5. The Windows Operating System

• Turn off the Welcome screen and tips
  (%windir%\welcome.exe)
  
  per-user .REG file setting: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Tips]
"Show"=dword:00000000
  
  per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoWelcomeScreen"=dword:00000001
  
  per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoWelcomeScreen"=dword:00000001

System Properties -> Hardware -> Device Manager

• disable USB error detection (only if motherboard has VIA Apollo chipset, for fixing problems with it) (on both host controllers)
  Settings -> Control Panel -> System -> Hardware -> Device Manager -> Universal Serial Bus Controllers -> VIA Universal Host Controller -> Advanced -> Disable USB error detection
  
  per-machine .REG file setting:[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Usb]
"ErrorCheckingEnabled"=dword:00000000

• enable UDMA66 data transfer on all ATA drives (i.e. hard disk, CD, DVD) (increases performance, by default Windows 2000 is set to UDMA33):
  
  per-machine .REG file setting:[HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Class\{4D36E96A- E325-11CE-BFC1-08002BE10318}\0000]
"EnableUDMA66"=dword:00000001
  BEWARE: whether or not this works depends on a number of issues, it is not enabled by default in Windows 2000 for good reason: this is for Intel chipsets; your system has to support it; specialised device drivers may need to be installed; and getting any of this wrong could result in system failure and data loss

System Properties -> Advanced -> Performance Options

(these are per-machine settings)

• only if you are able, move Windows' virtual memory to a second hard disk drive (if ATA, then also on a second controller). Consider how often the second disk drive is being accessed by programs, as this will affect the performance of the virtual memory.
  
  Virtual memory -> Change ->

  • choose the SWAP partition

  • set the size as per Windows' advice (1.5 times total physical RAM)

  • set the original partition Windows was using to 0
    
    per-machine .REG file setting, for an example paging file of 'C:\pagefile.sys 382 382': [HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager\Memory Management]
"PagingFiles"=hex(7):43,00,3a,00,5c,00,70,00,61,00,67,00,65,00,66,00,69,00,6c,\
00,65,00,2e,00,73,00,79,00,73,00,20,00,33,00,38,00,32,00,20,00,33,00,38,00,\
32,00,00,00,00,00

System Properties -> Advanced -> Startup and Recovery

(these are per-machine settings)

• System Startup
  (these are covered by our BOOT.INI)

  • Start -> Settings -> Control Panel -> System -> Startup and Recovery -> System startup -> Default operating system -> choose which option you want to be the default that Windows uses
    
    BOOT.INI setting: the first option in the list is the default

  • Start -> Settings -> Control Panel -> System -> Startup and Recovery -> System startup -> [] Display a list of operating systems for [0] seconds
    
    BOOT.INI setting: timeout=0

• System Failure

  • [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\CrashControl]
SendAlert / CrashDumpEnabled / AutoReboot / DumpFile / Ovewrwrite / KernelDumpOnly

Sounds and Multimedia

(these are per-user settings)

• Sounds

• turn off sound scheme
  the operating system making sounds in various situations consumes resources and is annoying
  Control Panel -> Sounds and Multimedia -> Sounds -> Scheme -> No Sounds
  
  ? [HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\.Default]
? [HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\...]
? [HKEY_CURRENT_USER\AppEvents\Schemes\Apps...]
? ".Current"=""

• Audio

• Sound Playback

• make sure the most appropriate device is selected

• Advanced -> Speakers -> configure as per the particular system

• Advanced -> Performance -> Hardware acceleration -> ?

• Advanced -> Performance -> Sample rate conversion quality -> ?

• Sound Recording

• make sure the most appropriate device is selected

• Advanced -> Performance -> Hardware acceleration -> ?

• Advanced -> Performance -> Sample rate conversion quality -> ?

• MIDI Music Playback

• make sure the most appropriate device is selected

• (presumably these are per-user settings)

• Hardware

• presumably there are device families that can be removed if they're not required (using Properties -> Remove):

  • ?

  • ?

  • ?

Networking

• Install only those networking components, clients and services you need, remove those you do not. you'll need a networking adaptor installed before you're able to add these (either a network card physically fitted and recognised in Network Configuration, or the 'dial-up adaptor', usually associated with modems but is actually a catch-all phrase for a few networking techniques, so can be added regardless of whether you have a modem or not)
  For example, for Internet access you need only the 'TCP/IP' protocol; if you want access to files/printers on other computers, made available using Windows Shares, you'll need the 'TCP/IP' or 'NetBEUI' protocol, and the 'Client for Microsoft Networks' client; and the 'File and printer sharing for Microsoft networks' service if you additionally want to share your files/printers with others. A default Windows installation will install excess protocols such as VPN and IPX/SPX which should usually be removed.
  If connecting to the Internet, be careful not to enable 'NetBIOS over TCP/IP' (there are good instructions at http://grc.com/su-bondage.htm) (basically, bind 'Client for Microsoft Networks' and 'File and printer sharing for Microsoft networks' to the un-routable NetBEUI instead of the routable TCP/IP)
  Tune such settings in these places:

  • for a local area network connection with a network card:
    (these are per-machine settings)

    • TCP/IP

      • IP address
        for private TCP/IP based networks, if you have control of the IP addressing range, use the 10.0.0.x range (its an easier number sequence than 192.168.x.x to remember). If you use DHCP then you don't need to set this.
        
        per-machine .REG file setting: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}]
"IPAddress"=hex(2):????????????
        As this setting depends on a variation in the name on different machines it is difficult to pre-configure so we advise you for now to set it by hand, or configure a DHCP server to supply the details and pre-configure the registry to use that instead. If you use DHCP then set it to 0.0.0.0

      • subnet mask
        Respective to your particular networking environment. If your IP address is 10.0.0.x then it will be 255.255.255.0. If you use DHCP then you don't need to set this.
        
        per-machine .REG file setting: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}]
"SubnetMask"=hex(2):????????????
        As this setting depends on a variation in the name on different machines it is difficult to pre-configure so we advise you for now to set it by hand, or configure a DHCP server to supply the details and pre-configure the registry to use that instead. If you use DHCP then set it to 0.0.0.0

      • default gateway
        If you use DHCP then you don't need to set this.
        
        per-machine .REG file setting: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}]
"DefaultGateway"=hex(2):????????????
        As this setting depends on a variation in the name on different machines it is difficult to pre-configure so we advise you for now to set it by hand, or configure a DHCP server to supply the details and pre-configure the registry to use that instead.

      • DHCP?
        It may be that you use DHCP on your network and thus don't need to set these settings for you as they'll be set automatically from the DHCP server by choosing 'Obtain an IP address automatically'. If you connect directly to an xDSL router then you will probably use DHCP.
        
        If you install Windows 2000 with a network adaptor already installed, it gives you the option of setting up the network, where you can choose typical or custom settings, and the custom settings use DHCP, which would make it a quick way of selecting this - it may be that dialog can be invoked by hand
        
        per-machine .REG file setting: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx}]
"Enable DHCP"=Dword:1
        As this setting depends on a variation in the name on different machines it is difficult to pre-configure so we advise you for now to set it by hand.

      • DNS
        If you use DHCP then you don't need to set this.
        
        per-machine .REG file setting: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"NameServer"=hex(2):????????????

      • Hostname
        
        per-machine .REG file setting: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"Hostname"=hex(2):????????????

      • NetBIOS over TCP/IP
        Disable 'NetBIOS over TCP/IP' when using NetBEUI / client for Microsoft Networks / File and Printer sharing
        beware, if you're sharing files on a Samba server, rather than a Windows server or workstation, then it requires 'NetBIOS over TCP/IP'
        Start -> Settings -> Network and Dial-up Connections -> Local Area Connection (or whatever name you have given it) -> Properties -> Internet Protocol (TCP/IP) -> Properties -> Advanced -> WINS -> Disable NetBIOS over TCP/IP
        
        per-machine .REG file setting: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBt\Parameters...?]
"various..."=?

    • Windows workgroup or domain name

    • NetBEUI

      • ?

    • show an icon in the taskbar when connected to the LAN - for more advanced users this may be useful to have on
      if the connection is broken you will see a visual indication, which can be useful. A drawback to this is the icon is the same as for Dial-Up networking and this confuses some people.
      Settings -> Network and Dial-up Connections -> Local Area Connection (or whatever name you have given it) -> Properties -> Show icon in taskbar when connected
      
      per-machine .REG file setting: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{GUID of Adapter}\Connection]
"ShowIcon"=dword:00000001
      As this setting depends on a variation in the name on different machines it is difficult to pre-configure so we advise you for now to set it by hand

    • rename the 'Local Area Connection' menu item to describe your actual network
      Settings -> Network and Dial-up Connections -> Local Area Connection -> Rename -> enter the name of your network
      
      per-machine .REG file setting: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{GUID of Adapter}\Connection]
"Name"="?"
      As this setting depends on a variation in the name on different machines it is difficult to pre-configure so we advise you for now to set it by hand

  • for a dial-up connection using Windows' dial-up software (RAS):

    • Start -> Settings -> Network and Dial-Up Connections -> right-click on the desired connection -> Properties -> Server Type -> set the properties for each connection here (this menu sequence probably differs between versions of Windows)

      • set the analog telephone line protocol for between your computer and the ISP (probably PPP)

      • As above, enable only the networking protocols you need (probably only TCP/IP) (this also speeds up the time to connect)

        • TCP/IP

          • Obtain an IP address automatically

          • Obtain DNS server address automatically

      • ...
      • ...
      • ...

    • Control Panel -> Network -> Dial-Up Adaptor -> Properties -> Bindings -> check only that which you need (see above)

  • for broadband Internet connections in general (ethernet, cable, DSL, etcetera):

    (need to checkout http://www.speedguide.net/Cable_modems/cable_reg_win2k.shtml)

    • improve performance by setting TCP to attempt to discover MTU automatically over the path to a remote host. otherwise MTU defaults to 576, which reduces overall performance over high-speed connections.
      
      per-machine .REG file setting: [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters]
"EnablePMTUDiscovery"=dword:1

Network Card (hardware)

(these are per-machine settings)

• configure for maximum throughout:
  Control Panel -> Network -> pick the adapter -> Properties -> Advanced ->
  (these options may or may not exist for you, depending on the particular card)

  • Connection Type

  • Link Speed & Duplex - 'Auto Detect' - the best means of configuring Full Duplex mode if it is available on a 10/100 twisted pair network card (this should be Windows' default setting anyway)

  • Speed

  • Transmit Threshold - ?

  • Burst Length - ?

• ? Control Panel -> Network -> pick the adapter -> Properties -> Driver Type

Modem (hardware)

(these are per-machine settings)

• once you've configured Dial-up Networking for a particular connection, create a shorcut to it on the Windows desktop:
  in Dial-up Networking, right-click on the appropriate connection and choose 'create shortcut'
  (atleast in Windows 98, if you were to drag it to the desktop it wouldn't create a shortcut but instead an INI file containing all settings relating to this connection, which wouldn't be as elegant)

• for a multi-user environment, you can configure dial-up accounts as Administrator that will be available for all users (leave the password blank and set it as each user otherwise it won't be carried over properly; if you need to turn off the 'display username and password...' option so that it connects automatically, leave it off, login as the user and set the password, log back in as Administrator and turn it on) or you can add dial-up connections for each user seperately

• set the port speed to the maximum:
  Dial-up Networking -> ? -> ?maximum connection speed? -> 115,200baud
  or is it in Control Panel -> Modems...?

• Change the MTU and RWIN settings: http://www.annoyances.org/exec/show/article04-006 and see to-do list at the bottom of this document (also here)

• enable logging of information of how this Internet connection is used:
  Dial-up Networking -> Server Types -> Advanced options -> Record a log for this connection
  

• enable logging of information about the use of the modem device:
  Control Panel -> Network -> Dial-up adaptor -> Properties -> Advanced -> Record a log file: yes
  
  Control Panel -> modems -> pick the modem -> Properties -> Connection -> Advanced -> Append to log
  the log file is %WINDIR%\modem-name.log

Taskbar & Start Menu

• Start -> Settings -> Taskbar & Start Menu...
  (presumably these are per-user settings)

  • If the monitor isn't large, reduce the size of 'Start menu' icons, as usually this menu is too large
    Start -> Settings -> Taskbar & Start Menu...-> Show small icons in Start menu - enabled
    
    ? per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\SmallIcons]
? (doesn't seem to be this but some people say it is) "SmallIcons"="yes"

  • disable the clock from showing in the System Tray
    unless you need it, it consumes resources
    General -> Show clock - off

  • General -> Use Personalized Menus - off
    with this on, recently used items are moved to the top of the menu and the rest hidden from view
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"IntelliMenus"="No"
    ? per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"IntelliMenus"="No"

  • Advanced -> Display Administrative Tools [on Start Menu - Programs - off
    you may not want this if multiple people are using the computer with other than an administrative role
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"StartMenuAdminTools"="Yes"
    ? per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"StartMenuAdminTools"="Yes"

  • Advanced -> Display Logoff - on
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"StartMenuLogoff"=dword:00000001
    ? per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"StartMenuLogoff"=dword:00000001

  • Expand Control Panel - on
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"CascadeControlPanel"="Yes" (this works but visually the setting in Start -> Settings -> Taskbar & Start Menu... still claims to be off)
    ? per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"CascadeControlPanel"="Yes"

  • Advanced -> Expand My Documents - on
    
    per-user: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"CascadeMyDocuments"="Yes" (this works but visually the setting in Start -> Settings -> Taskbar & Start Menu... still claims to be off)
    ? per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"CascadeMyDocuments"="Yes"

  • Expand Network and Dial-Up Connections - on
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"CascadeNetworkConnections"="Yes" (this works but visually the setting in Start -> Settings -> Taskbar & Start Menu... still claims to be off)
    ? per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"CascadeNetworkConnections"="Yes"

  • Expand Printers - on
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"CascadePrinters"="Yes" (this works but visually the setting in Start -> Settings -> Taskbar & Start Menu... still claims to be off)
    ? per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"CascadePrinters"="Yes"

  • Advanced -> Scroll the Programs Menu - off
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"StartMenuScrollPrograms"="No"
    ? per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced]
"StartMenuScrollPrograms"="No"

Internet Explorer

(presumably these are per-user settings)

These are Internet Explorer (IE) settings (integrated with the operating system from Windows 95c onwards, unless you use 98Lite so as to not install it in the first place). as IE is installed by default and is an integral part of Windows these changes are worth making in case anyone or anything chooses to use IE or its components). We recommend you lock down Internet Explorer as tight as you can and use something like Netscape (or another Gecko-based browser such as Mozilla or K-Meleon) instead. Or, if you do really need to use IE, loosen off those insecure parts of it that you need in browsing and for only those security zones which are apply. It is not advised using IE on the open Internet because of its many security vulnerabilities.

it's probably worth running IERadicator (unless Windows was initially installed Windows using 98Lite) to remove a greater proportion of Internet Explorer (but I haven't used it in a while and need to check what it does and doesn't remove)

'control panel -> Internet Options' or 'Internet Explorer -> Tools -> Options' or right click on Internet Explorer desktop icon and choose Properties

Options for various versions of IE (applicable product version number(s) are in square brackets afterward...
(Win2k comes with IE5.0, WinXP comes with IE6.0)

• General

• Home page -> Use Blank
  
  per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Start Page"="about:blank"

• temporary internet files -> settings -> temporary internet files folder -> move folder to TEMP partition (if running a system with multiple partitions) [5.5,6.0] (E:\%username%\ie\Temporary Internet Files - if you set it this way it'll choose 'Temporary Internet Files' automatically and create the directory; if you set it directly in the registry it won't; so we've set our registry setting to use the cumbersome 'Temporary Internet Files' for consistency)
  
  per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders]
"Cache"=hex(2):45,00,3a,00,5c,00,25,00,55,00,53,00,45,00,52,00,4e,00,41,00,4d,\
00,45,00,25,00,5c,00,69,00,65,00,5c,00,54,00,65,00,6d,00,70,00,6f,00,72,00,\
61,00,72,00,79,00,20,00,49,00,6e,00,74,00,65,00,72,00,6e,00,65,00,74,00,20,\
00,46,00,69,00,6c,00,65,00,73,00,00,00

• Programs

• internet explorer should check to see whether it is the default browser - off
  
  per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Check_Associations"="no"
? pre-configure .REG file setting: [HKEY_USERS\.DEFAULT\Software\Microsoft\Internet Explorer\Main]

• Internet programs...

• Security

'High' will turn off all of the features (see Appendix) apart from these, all of which we recommend you disable (if a 'Custom Level' has already been chosen you will have to restore the button for choosing 'High' by choosing 'Default Level...')

• 'Script ActiveX controls marked safe for scripting' (defaults to 'Enable')

• 'Font download' (defaults to Prompt)

• 'Java permissions' (defaults to 'High safety') [5.5]

• Internet - set the security level to 'High'
  
  per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
  per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3]
  See the Appendix for the list of values to set in these keys.

• Local intranet - the higher you set this the more obstructive Windows is to your moving around and running files. we're currently trying this at a 'Medium-low' security level
  
  per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
  per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1]
  See the Appendix for the list of values to set in these keys.

• Trusted sites - set the security level to 'High'
  
  per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
  per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
  See the Appendix for the list of values to set in these keys.

• Restricted sites - set the security level to 'High'
  
  per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
  per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4]
  See the Appendix for the list of values to set in these keys.

• Content -> Personal information -> AutoComplete -> Use AutoComplete for

  • 'Web addresses' - on (this also applies to Start Menu -> Run commands, where its handy enough to warrant turning this on, unless you're being very security conscious. related to IE's 'Use inline AutoComplete')
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete]
"AutoSuggest"="yes"

  • 'User names and passwords on forms' - off
    (Prevent IE saving personal information (such as visited URIs) in the registry)
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"FormSuggest Passwords"="no"
    
    ? per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"FormSuggest Passwords"="no"

• Privacy -> Privacy Preferences (5.5,6.0)

• Advanced

(if these have been changed, you can restore them to their default by clicking 'Restore Defaults' then follow the directions below)

• Browsing

  • Automatically check for Internet Explorer Updates - off [5.0,5.5,6.0]
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"NoUpdateCheck"=dword:00000001

  • Enable Install On Demand - off [5.0,5.5,6.0]
    Prevents Internet Explorer from automatically installing components; itherwise it would download a component when users browse a web site that wants it. If you disable this policy or do not configure it, users will be prompted to download and install a component when visiting a web site that uses that component."
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"NoJITSetup"=dword:00000001

  • Enable page hit counting - off [5.0]
    
    per-user .REG file setting: [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Webcheck]
"NoChannelLogging"=dword:00000001

  • Enable page transitions - off [5.5,6.0]
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Page_Transitions"=dword:00000000

  • Notify when downloads complete - off
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"NotifyDownloadComplete"="no"
    
    ? per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"NotifyDownloadComplete"="no"

  • Show Internet Explorer on the desktop - off (don't encourage its use) [5.0,5.5,6.0]
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoInternetIcon"=dword:00000001 (this turns off the setting but leaves the icon on the desktop)/
    per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer]
"NoInternetIcon"=dword:00000001

  • Use inline AutoComplete [for Web addresses] - off (this also applies to Start Menu -> Run commands, where its useful to have previously used commands automatically suggested but not to have the suggested command on the line you're typing) [5.0,5.5]
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\AutoComplete]
"Append Completion"="no"

  • use smooth scrolling - off [5.0,5.5] (makes the page scroll in annoying jumps)
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"SmoothScroll"=dword:00000000

• Multimedia

  • Always show Internet Explorer Radio bar - off [5.0,5.5]
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\MediaPlayer\Radio\Settings]
"AlwaysShowRadio"="no"

  • Play animations - off (do not animate animated GIFs)
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Play_Animations"="no"
    
    ? per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Play_Animations"="no"

  • Show image download placeholders - on [5.0,5.5]
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"Show image placeholders"=dword:00000001
    
    ? per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"Show image placeholders"=dword:00000001

• Java (Sun)
  If you've installed and set Sun's Java to be the default for Internet Explorer then it will have a setting here
  Use Javax vx.x.x for "<"applet">" (requires restart)

• Java VM

  • Java console enabled - on (displays Java messages in View -> Java Console) [4.?,5.0,5.5,6.0]
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Java VM]
"EnableJavaConsole"=hex:01,00,00,00

  • Java Logging enabled - on [4.?,5.0,5.5,6.0]
    (logs to %WINDIR%\JAVA\JAVALOG.TXT)
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Java VM]
"EnableLogging"=hex:01,00,00,00

  • JIT compiler for virtual machine enabled - off [5.0,5.5,6.0]
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Java VM]
"EnableJIT"=hex:00,00,00,00

• Search from the Address bar
  When searching: Just display the results in the main window [5.0,5.5]
  
  per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main]
"AutoSearch"=dword:00000001
  
  per-machine .REG file setting: [HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Main]
"AutoSearch"=dword:00000001
  
  related registry setting for configuring: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\AdvancedOptions\SEARCHING\AUTOSEARCH\JUST_DISPLAY]

• Security

  • Check for server certificate revocation - on [5.0,5.5,6.0]
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

  • Do not save encrypted pages to disk - on [5.0,5.5,6.0]
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"DisableCachingOfSSLPages"=dword:00000001

  • Enable Profile Assistant - off [5.0,5.5]
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Security\P3Global]
    "Enabled"=dword:00000000

  • Use Fortezza - off [5.0,5.5,6.0]
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"Fortezza"=dword:00000000

  • Warn about invalid site certificates - on [5.0,5.5,6.0]
    in 5.5SP2 this is on by default
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"WarnonBadCertRecving"=dword:00000001

  • Warn if changing between secure and not secure mode - on [5.0,5.5,6.0]
    in 5.5SP2 this is on by default
    
    per-user .REG file setting:[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"WarnonZoneCrossing"=dword:00000001

  • Warn if forms submittal is being redirected [5.0,5.5,6.0]
    in 5.5SP2 this is on by default
    
    per-user .REG file setting: [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]
"WarnOnPostRedirect"=dword:00000001