HTML Help files on network shares now unavailable

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

After security update MS05-026 was installed on our user's workstations, no
one can access HTML help files (.chm) files from applications installed on or
residing on a network share.

I have seen the KB articles explaining why, and the "fixes", but they are
inadequate. One specifies to right-click each .chm file, go to Properties
and choose "unblock". a) this option of "Unblock" doesn't exist, and b)
there are thousands of these .chm files.

Another KB article gives registry changes that don't make sense to deploy
enterprise-wide, and they defeat the purpose of the security patch in the
first place.

I have searched far and wide and have not found a fix for my environment.
Any ideas, places to research further, patches upcoming, etc?

Thanks

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Pete G wrote:

> After security update MS05-026 was installed on our user's workstations, no
> one can access HTML help files (.chm) files from applications installed on or
> residing on a network share.
>
> I have seen the KB articles explaining why, and the "fixes", but they are
> inadequate. One specifies to right-click each .chm file, go to Properties
> and choose "unblock". a) this option of "Unblock" doesn't exist, and b)
> there are thousands of these .chm files.
>
> Another KB article gives registry changes that don't make sense to deploy
> enterprise-wide, and they defeat the purpose of the security patch in the
> first place.
>
> I have searched far and wide and have not found a fix for my environment.
> Any ideas, places to research further, patches upcoming, etc?
>
> Thanks
Hi,

I'm afraid deploying some registry settings is your only option.

Deploying the setting in the registry file listed below will solve
the problem as long as your network drive or UNC path is defined as
"Local intranet zone" (it should be).

To see what zone you have for the path, in Explorer, select
"Status Bar" under the View menu and then go to the folder where the
help files are located. If it says "Internet" in the Status bar, you
will need to add your domain or server to the "Local intranet zone".


--------------------8<----------------------
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\ItssRestrictions]
"MaxAllowedZone"=dword:00000002

--------------------8<----------------------

The setting above will open up for Local Machine zone, Local intranet
zone, and Trusted sites zone, but *not* the Internet zone.

More about this registry setting here:

http://support.microsoft.com/kb/896358

and here:
http://support.microsoft.com/kb/896054




--
torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
Administration scripting examples and an ONLINE version of
the 1328 page Scripting Guide:
http://www.microsoft.com/technet/scriptcenter/default.mspx

 

[Guest]

Archived from groups: microsoft.public.windowsxp.security_admin (More info?)

Thank you. Your fix steps are much simpler and easier to understand than
what I found on MS KB. I guess I just needed an interpreter. This shouldn't
be too difficult to deploy.

Pete

"Torgeir Bakken (MVP)" wrote:

> Pete G wrote:
>
> > After security update MS05-026 was installed on our user's workstations, no
> > one can access HTML help files (.chm) files from applications installed on or
> > residing on a network share.
> >
> > I have seen the KB articles explaining why, and the "fixes", but they are
> > inadequate. One specifies to right-click each .chm file, go to Properties
> > and choose "unblock". a) this option of "Unblock" doesn't exist, and b)
> > there are thousands of these .chm files.
> >
> > Another KB article gives registry changes that don't make sense to deploy
> > enterprise-wide, and they defeat the purpose of the security patch in the
> > first place.
> >
> > I have searched far and wide and have not found a fix for my environment.
> > Any ideas, places to research further, patches upcoming, etc?
> >
> > Thanks
> Hi,
>
> I'm afraid deploying some registry settings is your only option.
>
> Deploying the setting in the registry file listed below will solve
> the problem as long as your network drive or UNC path is defined as
> "Local intranet zone" (it should be).
>
> To see what zone you have for the path, in Explorer, select
> "Status Bar" under the View menu and then go to the folder where the
> help files are located. If it says "Internet" in the Status bar, you
> will need to add your domain or server to the "Local intranet zone".
>
>
> --------------------8<----------------------
> REGEDIT4
>
> [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\HTMLHelp\1.x\ItssRestrictions]
> "MaxAllowedZone"=dword:00000002
>
> --------------------8<----------------------
>
> The setting above will open up for Local Machine zone, Local intranet
> zone, and Trusted sites zone, but *not* the Internet zone.
>
> More about this registry setting here:
>
> http://support.microsoft.com/kb/896358
>
> and here:
> http://support.microsoft.com/kb/896054
>
>
>
>
> --
> torgeir, Microsoft MVP Scripting and WMI, Porsgrunn Norway
> Administration scripting examples and an ONLINE version of
> the 1328 page Scripting Guide:
> http://www.microsoft.com/technet/scriptcenter/default.mspx
>