Virtualized Internet Explorer 6 for Windows 7
Adoption to Windows 7 is accelerating and migrations from prior versions of Windows to Windows 7 are really starting to pick up steam. One significant impediment to migrating to Windows 7 is the lack of native support for Internet Explorer 6 (IE6) on Windows 7. Many enterprises still rely on internal “home grown” or legacy web applications that are designed to work specifically with IE6 to conduct their day-to-day business. A complete migration to Windows 7 without support for these IE6 web applications is not possible or would greatly hamper employee productivity. Fortunately, Symantec End-Point Virtualization is providing a solution based on its Symantec Workspace Virtualization technology that provides native support for IE6 on Windows 7
Why Are People Still Using IE6?
The first browser to ship as part of Windows was IE6. As the army of Windows developers began to transition native windows applications to the web the natural course was to use IE6 as the new interface to these applications. In these early days of the Internet browser many standards were being proposed with each web browser vender proffering their own approach to how the browser could become the new face for applications. Microsoft, with IE6, was no exception and prescribed its own way of building applications to its developer community. Long story short, this resulted in many of the first big wave of corporate applications to be tied tightly to the IE6 way of doing things. While the overall browser market share of IE6 usage is steadily declining, it is still only second to IE8 in overall browser market share ( see: http://www.netmarketshare.com/browser-market-share.aspx?qprid=3 ) at 17.17% overall market share in June of 2010.
The solution to moving beyond IE6 seems obvious; simply upgrade these legacy applications to work with current browsers. Unfortunately, there are challenges to this approach. The cost of re-implementing these web applications to work with current technology is prohibitive. In some cases, the original implementers of the systems that are tied to IE6 are no longer available to port the applications. The maxim of “if it ain’t broke, don’t fix it” may also come into play as some of these applications have been in use for over nine years. The cost, pain and inconvenience of porting the applications and perhaps retraining a large workforce to use a new interface don’t justify upgrading the application. The bottom line is that for all its flaws, IE6 is going to be around for several years to come.
Solutions for Supporting IE6 on Windows 7
Microsoft has recognized that many customers will still require the use of IE6 on Windows 7 and have included “Windows XP Mode” as a solution. This is a virtual operating system environment based on Microsoft's Virtual PC technology and is also a mechanism for opening Windows XP applications from within Windows 7. In short, when the use of IE6 is desired, an entire Windows XP virtual machine must be loaded into memory before IE6 can be used. The drawbacks of excessive load time, increased demands on system resources (both memory and CPU processing) and the requirement to maintain two desktop operating systems per user (Windows 7 and an instance of Windows XP running as a virtual machine) make this solution untenable for many corporate customers.
Symantec’s solution to this Windows 7 migration dilemma is to make IE6 available as a virtual application layer that runs on the Symantec Workspace Virtualization (SWV - http://www.symantec.com/business/workspace-virtualization ) technology.
The Answer to Legacy IE6 Web Application Support on Windows 7
Running IE6 as a virtual application layer on Symantec Workspace Virtualization provides the perfect solution for enterprises that wish to migrate to Windows 7 immediately. Virtual IE6 runs within a light-weight application virtualization container which allows it to run as a native application on Windows 7 with full visibility to system components and services such printing, drag and drop, and ActiveX controls as well as browser add-ons such as Adobe Reader, Adobe Flash, Java and Microsoft Media player plus many more. In additional to running as a native application it also provides the protections provided by the virtualization container in which it runs. Browser exploits such as installing unwanted software or add-ons, file system or registry corruption can all be immediately removed with the “virtual application reset” capability of SWV. All application installations, file system and registry writes are made within a read / write containment area. If something happens to a virtual application running within SWV, a simple virtual application reset can be issued which removes all operations made to this containment area and reverts the application to its original, pristine state.
Deploying Virtual IE6 within the Enterprise
Deploying Virtual IE6 to desktop systems is made easy by using Symantec Workspace Streaming (SWS - http://www.symantec.com/business/workspace-streaming ) or Symantec Client Management Suite (CMS -http://www.symantec.com/business/client-management-suite ). SWS is an excellent solution for cases where real-time, on-demand streaming of the IE6 virtual application layer to client desktop systems is desired. CMS is an industry-leading solution for providing scalable software deployment to the enterprise. The combination of SWV with these software deployment mechanisms provides all the components needed for a seamless migration to Windows 7.
How to get Started with Virtual IE6
Virtual IE6 is available immediately here on Symantec Connect.
This release of Virtual IE6 is supported on Windows 7 – 32-bit and 64-bit.
Requirements for Virtual IE6 on Windows 7 include:
1. SWV 6.1 SP1 or later available at the following link: https://www4.symantec.com/Vrt/offer?a_id=55183 (A Symantec Account is required to access this site to download SWV).
2. SWV Layer Definition Tool available at the following link: http://www.symantec.com/connect/downloads/symantec-workspace-virtualization-layer-definition-tool
Additional information on how the SWV Layer Definition Tool is used to create a virtualized layer please see the following link: http://www.symantec.com/connect/articles/virtualizing-internet-explorer-using-swv-layer-definition-tool
Summary
A significant barrier to migrating to Windows 7 is support for legacy web applications that require IE6 in order to function properly. Symantec Workspace Virtualization provides a solution to this dilemma by providing IE6 as a virtualized application layer. The virtual application layer can be deployed real-time to client desktop systems using Symantec Workspace Streaming or deployed using Symantec Client Management Suite which provides a very scalable solution for deploying virtual IE6 to thousands of client desktop systems. Virtual IE6 is available immediately here on Symantec Connect.
Comments
Great article Karl - here are some related videos
David Strom just posted a video demo here
http://webinformant.blogspot.com/2010/08/running-i...
This Brian Madden video is an Erik Hughes interview from Vision on the Layer Definition Tool
http://www.brianmadden.com/blogs/videos/archive/20...
Brad - Facebook SEV Fanpage http://bit.ly/oGCXf - http://www.symantec.com/business/software-virtuali... - Follow Endpoint Virtualization updates on Twitter, at: http://twitter.com/BradRowland
thanks man for sharing this
thanks man for sharing this great tips, I'll try that now.
Cheers,
Albert
/* Infrastructure Support Engineer */
Error 1042 when activating the layer
I have a freshly built Windows 7 VM. I am running SWV 6.1 SP4 (application build 6.2.1562).
I followed all of the instructions to create the layer. I downloaded the LDT linked in this article as well as the IE6 specific tool.
The layer was successfully created and named "Internet Explorer 6 v1.2".
I monitored the progress of the layer creation in a command window and noted the following errors:
Create layer from definition file was successful!
When I try to activate the layer, I get "An unexpected error has occured. Error code 1042".
When I try to reset the layer, I get the same thing, with error code 1059.
I also tried exporting the layer (this worked) and reimporting (this also worked) but the same error occurs when I try to activate.
I know this error references versions, and most of the posts I have found relate to either problems with 2.1, converting layers or with not having a high enough version of SWV. However, in this case, there was no conversion, I am not running the older version, and I have only used the newest SWV agent available on a clean build of Windows 7.
Any thoughts?
The current beta is targeted to a more current release of SWV, however, it will work fine with 6.1 SP4 by making the following small modification to the LDF file:
Open the LDF in an editor and scroll to the end of the file. In the <pkg-settings> area find two instances (one in settings="ro" and settings="rw") for the following line:
<MinorVersion valuetype="REG_DWORD" valuename="MinorVersion"><![CDATA[5]]></MinorVersion>
CHANGE it to:
<MinorVersion valuetype="REG_DWORD" valuename="MinorVersion"><![CDATA[3]]></MinorVersion>
(this changes the layer minor version from 5 to 3).
Delete the existing layer, recreate it by running the .bat file again. HINT to make the creation of the layer MUCH faster the second time. While in the LDF look for the following line:
<file-sources enabled="true">
CHANGE it to:
<file-sources enabled="false">
This will use the files that already exist in the "filerepo" directory for creating the virtual application layer and thus create the layer in a matter of seconds. ;)
The beta will be refreshed shortly with a version that will work with 6.1 SP4 but it simply contains the above modification.
Newer version of SWV
Hi Karl,
I will give that a try. Thank you very much for your assistance. I have a question- where can I obtain a newer version of the SWV client? As far as I could tell, I am using the latest version available for download, and the one that is referenced in the above documentation?
Thanks!
This was an oversight on my part. A preview of the next release of SWV isn't quite available yet so you have the most current (public) available version of SWV. The Beta will be refreshed soon to resolve this. For now, the fix I described above should resolve the issue. Thanks much for your feedback.
Thank you Karl
Hi Karl,
This worked like a charm.
On a different note, do you have any general advice on how I would go about adding customizations such as default homepage and favorites?
Thanks again!
Customizations such as default home page and favorites are added using the IE6 on Win7 browser. Changes will be made to the RW sublayer. If you choose to make the changes permanent (i.e. won't be erased on a reset), use SWV Admin to create a new reset point (Right-click layer, ->New Reset Point). Export the layer with the new reset point, distribute to desktop clients. That should do it!
Hi Karl, Using this method
Hi Karl,
Using this method I am able to make user-based customizations. What I would like to do is to provide a default homepage (start page) in IE for all users of a particular layer, not just the current user.
Do you have any advice on that?
Thanks!
Using the method I described,
Using the method I described, after you make the desired change, you should be able to Right-Click the layer and seleted "New Reset Point...". This will copy changes to the "USER_TEMPLATE" area thus ensuring that subsequent users of the layer get the same setting.
A better approach may be to edit the LDF used to create the layer to customize the settings.
The following article describes how to edit the original LDF to retain specific settings:
http://www.symantec.com/connect/articles/how-custo...
These settings ensure that ALL users of the layer get the settings.
Enjoy!
Karl, Worked like a charm!
Karl, Worked like a charm! I just had to check the box to move the settings to the default user location. Thanks!
Search assistant files fails on download
Karl,
http://sa.windows.com/sasearch seems to be invalid. LDF fails trying to download the searchassistant files.
is there a better link?
Disregard.. got around the http link for search assitant
HI Karl,
Disregard my previous reply.
I was able to locate and copy off all the search assistant files from my XP system (with ie6) and put then in the file repository folder.
Removed the file sources section from the ldf file (to prevent all the re-extraction and such) and it worked fine.
Testing it now.
BTW.. awesome work with all this. Kuddos.
Thanks, everyone's feedback during this beta will only make this a much better release!
Also thanks for the kudos, you can also "vote" for the article. Thumbs up or down to let us know how we are doing. :)
I'm discovering that intermittently access to this url becomes inaccessible. The next release of IE6 on Win7 will have these files removed (search from within IE6 will be removed entirely as it is not integral to the browser. If a search facility is desired there are many "Search" toolbars that can be installed to support this function (Google, Yahoo, etc).
To resolve this, you can edit the LDF and remove the following files from within the <file-destinations> tags :
<dest-file name="balloon.xsl" ...
The <file-source name="SearchAssistantFiles" ...>
<src-file name="balloon.xsl" type="file" />
...
</file-source>
Must also be removed. Save the LDF and re-run the bat file.
IMPORTANT TIP: If creating the layer second time and the filerepo already exists (i.e all required files have already been downloaded and extracted) then look for <file-sources enabled="true"> and change it to <file-sources enabled="false">. This will cause the swvldf tool to skip downloading and extracting files so the layer creation process will be much faster. For this to work ALL filerepo files required by the layer (i.e. all <dest-files>) must exist or layer creation will fail.
CPU utilization spikes
Hi,
I am running into an interesting problem.
Using the latest version of SWV (6.1 SP4) and the new IE6 Layer Tool for Windows 7 (https://www-secure.symantec.com/connect/articles/virtualized-internet-explorer-6-windows-7) I am running into high CPU usage resulting in an unusable machine. Once I deactivate the layer, the machine works fine.
I tracked the process down to a Trend filter driver. Once I remove the Trend Officescan (version 10) service, the layer works fine.
I stumbled across people referencing this problems 2 years ago, and it seems unsolved. Trend and Symantec both have information on it:
https://www-secure.symantec.com/connect/ja/forums/...
http://esupport.trendmicro.com/pages/High-CPU-usag...
https://kb.altiris.com/article.asp?article=40084&p=1
These links refer to an older version of SWV and Trend running on Vista, but I am having the same exact problems.
Installing the registry entry only sped up the machine marginally, the layer is still pretty much unusable.
I have tried this on multiple machines with the same effect.
Other layers like FireFox, work fine with no CPU increase.
Any thoughts?
Exact Same Trend/SWV Issues Here
Heya,
We are having the exact same troubles with high CPU utilization with Windows 7, SWV 6.1 SP4, and Trend 10. Our Security office believes they found a fix. http://esupport.trendmicro.com/Pages/High-CPU-usage-occurs-on-a-Windows-computer-with-Altiris-Software-Virtualization-Agent-after-installing-WFBS-or-OfficeScan.aspx
Here are the crucial pieces from the page.
2.
Open the Registry Editor (regedit.exe).
Important: Always make a backup copy of the whole registry before making any modifications. Incorrect changes to the registry can cause serious system problems.
3.
Go to HKLM\SYSTEM\CurrentControlSet\Services\TmFilter\Parameters.
4.
Add the DWORD value "DisableCtProcCheck" and set its value to "1".
5.
Restart Trend Micro Scan Engine services or reboot the system for the changes to take effect.
Systems Administrator
Rice University
Remember, "The happiness of your life, depends on the quality of your thoughts."
Thanks for posting this! I'd be interested in whether this works for others.
Hi Palvaran,
Have you installed this fix? Unfortunately, it doesn't fix the issue. Although there is a modest speed increase, the CPU is still spiking and any actions within the browser are painfully delayed compared to when Trend's service is disabled.
First wave of testing Trend/SWV Done
We contacted Trend and below is the summary of what we did to fix things. I placed the zip file in the download section and am waiting for approval at the moment.
1. Add HKLM\SYSTEM\CurrentControlSet\Services\TmFilter\Parameters" - Add a DWORD value "DisableCtProcCheck" - Set the value to 1
2. The officescan.ini (on the server) was modified to disable the Trendmicro Unauthorized Change Protection Service.
3. Remove the 4 identical .sys files in the .msi with the 4 provided in the zip file.
On a side note, is anyone adding Trend or their antivirus to the Exclude list ala packaging an app?
Systems Administrator
Rice University
Remember, "The happiness of your life, depends on the quality of your thoughts."
Hi Palvaran,
Can you elaborate on step number 3? Which MSI are you referring to, and which .sys files?
Can you provide the exact settings you changed on the server officescan.ini in step 2?
I followed the step number 1, but only saw about a 10% speed increase.
Also, can you provide the zip via email to michael.wade@fmc-na or via a URL as I am not sure if/when we will see it listed under the downloads section.
Thanks in advance!
Hey Mike
I tried to send the file, but your email address is not recognized by our system. Try clicking here and seeing if this works. I uploaded the file to our dropbox service.
https://dropbox.rice.edu/pickup.php?claimID=QR7ntwc8aRAVbUQk&claimPasscode=gAfwSuuud0L6f77k&emailAddr=fg2%40rice.edu
Systems Administrator
Rice University
Remember, "The happiness of your life, depends on the quality of your thoughts."
I have a couple of questions.
#1 These files should replace files located on the OfficeScan server, I assume? In your previous post, you mentioned an MSI. I wasn't sure what that was referring to. If it refers to the client or server, let me know.
#2 The readme file for the hotfix suggests adding a registry entry... I assume this refers to the server as well, and not the individual clients like the disableproccehck entry?
Thanks again for all your help.
Kinda
The 4 files and the registry entry all need to be performed on the clients. The server side has an INI file which gets modified, but I don't know if out security team has made that change yet.
Systems Administrator
Rice University
Remember, "The happiness of your life, depends on the quality of your thoughts."
I'd love to know if anyone else has positive experience with this hotfix.
I know a couple people have reported speed increases, the problem for me is that using the browser even after the fix is still to slow to roll out for wide adoption.
Things like Google Maps or a content-heavy page take 30-45 seconds to load, and even typing a URL comes with a 3-5 second delay, compared to when the service is stopped, it acts like it's installed natively.
Interestingly, this only happens with the IE layer. FireFox and other apps seem to run fine.
According to this link, someone said it worked for them, someone else said it didn't work, and a Symantec employee said it reduced the CPU load by about 10%, which is consistent with what I am seeing. Unfortunately, the CPU is still spiking to levels that cause the browser to stop responding.
https://www-secure.symantec.com/connect/ja/forums/svs-vista-and-trendmicro-office-scan-8
I've asked our test team to look into this.
SWV Customer Preview (x64 Support)
Anyone tryed to compile it under the new SWV Customer Preview???
I compiled it succesfully, but it just wont RUN...
Also can i import the LDF into Wise Composer to make it streamable?
Daniel Lopes de Oliveira
Endpoint Management Architect & Consultant
-----------------------------------------------
MCITP: EA
There have been multiple customer previews of SWV what is the build? (SWV Admin -> Help -> About).
You are using the IE6 for Win7 correct? Some have mistakenly tried the IE6 for WinXP which will definitely NOT work on Win7.
When you say it won't run describe specifically what happens (nothing comes up?) or is there an application crash?
The exported package (XPF or VSA) can be imported in the SWS (Symantec Workspace Streaming) and converted to a streaming package. Did you mean SWS Composer (I'm not familiar with Wise Composer)?
Hey karl,
I was editing the post as you replied me ;)
It´s running now, i made little mistake building the layer from the LDF, its working like a charm now, under Windows 7 x64 (SWV Admin v6.3.1094).
But the catch is that i can´t stream it with the new SWS, same version and build, as it wont allow packages build from SWV admin to be imported and converted to streams, like the release notes from SWS mention:
Known issues in this release
The following are unresolved issues in this release.
Issue
I´ve tried to recompile the package, rebuilding the shortcuts, also with no luck...
And i think theres no way to "build" the LDF from inside Wise Composer...
I guess i´ll try it under Version 6.1 Sp4, that´s the current "stable" release, but if you have any toughts, let me know.
P.S: Wise Composer is the "new" name for SWS Composer ;)
Regards,
Daniel Lopes de Oliveira
Endpoint Management Architect & Consultant
-----------------------------------------------
MCITP: EA
Have you tried exporting the IE6 package as a VSA (just give the file a VSA extension vs the XPF extension)? You can also cause the swvldf.exe tool to export a VSA when building the layer from the LDF. Edit the .bat file that creates the IE6 layer from the LDF. Add to the end something like: -p c:\temp\ie6.vsa
Use "Wise" Composer to import the .VSA, they try to create the streaming package.
I'm not sure this will resolve the streaming issue but it is worth a try.
No luck :(
Saved it to VSA then imported into Wise to build the stream, and it gave me the same error, i´m gonna try building the LDF into a XP machine with Version 6.1 SP4, then importing the VSA into Workspace Composer, that sould work...
Wondering if they´re gonna fix this for version 6.3.1094 :)
Daniel Lopes de Oliveira
Endpoint Management Architect & Consultant
-----------------------------------------------
MCITP: EA
They are definitely working on a fix for the 6.3 to work with streaming. 6.1 SP4 on XP should work.
Karl,
Thanks a lot for your time and effort :)
* Waiting anxiously for 64Bit streaming support ;)
Daniel Lopes de Oliveira
Endpoint Management Architect & Consultant
-----------------------------------------------
MCITP: EA
Karl,
Many thanks. I can't wait to hear back. On a whim, I installed the latest hotfix, hoping it would fix the problem. The release notes mention a CPU usage issue, but after the install I still have the same thing. If you like, I'm happy to provide my environment for feedback and further testing.
Best,
Michael
Test is looking into this now...I'll have them get with you if they require additional information about the environment.
Ah the good old days of IE 6
Ah the good old days of IE 6 :)
Thanks Karl!
"It can't rain all the time"
Different Java Plugins for different Browser
Hi
Is there a Option to force the Ie6 to use a (older) virtual Java. I tried it with a dependency but the Ie6 is using the newer non virtual Java from the Win7
Look up "running multiple
Look up "running multiple version of Java" by Jeremy here on connect, that article will explain how to do this.
If a forum post solves your problem please flag is as the solution
We fixed the problem by
We fixed the problem by excluding the c:\fslrdr folder from being scanned using Real Time Scan. Unfortunately, this seems like it might introduce an attack vector on the virtual application.
Did you try adding the AV
Did you try adding the AV scan process to SWV's program ignore list? That might solve the problem without any added risk.
If a forum post solves your problem please flag is as the solution
Hi Jordan, I have not. I can
Hi Jordan,
I have not. I can try un-doing what I did to fix it and see if that resolves the issue. I'll report back.
Hi Jordan, Adding it to the
Hi Jordan,
Adding it to the global exclusions did not work. Only by adding it to the Trend real-time scan was I able to regain performance.
not the global exclude list
not the global exclude list but the program ignore list. It's something that you have to edit via the registry. How to do this should be covered in our help file.
If a forum post solves your problem please flag is as the solution
I will test and let you know.
I will test and let you know.
Good Idea Silent. I am
Good Idea Silent. I am passing this suggestion to our security team for approval.
Systems Administrator
Rice University
Remember, "The happiness of your life, depends on the quality of your thoughts."
useful post..
useful post..
Wiseuser
Altiris Certified Professional
Well the opinions vary, for
Well the opinions vary, for example in many places IE6 is very much used, but in other places, the most used browser is Firefox, I don't know if IE6 is better with windows 7, because in the version of windows vista it is very slow.
Can we download the trial
Can we download the trial version of this ?
Hi, Is it possible for you to
Hi,
Is it possible for you to post the process you followed to virtualize IE6?
Good post btw.
Thanks.
Bibhash Nag
IE6 was not the first
IE6 was not the first browser!!!!
IE6 future
Though there are a lot of legacy apps using IE6, there's no future in the companies that are using this legacy browser. It is like to use old and rusty vacuum cleaner. If there's no way to upgrade the application that require IE6 then it is great chance for a company to replace the application itself, not only the browser.
STS: NetBackup and Storage Foundation for Windows
If this post was helpful please vote +1
If this post was useless or just for points please vote -1
IE Tester
I use an application called IETester to test websites on older versions of IE. It's probably more light weight than the solution given here, but I don't think that it supports all of the plugins, so it might not be an option for every user.
AddToIt
File Upload Dialog Box
Karl,
We have a web app that has a file upload button. However when using the virtualized IE6 on Windows 7, the file upload dialog box does not appear when the user clicks the browse button. Is there some setting that needs to be changed?
Thanks,
Art Rathke
I need to know more about the
I need to know more about the web app. Is it java, ASP, PHP? does it open a custom child window or a windows forums box?
If a forum post solves your problem please flag is as the solution
Same with Outlook Web access
We have the same issue with Outlook Web access. If we click on the Browse button, the Choose File dialog box does not show up. Anyone experiencing this?
Anyone else having issues
Anyone else having issues with Activex controls causing the browser to crash?
What ActivateX applications
What ActivateX applications are you having issues with?
If a forum post solves your problem please flag is as the solution
Internet Explorer 8 v 9?
Has anyone tried the suggested theme of mixed browser versions with IE 8 & IE 9? We are having to support IE 9, but having it on the support staff computers breaks their access to the Symantec Management Platform. I'd like to try this out for our technical staff.
Any suggestions?
Not yet already Jesse but if
Not yet already Jesse but if it is good I'll try it. Can you give me the details or information regarding this? I know it can help us a lot in our workplace.
We don't yet support IE9
We don't yet support IE9 virtualized or in the base with other virtualized versions of IE.
If a forum post solves your problem please flag is as the solution
nice article
nice article
Thanks,
CableGuy
Do not forget to mark a SOLUTION
IE7?
What about IE7 for Windows 7? We like a lot of other customers have IE7 on our Windows XP systems and would rather not move backward and use IE6 if possible when we migrate to Windows 7. Unfortunately the legacy apps require either IE6 or IE7 and we would prefer to use the newer one if possible.
And what about GPO's behavior?
And what about GPO's behavior?
Hello,
We've noticed strange behaviors about GPO when we tried to virtualize IE6 in a Windows 7 environment.
The fact is that we used GPO to configure IE paraméters for IE6 (virtualized) & IE8 (in the base) (one for each).
So when GPO are applied we noticed for exemple that some parameters are not apply for IE6 wereas we uses the same parmeters for our XP machines with IE6 not virtualize..
Did someone have ever seen the same ou a similar behavior?
Regards,
Worked like a charm. thanks
Worked like a charm.
thanks karl.
Thank You
Great article thanks for the information. I will definitely be rolling this out at work once I manage to get through my 'to do' list.
Would you like to reply?
Login or Register to post your comment.