CoNetrix

Blog: Internet Explorer

We had a customer report that all browser windows were closing for users and this was increasing in frequency. Most of the users reporting the issue were at the corporate office, which has about 150 users and is where the IT department is located. I performed a remote session with on the users and confirmed the issue. Internet Explorer, Chrome, and Firefox all would close, not crash, at the same time.

My first thought was that some remote assistance and IT management software they had recently installed was causing the issues. We uninstalled the software and the issues continued. My next thought was that something malicious was on the network and was killing the processes remotely. I moved the PC to the guest wireless network and the issues stopped. After moving the PC back to the internal network, the issues began again. After a while, the issues randomly stopped for this user. I moved on to looking at another user's PC. The IT department did not know of any new devices that had been brought onto the network.

Whatever was causing the issues was obviously powerful enough to kill processes. The browsers seemed to be closing at regular intervals, at the top of the hour and half after the hour. I started Process Monitor, Process Explorer, and WireShark, opened the browser, and waited. As expected, the issue occurred again. I started looking through the WireShark logs and did not see anything odd. I looked at the Process Monitor log and found several cmd.exe processes killing the browser applications. At about the same time I saw the cmd.exe commands that killed the browser processes, I saw nxclient.exe processes that called cmd.exe and ran taskkill commands.

I started searching online and found a blog on the NxFilter support group discussing the same issue. This customer has NxFilter for web filtering for several years. They were using version 5.0 of NxClient, which was before the version mentioned in the NxFilter support group. The NxFilter creator responded to that group and said that the client was doing so to force a refresh the user's session, but that this is not the correct behavior. There was a new version of NxClient that fixed this behavior. Version 9.1.3 of NxClient was current, so I updated the customer to use the newer version. That resolved the issues. 

 

Internet filtering, Internet Explorer, Chrome,
 

I was helping out with a customer’s Active Directory migration and a different IT support group used a profile migration tool to help “ease” the transition between domains. But soon after the users started complaining that IE was not allowing them to save passwords. They would get prompted to store the credentials for a website and click yes, but as soon as they closed and reopened IE their stored credentials would disappear. Our suspicion was that the profile migration tool had corrupted the credential store in the registry.

I started a remote session with one of the users, checked the IE password store in the registry (HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\IntelliForms\Storage2), and saw several of the user’s old entries. In order to allow the user to store passwords again, I had to delete this registry key, reopen IE, and save credentials for a website. Once I clicked “yes” to the prompt to save credentials, the registry key was automatically recreated and the credentials got stored.

Networking, password, Registry, Internet Explorer, Active Directory, Windows,
 
 

Though the Security Zones GUI under Internet Properties only has four well defined “zones”, you can actually create your own custom zone pretty easily.  We had to do this for a customer that needed some very specific (wide-open) security settings for their site to work properly.  Rather than comprise the security of the other “Trusted Sites”, we created a new zone for the one specific site.  The easiest way to do this is by using the GUI to get all your settings just so (by editing one of the built-in zones).  Then, from the registry editor, export the edited zone’s registry key located under HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones.  The zones are numbered 0-4, but you can check the “DisplayName” entry to make sure you are exporting the right zone.  You can then edit the exported REG settings to increment the zone number by one, and change the “DisplayName”, “Description”, and “PMDisplayName” to whatever you want.  The “PMDisplayName” is what will show in the IE status bar when you visit the included site/sites.  Save your changes and import the modified zone REG file.

Networking, Security and Compliance, Internet Explorer,