normanbrobinson
commented
8 years ago This is an ongoing issue in large enterprises and government agencies where there are security policies restricting add-ons at the local machine, network, and enterprise policy levels. The following group policy items should be changed after the Group Policy Object (GPO) has been pushed and applied to the machine.
OS :: Settings :: Value Windows 7, Windows 8.1 :: Computer Configuration/Policies/Administrative Templates/Windows Components/Internet Explorer/ Automatically activate newly installed add-ons :: Default: Disabled Change To: Enabled
Windows 7, Windows 8.1 :: Computer Configuration/Policies/Administrative Templates/Windows Components/Internet Explorer/ Do not allow users to enable or disable add-ons :: Default: Enabled, Change To: Disabled
Windows 7, Windows 8.1 :: Computer Configuration/Policies/Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Advanced Page Allow third-party browser extensions :: Default: Disabled, Change To: Enabled
Windows 7, Windows 8.1 :: Computer Configuration/Policies/Administrative Templates/Windows Components/Internet Explorer/Security Features/Add-on Management Add-on List {11352A67-0178-46B1-8855-D50B2F81C054} :: Default: Disabled, Change To: Enabled
Windows 8.1 :: Computer Configuration/Policies/Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Advanced Page/Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows :: Default: Enabled, Change To: Disabled
User Profiles
In most cases after the installation of WAT and the GPO being applied, the user profiles are in a good condition. However, there have been some cases where the user profiles have corrupted for unknown reasons to the point where the user will be unable to enable WAT on their machine’s Internet Explorer. This is a common problem many people have experienced on their computers that has been connected to the domain and their accounts are a part of the domain’s Active Directory. There have been no complaints from personal PCs and/or workstations that are not a part of the domain. To confirm this theory, another user or an IT technician should log in the computer and test the WAT toolbar. If it does enable for other users, but not the primary user, please follow the steps below. If it does not work for other users, it is mostly likely the GPO is configured incorrectly or that the computer has not received the updated group policies.
If WAT does work for other users but not the primary user, the only way to resolve this issue is for an IT technician with administrative privileges to delete the current user’s user profile and allow the user to log back on the computer in order for the computer to regenerate the user profile. NOTE: This method will wipe off all data from the user’s account (Documents, Pictures, Desktop, saved emails, folders, etc.). Please make sure the user back up all data from the machine onto a back-up drive (e.g. an approved USB Flash Drive, network personal drive, etc.)
!! DO NOT PROCESS THE STEPS BELOW UNTIL THE USER PROFILE’S DATA HAS BACKED UP !!
Navigate to the following: Control Panel > System > “Advanced System Settings” > “Advanced” tab > “Settings” button under “User Profiles” > Select the user profile that is having problems. Click on “Delete”
Troubleshooting
WAT not turning on in IE (after user profile)
- Please make sure there is an existing GPO in place where Security has created for WAT to be allowed on the network. Names vary by agencies depending on who named the group policy. The person who named it could be a person from either Engineering or Security. At DHS HQ, it is called “WAT Toolbar Allow”.
- Please check whether or not if the machine is in the correct GPO so the machine can receive and apply the proper group policies. Inside those policies, it will allow the user to enable the toolbar inside the user’s Internet Explorer (IE).
- For the technicians, they can check whether or not if the machine has gotten the GPO pushes by typing in the Command Prompt (with Administrative Privileges).
gpresult /r /scope computer
Should display Applied Group Policy Objects, "Win7 WAT Toolbar Allow" and the security groups should have "WAT Toolbar Allow".
Hope that helps!
patrickhlauke
We’ve successfully installed your WAT product in our staging environment without issues and displaying the tool bar as normal. However when we attempt to do so in our internal domain environment, the installation process runs, successfully completes and installs the application in the local path: C:\Program Files\Web-Accessibility-Toolbar. Unfortunately, though, the toolbar does not appear in IE as others.
Looking in the Managed Add-ons / Toolbars and Extensions, within IE, shows the toolbar as “enabled”. But we cannot see it, so the users can access and utilize.
We’ve installed in the following environment: • Windows 7 Enterprise (SP1). • All applicable and current Windows Updates have been applied through Windows WSUS. • Temporary disabled the local ESET Endpoint Security 6.4.2014.0 Antivirus and Firewall features. • Local Administrators on the respective machines. • Ran IE with and without Administrator credentials. • Our Security Group has approved the Development Team, the install and use of this tool.