https://worldofeuc.com logo
Join Slack
Powered by
This message was deleted.
# citrix-vad
s
This message was deleted.
d
Guess it depends on the actions that are launched by the active setup. It might just be placing a desktop shortcut or something that’s required. So probably only looking at the individual active setup actions and testing will tell you.
k
Well, it's the new MIcrosoft Edge browser which executes an .exe process, with 2 or 3 parameters which is of course not documented anywhere 🙂
n
You’ll need to test them, back in the Win7 days you needed to be careful removing actions as they would affect the theme applied, no document libraries (still think that’s a valid one, setting up media player. Many app packers use it too to apply per user keys, but I find you can replace most of those with a UEM tool - even the Edge one I’d say.
k
Thank you for your inputs @Nathan Shaw I think I'll do some testing to see if removing the Edge active setup has an impact on the general functionality of Edge
n
Ah, that would be @Nathan Sperry but thanks!
👍 1
But Q. Are you allowing Edge auto-updates?
j
Just kill them all. I've never noticed a single problem and I throttle the lot as a matter of course.
👍 2
The new Edge is an absolute abomination anyway so there's that as well
k
My apologies @Nathan Sperry and @Nathan Shaw 😄
n
I wouldn’t just kill the lot of them, for example Microsoft introduced this action in Win2008R2 SP1 (yes old crap but you get the idea) as a security mitigation “See https://support.microsoft.com/kb/3009008 This Fix configures ActiveSetup to disable SSLv3 in Internet Explorer, to mitigate the "POODLE" vulnerability. As an ActiveSetup component, this runs one time for each user at their next logon time” I’d always review them as these type of things could easily slip in the next LCU.
k
I have found that the Edge Active Setup creates a pinned shortcut on the taskbar in a server OS, and I cannot for the life of me understand why Microsoft keeps dictating where Edge should create shortcuts. I makes absolutely zero sense to create a pinned shortcut on the taskbar be it the setup process or via active setup.
I am a grown man, I am perfectly capable of creating application shortcuts on my own, thank you very much 🙂
j
Vendors should not be relying on ActiveSetup to mitigate security vulnerabilities. There is no reason to keep the Active Setup stuff IMO.
👍 4
n
Agreed, I hate the use of AS, try telling them that, but they do - that’s the point. Just removing everything without understanding what is does would not be my advice without some testing - I’m thinking FSLogix exclusions here!
j
Oh I always agree people should test, but from my experience, I have yet to see anything in 10 years or so of yeeting ActiveSetup entries that caused an issue. I used to have reservations about the .Net stuff, but now I just terminate with extreme prejudice. As always, YMMV, but this is my considered opinion 🙂
k
A very interesting article on Citrix Tech Zone about Google Chrome by @Dennis Span and @Martin Zugec : https://docs.citrix.com/en-us/tech-zone/build/tech-papers/google-chrome.html
I can see that Google Chrome uses the same approach with the Active Setup, it does not create the pinned taskbar shortcut though, so this must be a Microsoft thing
j
Tis interesting. Didn't know about the Chrome roaming profile stuff (Chroming profile?) Might use that
n
There’s a Chrome GPO to prevent some of that automatic 1st-time-logon behaviour. I expect also Edge has same.
j
Yep sorry should have mentioned the Chrome stub drops a desktop shortcut generally
k
But that can be disabled with the master_preferences file right?
n
Chrome does do same taskbar thing by default in my environment. I think I supressed it somewhere.
j
Yep there's an Edge reg key _HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer_—a DWORD value called DisableEdgeShortcutCreation with a value of 1.
k
Hmm...will check the Chrome installer then
I can see my Chrome install process imports some registry values regarding the automatic update process, nothing related to shortcut creation
I'll do some testing
n
Chrome does it, Adobe does it - they are all at it
k
Pinning stuff to the taskbar?
Or are you talking about the desktop shortcut?
n
Uses ActiveSetup to configure uses settings, not shortcuts thou
In fact anytime I install a unknown application I always check ActiveSetup, then use FSLogix to mask that stubpath
k
Fantastic idea with FSLogix
n
I do that, so if there is a problem, I dint have to keep a backup reg copy
k
I keep forgetting about App Masking, which is a bit strange as this how I got to know of FSLogix in the first place years back
j
I can guarantee the "user settings" they are enforcing are generally not helpful to anyone but themselves
👍 1
Also check for Scheduled Tasks that also do you no good
👍 1
n
All garbage inherited from Chromium. Ugh. Non-admin auto-update of apps? No thanks.
k
The non-admin update part seems to be going around with apps from MS lately.
j
Slack, Chrome, Teams, DropBox, everyone wants to push updates under your nose
👍 1
n
🤣🤣🤣 you mean like Azure or Intune?
n
I’ve always killed all AS items, except for one IE item - and only because it blows up the IE shortcut when using a custom Start layout if you kill it.
👍 1
t
you should be able to move anything in ActiveSetup to something like WEM and it should work just fine. The ONLY caveat to this is if whatever work done in ActiveSetup changes the "shell" (eg, adding the open with context menu). If the shell doesn't dynamically add these then you'd have to terminate/reopen the shell. Procmon can give you a better idea what these programs are trying to do.
👍 1
r
I kill them all or move them if needed. Side note, I struggle on optimizing the default profile. Maybe James has a bad ass script for that 🙂
j
Unfortunately it is very difficult to script. Getting the Registry permissions right is incredibly challenging
l
I usually delete all AS items also. But I have seen what @Nick Panaccio had seen with the IE icon disappearing on a pinned tile. What key was it Nick? Registry permissions and propagation is a pain in the registry for sure.
n
I can grab the key first thing in the morning.
Here's the registry info on that one key:
Copy code
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11cf-8B85-00AA005B4383}]
@="Web Platform Customizations"
"ComponentID"="BASEIE40_W2K"
"Dontask"=dword:00000002
"Enabled"=dword:00000001
"IsInstalled"=dword:00000001
"Locale"="*"
"LocalizedName"="@C:\\Windows\\System32\\ie4uinit.exe,-2000"
"StubPath"="C:\\Windows\\System32\\ie4uinit.exe -UserConfig"
"Version"="11,652,17763,0"
j
State of that key name "IE4 Windows 2000". You can forgive people for waxing them
👍 1
n
Microsoft's gonna Microsoft...
l
Lol seriously. Ie4!!!!
Thanks Nick
👍 1
3 Views
Open in Slack
PreviousNext
Powered by