that corrects the problem.
>> >> > Visit
>> >> > KB929798. Note that you DO need to make the registry edit
>> >> > described,
>> >> > however
>> >> > you DO NOT need to install the KB article. The hotfix KB929798 has
>> >> > been
>> >> > added into SP3 and IE7 cumulative updates. Why Microsoft doesn't
>> >> > just
>> >> > fix
>> >> > the problem instead of adding curriously named registry keys is a
>> >> > topic
>> >> > for a
>> >> > different discussion.
>> >> >
>> >> > You will need to make that registry change before you are able to
>> >> > run
>> >> > any
>> >> > unsigned executables from mapped drives
>>

n3w813

Does this issue affect IE7 installs on Windows Server 2003 (SP2)?