Category: Microsoft

Internet Explorer Tracking Protection

Internet Explorer Tracking Protection

One of the most overlooked features of Internet Explorer, is the Tracking Protection feature. Tracking Protection is a feature that prevents websites from tracking your browsing behavior. You know if you for instance search for, let’s sat a new Synology NAS box in Google. Suddenly a lot of NAS related adds appear in your Facebook feed and on various other add-driven sites. That’s basically tracking, someone somewhere now knows that you are in the market looking for a new NAS.

However Tracking Protection also prevents all adds, flash content and the likes from being loaded when accessing a website. This means that in most cases the websites will be loading faster and not consume as many system ressources.

In this blog I will cover how to enable Tracking Protection and why I recommend doing this, especially in a multiuser scenario.

Up until a few years ago my preferred browser was Internet Explorer. Actually, besides the good old days with Netscape Navigator, I have always used Internet Explorer when browsing the internet. I am not trying to start yet another browser war here, but the alternatives like Google Chrome, Mozilla Firefox or Opera never really said me much, I had gotten used to working with Internet Explorer and liked, and still likes, the way it works.

However as Windows 10 was released we received a new browser called Edge. Edge is supposed to be the successor of Internet Explorer and at least for my part, that is the case, but according the various sites here and here, it doesn’t look like Edge is getting favoured by many people, it’s still Google Chrome that’s topping the lists as the most preferred browser.

Even though Google Chrome may be the most preferred browser, this is usually not the case in multiuser setup like Citrix XenApp or Microsoft RDS, as we would like to provide a secure and consistent user experience, that includes the browsing experience as well. We can, via group policy, lock almost everything in Internet Explorer down, which gives us total control of what parts of Internet Explorer the user can access and/or configure. Any Internet Explorer security updates, or just regular feature updates, are all maintained either via the Microsoft Update site or via an internal Windows Server Update Service (WSUS) server, which means that during our regular Windows operating system maintenance we get updates for Internet Explorer as awell as any other relevant Microsoft software.

So how does it work?

How to configure Tracking Protection manually:

First we need to enable Tracking Protection in Internet Explorer:

Click – Tools -> Internet Options – Programs

Click – Manage add-ons

Click – Get a Tracking Protection List online…

This should bring you to this site – http://iegallery.com/da/trackingprotectionlists/ (Or a smilar looking URL based on your region)

That site errors out, way to go Microsoft!

This has been an issue for at least 6 months, maybe more, and it doesn’t look like Microsoft is going to fix it anytime soon.

So what we need to do instead, is to go to this URL – https://www.microsoft.com/en-us/iegallery

Scroll down to the Tracking Protection Lists section and select EasyList Standard, EasyList and Stop Google Tracking, by clicking add on each list.

This adds the lists to Internet Explorer and your Tracking Protection configuration, should now look like this

Your browsing experience should now be significantly faster than before the activation of Tracking Protection and also consume less system ressources.

I have created 2 short videos in which I demonstrate how the browsing experience is in Internet Explorer with and without Tracking Protection enabled. The demonstration is done in Citrix XenApp 7.18 on Windows Server 2016 in Internet Explorer 11with the latest Microsoft Updates. I have used http://www.cnn.com for demonstration purposes, however you will probably notice the same behavior with pretty much any other site.

Tracking Protection disabled:

Tracking Protection enabled:

Have a look at the CPU usage in the first video where Tracking Protection is disabled. When the site just sits there doing nothing, the CPU usage is somewhere between 40% and 70%. This is huge if you have multiple users on a Session Host server, imagine 10 users just loading this page and let it sit doing nothing.

In the second video, where Tracking Protection is enabled the CPU usage is loking a lot better some where between 5% and 15% when the site just sits there doing nothing. Also 37 services have been bloked on this particular website. As I scroll up and down, CPU usage spikes does occur because of the change in content on the site, this is normal behaviour and will occur both with and without Tracking Protection.

How to configure Tracking Protection via Group Policy:

So now you may be asking “Now I have the Tracking Protection enabled on my local Internet Explorer browser, how do I enable it for every user in my environment?”. The answer to that question is: “Via Group Policy and Group Policy Preferences, of course :)”

Once Tracking Protection has been enabled a few things happen in the file system and registry.

In the file system:

  • In the user’s profile 3 so called TPL files gets downloaded, these files contains the EasyList, EasyPrivacy and Stop Google Tracking lists.
  • The TPL files can be found here  – %LOCALAPPDATA%\Microsoft\Internet Explorer\Tracking Protection and looks like this:
  • Copy the TPL files to a central location like NETLOGON or a share where users have read access.

In the registry:

  • In the user’s registry 3 registry keys and a few values within these keys are created.
  • The registry key names corresponds with the above TPL GUID like names, and looks like this:
  • The full path the the above keys is – HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Safety\PrivacIE\Lists
  • So, as you see, 3 registry keys are created with names that corresponds with the names of the TPL files.
  • Export the 3 keys to a REG file and in each key, change the “Path” value to %LOCALAPPDATA%\Microsoft\Internet Explorer\Tracking Protection\nameofTPLfilehere.tpl

GPO Configuration:

  • Create a new GPO
  • Under User Configuration configure Group Policy Preferences registry items like shown below:
  • For each of the 3 registry keys modify the Path value, so that it looks like this:
  • %<LOCALAPPDATA>%\Microsoft\Internet Explorer\Tracking Protection\nameofTPLfilehere.tpl
  • This makes sure that the Group Policy engine resolves the %LOCALAPPDATA% correctly, and thereby configures the correct path to the TPL file.
  • You will also have to add this registry value:
  • This enables the Tracking Protection filtering feature.

You may have noticed the Tracking Protection Exceptions group I have in the GPO. The Tracking Protection Exceptions list enables you to configure specific URLs where you don’t want Tracking Protection to be active. This might be internal URLs like an intranet site or some other internal web based application, where Tracking Protection could be messing with the general functionallity of the web site.

To configure a list of exceptions add this to your GPO:

  • Here, as an example, I have the http://intranet.company.local URL you may add as many URLs you want here.

As this GPO configures user settings, it can be applied to both Windows client operating systems and Windows server operating systems. I have tested this specific configuration on Windows 7 and later and on Windows Server 2008 R2 and later, however only with Internet Explorer 11.

This concludes my guide on how to enable and configure Internet Explorer Tracking Protection. Feel free to comment.

User Profiles…the struggle is real!

User Profiles…the struggle is real!

During the last couple of years I have seen that managing user profiles in a Citrix environment can be a major PITA. However before going any further, let’s take a few steps back in time.

In the good old days in the world of Citrix, with Windows Server 2008 R2 and Windows 7, everything was nice and quite in the user profile area. We were happily rolling along with Citrix User Profile Manager, telling ourselves that the old, dusty and rather unstable Windows Roaming Profile was a thing of the past and no one would ever be using that again. We were managing User Profiles like a boss, with fine tuned configurations preventing profile bloating, roaming of Internet Explorer cookies and passwords and perhaps roaming different files and folders outside the APPDATA\Roaming folder.

Fast forward to today, or a couple of years ago, Microsoft released Windows 10 and Windows Server 2016 and with them new Windows Profile versions.

Let’s have a quick look at the different Windows Profile versions dating back to Windows XP and Windows Server 2003:

UPDATE – 04/11-17: I have updated the table below to reflect the current Windows 10 versions.

Client Operating SystemServer Operating SystemOperating System VersionProfile Version/extension
Windows XPWindows Server 2003/2003 R2None
Windows VistaWindows Server 2008 V2
Windows 7Windows Server 2008 R2V2
Windows 8Windows Server 2012V3
Windows 8.1Windows Server 2012 R2V4
Windows 10V1507V5
Windows 10V1511 (November Update)V5
Windows 10Windows Server 2016V1607 (Anniversary Update)V6
Windows 10V1703 (Creators UpdateV6
Windows 10V1709 (Fall Creators Update)V6

 

You may have noticed that Windows 10 is currently offering 2 different Windows Profile versions, V5 and V6, and rumors are that the Windows 10 Fall Creators Update may present a V7 Windows Profile. This is where the struggle begins!

UPDATE – 04/11-17: Windows 10 v1709 (Fall Creators Update) did infact NOT present a V7 Windows Profile version. V1709 is still on V6, like v1703 and v1607.

As per this “Windows as a service” guide Windows 10 will receive 2 feature updates per year, a feature update is like the Anniversary Update or the Creators Update and even though Microsoft is boasting of an “outstanding app compatibility”, this isn’t really of much use to us, if they change the profile version. A profile version change will initially trigger a new profile to be created at login which means that we need to do some kind of profile migration between the old profile and the new profile, unless we really like to receive a lot of support calls about missing application settings or that no default printer is set, because something went wrong during the profile version upgrade.

If we are using Citrix Profile Manager this profile version upgrade is handled automatically, however do wo really want to do that? If we shortly revisit the good old times, we didn’t upgrade the user profiles when we migrated from Windows XP to Windows 7 or from Windows 7 to Windows 8 or Windows 10, did we? I sure didn’t and when is comes to traditional profile management I always recommend to do a profile migration NOT an upgrade!

In the good old times, a profile upgrade was always associated with a operating system upgrade. So when we are offered, at the moment, 2 different windows profile versions i Windows 10, in my mind that is the equivalent of an operating system upgrade, which means that the profile needs to be migrated as the functionality and stability of the profile cannot be guaranteed, if it’s upgraded.

In a Windows 10 VDI scenario this presents us with a couple of things to keep in mind. As per above guide, each feature update is maintained with so called quality updates every 18 months, so at least once every 18 months we need to upgrade our Windows 10 VDIs with a feature update. Let’s just assume, and I am NOT saying that this will be the case, but let’s just assume that Microsoft will upgrade the windows profile version every 18 months, this may not be a desirable scenario, as we need to maintain some kind of profile migration feature/script to be able to migrate the settings from the old profile to the new profile with the new version.

Some Citrix setups offer hundreds of different applications where all kinds of settings are saved in all kinds of places eg. files/folders/registry, this means that a potential migration feature/script needs to cover whether the settings of one or more applications needs to be migrated or not in case of a profile version upgrade. As applications come and go or gets upgraded these different places where applications might save their settings, will have to be maintained in what ever migration feature used, which then again means that we need to have a great deal of knowledge of our applications, not just how to install them, but also how and where their settings are saved.

Let’s take a look at how Citrix User Profile Manager can help us, some of the way, when upgrading Windows 10.

This is how a Citrix UPM share looks like, when a user has logged on from a Windows 10 v1511, Windows 10 v1607 and Windows 10 v1703:

This is achieved with the “Path to user store” in a Citrix UPM GPO configured like this:

The !CTX_OSNAME! and the !CTX_OSBITNESS! are both variables that can be used as a part of the profile share path. When these variables are combined you get a very flexible profile share path where a folder is created that corresponds to the operating system and the bitness of the operating system. This means that you would usually never need more than one profile share, when using Citrix User Profile Manager.

This configuration makes sure that a new profile is created when logging on to an upgraded Windows 10 computer with a new windows profile version.

You can omit the !CTX_OSNAME! and the !CTX_OSBITNESS! and point directly at the #SAMAccountName# variable, however this will create a profile folder for the user in the root of the share, which means that you will no longer have a folder named “Win10RS2x64”. If this is the case you now have a profile share that is “locked” to this specific version of Windows 10, that’s not wrong but it may present some issue at some point, as we essentially don’t want Windows or Citrix UPM to do profile upgrades.

One way or another we are in need of some way to transfer and/or migrate settings between different profile versions. You can of course bring out the big guns and go with RES or AppSense as they are perfectly capable of migrating profile and applications settings between different profile versions with their User Environment Management (UEM) solutions.

Liquidware is, compared to RES and AppSense, a smaller player in this area, however they have in their ProfileUnity product a way to migrate profile and application settings between different Windows versions and that of course includes Windows 10 as well. They also have disk based profiles, which really boosts the login performance.

You can of course also create your own profile and applications migration script, I have seen a few so I know they are out there.

To conclude – With Windows 10 we are, in my opinion, entering a new ara where we are basically doing operating system upgrades once every 12-18 months, this adds a bunch of additional tasks to our already long list of Citrix and Citrix related tasks. I think now would be a great time to implement some kind of UEM feature, to be able to manage and maintain the profile and applications settings in different user profile on different operating systems. Citrix User Profile Manager is, in my opinion, now considered the “old solution” together with the traditionel Windows Roaming Profile.