Enabling the Internet Explorer BHO via group policy – Customer Portal

This article tells you how to enable the Impero Internet Explorer (IE) Browser Helper Object (BHO) through Group Policy.

The Impero BHO is used to filter and block websites accessed using Internet Explorer.

Note: The Impero BHO is only supported on 32-bit versions of Internet Explorer. The policies below may vary due to templates and if a central store is used.

1. Group Policy changes required to enable the Impero BHO

Within a Group Policy Object (GPO), for either "Computer Configuration" or "User Configuration" browse to the following options:

Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> Allow third-party browser extensions

ENABLE this policy

Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> Turn on Enhanced Protected Mode

DISABLE this policy

Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Advanced Page -> Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows
DISABLE this policy

Administrative Templates -> Windows Components -> Internet Explorer -> Disable add-on performance notifications (Turn off add-on performance notifications - Server 2012)

ENABLE this policy

Administrative Templates -> Windows Components -> Internet Explorer -> Automatically enable newly installed add-ons (Automatically activate newly installed add-ons - Server 2012)

ENABLE this policy

Administrative Templates -> Windows Components -> Internet Explorer -> Do not allow users to enable or disable add-ons

ENABLE this policy

Administrative Templates -> Windows Components -> InternetExplorer -> Turn off Managing SmartScreen Filter for Internet Explorer 9

ENABLE this policy and in the options choose to turn the filter OFF

Administrative Templates -> Windows Components -> Internet Explorer -> Turn off Managing SmartScreen Filter for Internet Explorer 8

ENABLE this policy and in the options choose to turn the filter OFF

Administrative Templates -> Windows Components -> Internet Explorer-> Security Features -> Add On Management -> Add On List

Enabled\Add On list

Value Name {220A4F50-B00B-484B-8CB3-E8C9032CFAE9}

Value 1

Additional policy for IE11 and above:

Windows 2012 R2:

Administrative Templates -> Windows Components -> Internet Explorer -> Turn off Performance Notifications

ENABLE this policy

User Configuration ->Administrative Templates -> Start Menu and Taskbar -> Do not allow pinning programs to the Taskbar

ENABLE this policy

User Configuration -> Administrative Templates -> Windows Components -> Internet Explorer -> Turn off ability to pin sites

ENABLE this policy

Additional Information:

If you have already deployed IE and you have roaming profiles, your users may have already disabled the Impero Browser Helper Object. Setting the group policy action above will stop them from disabling it in the future but you will need to delete a registry entry which was made by IE when the user disabled the Impero BHO.

Using a logon script (please do not use the Impero Remote Command Prompt as this will not work) type the following:

Reg delete HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{220A4F50-B00B-484B-8CB3-E8C9032CFAE9} /f

Note: This will work on Windows 7, 8.1 & 10

2. Impero Block Policies

You can use Impero to stop the students from disabling the BHO, although it is limited as IE will still pop up to ask to enable or disable BHOs. The message is called performance notifications and can only be disabled in Group Policy.

In Advanced Policies create 5 block policies:

Windows caption - *InPrivate Browsing*
Windows caption - *New Web Query*
Windows caption - *Internet Options*

Windows caption - *Manage add-ons*

Windows caption - *Choose add-ons*

Related articles