How to programatically change search provider in IE9 without user prompt?

Question

I need to force change the search provider programmatically for IE9 to K9SafeSearch. I have this working most of the way, but after the user logs in, they are shown the following prompt to confirm the change:

I cannot seem to find a way to force this confirmation so that the user does not see it. I need to deploy this to about 1000 library PCs, so I'd rather not log back into each one to confirm this. Since these PCs are locked (similar to DeepFreeze), the user would be prompted for this at each logon even if they confirmed the change - hence the need to force the confirmation.

Here are the keys I'm forcing (note that they are also pushed to HKLM):

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes]
    "DefaultScope"="{6107AD2D-B8EA-49F2-B501-464ADEEF4A85}"
    "DoNotAskAgain"=bing.com

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6107AD2D-B8EA-49F2-B501-464ADEEF4A85}]
    "DisplayName"="K9 Safe Search"
    "URL"="http://www.k9safesearch.com/search.jsp?r=o&q={searchTerms}"
    "OSDFileURL"="http://www.k9safesearch.com/providers.jsp?p=os"
    "FaviconURL"="http://www.k9safesearch.com/favicon.ico"

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\SearchScopes\{6107AD2D-B8EA-49F2-B501-464ADEEF4A85}\Non-Matches]
    "http://www.k9safesearch.com/providers.jsp?p=os"=hex:00,00,00,00,00,00,00,00

Solution 1

This can be completed by using the Internet Explorer Administration Kit. From this Technet forum post:

Update the install.ins file and run the StubPath from the IE ActiveSetup registry key for our IEAK 9 Customization. This will reset the user to our default Custom deployment. I'll change the default search provider in the the [SearchProviders] section for the specific country's desired provider and run "RunDLL32 IEDKCS32.DLLL,BrandIE4 CUSTOM" to reimport the settings.

Kinda cool this command. It updates the settings even if the user has IE open.

Solution 2

There is no way around this. This is to prevent malware from changing search pages from under to you engines that further distribute malware or would direct you to fake sites.

Comments

[kinokijuf]

-1 These security measures were put in place by Microsoft to prevent evil sysadmins and ISVs like you and Google to forcing the One True Search Engine on users.

[Ramhound]

Why don't you just UPDATE the image then deploy the image to the computers? This way the change won't be reversed on a reboot.

[Beems]

At the current point, I don't have a method to re-distribute an entire image to 1000 computers, unfortunately.

[Arjan]

@kinokijuf, why would Beems have bad intentions just because others might be evil?

[Beems]

Well, that isn't exactly what I wanted to hear, but is what I expected. Our next solution then is to make the change, then reboot, then log in, then have a custom application that opens IE, finds the option, and pushes the "Change" button. Either that or we have to log in to 1000 computers to change this.

[Beems]

I can't answer my own question yet, but here is the answer: This can be completed by using the Internet Explorer Administration Kit. See this post from TechNet here: social.technet.microsoft.com/Forums/en-US/ieitprocurrentver/‌​…

[Mostafa Hamed]

Welcome to Superuser, Please post all information relevant to your answer in your answer to avoid link rot. You can still sight the KB item as a source.