Microsoft Internet Explorer (IE) 7.0 is a core component of Windows Vista and
is available for the latest versions of Windows XP and Windows Server 2003.
This newest version of IE includes several cool new features, such as a streamlined
interface, improved search integration, tabbed browsing, RSS feed compatibility,
and advanced printing capabilities (e.g., IE 7.0 reformats printed output to
match the paper size rather than just cutting off text). But one of the biggest
improvements is IE 7.0's enhanced security. The browser offers ActiveX component
restrictions, phishing protection to help determine when a Web site might be
trying to obtain personal information, and improved security status highlighting
that changes the address bar to green for high-assurance Web sites.
These security enhancements make IE 7.0 valuable in most environments. Therefore
Microsoft is pushing the browser as a high-priority update. So if your organization
lets clients automatically update programs, you might not need to deploy IE
7.0. During the automatic update, the end user sees the dialog box that Figure
1 shows. The user must click Ask Me Later, Don't Install, or Install. If
the user chooses to not install the update, you can manually deploy it later.
(For information about preventing automatic updates, see the sidebar "Preventing
Internet Explorer 7.0 Automatic Deployment".)
Deploying Internet Explorer 7.0
If IE 7.0 isn't automatically deployed in your organization, you can download
the browser from Microsoft's Web site (http://www.microsoft.com/windows/ie/downloads/default.mspx).
IE 7.0 is available for Windows XP Professional x64 Edition, Windows XP SP2,
and various versions of Windows Server 2003 (e.g., Service Pack 1—SP1,
x64, IA-64). Several installation methods are available. The end user or administrator
can click a link, you can run a script from the downloaded file or a customized
package, or you can use Windows Server Update Services (WSUS) or Microsoft Systems
Management Server (SMS) 2003 to deploy the browser. In addition, users can manually
install IE 7.0 from a network share or CD-ROM.
The IE 7.0 deployment file for 32-bit XP environments (i.e., IE7-WindowsXP-x86-enu.exe) has two
switches that are useful for automated deployments.
The -passive switch shows the progress of the IE 7.0
installation but doesn't prompt the user for any information. The -quiet switch doesn't display any dialog
boxes.
For organizations that use WSUS, IE 7.0 appears as
a 15MB update rollup option. You can use standard
WSUS procedures to configure IE 7.0 deployment.
The browser will then deploy automatically and users
can decide whether to install, not install, or postpone
installation.
If your organization uses SMS, the Inventory Tool for Microsoft Updates (ITMU)
makes IE 7.0 available as part of the standard Microsoft Software Update Services
(SUS) functionality. You can use SMS's reboot features to control the deployment's
system restart requirements rather than using the IE 7.0 installation options.
You can also build a package of the downloaded IE 7.0 executable file with various
switches to create a silent installation. Alternatively, you can use the Internet
Explorer Administration Kit (IEAK) to create a customized IE 7.0 package for
a more controlled deployment.
Internet Explorer Administration Kit. The IEAK 7.0 is available
from http://www.microsoft.com/technet/prodtechnol/ie/ieak7/default.mspx
and comprises two main components, the Internet Explorer Customization Wizard
and the IEAK Profile Manager. During installation you're prompted for how you
plan to use the tool (e.g., in a corporate environment, as an ISP). For the
purposes of this article, let's assume a corporate environment.
To use the IEAK to create a customized IE 7.0 installation file, start the
Internet Explorer Customization Wizard. From the Start menu, select Programs,
Microsoft IEAK 7, Internet Explorer Customization Wizard. The first step is
to gather the required information related to deploying IE 7.0; click Next in
the wizard's introduction dialog box to get started. In the File Locations dialog
box that opens, browse to the folder where you want to create the deployment
build. By default, this location is C:\builds\todays date. The Advanced Options
button that Figure 2 shows lets you configure
automatic downloading of components and specify where to download components
during the build process. After you set these options, click Next.
A drop-down list displays that lets you select the target client platform,
which controls the version of IE you need to deploy (e.g., Vista—x86-based,
XP SP2). Next, select the language to use (the default is English). The next
dialog box that opens lets you choose the destination media type for the customization:
a file, an autorun CD-ROM, or the configuration-only information to use for
clients that are already running IE 7.0. (The configuration-only option is for
environments that don't use Active Directory—AD—and therefore
can't use Group Policy.)
The wizard then displays a list of features that require customization, as
Figure 3 shows. If you'll use Group Policy,
you need to select only a few features. Select the features you want to customize,
and click Next.
Now you must select where to download components from. Click Next in the introduction dialog
box. The wizard will connect to Microsoft's Web site
and check the latest version available. If you've previously run the IEAK and already have a downloaded
build, the wizard will also show the version on your
machine. If you don't have a local build, or a newer
version exists, click Synchronize to download the latest version to your machine, then click Next.
You can add as many as
10 custom components to
include with an IE 7.0 deployment. You can configure these
components to run before IE
installation, after installation,
or when the system restarts
after installation. After you
add the custom components
you want, click Next.
The next step in creating a customized installation is to configure the malicious
software removal tool to run before IE 7.0 installation and to allow the updates
to install. You also need to enable the option to let users configure the default
browser behavior. Finally, you need to specify whether to store uninstallation
data on the client machines (which uses valuable disk space).