Skip to main content
tims27342635
Participant
February 22, 2018
Answered

Windows 10 - Whitelist sites for use of Flash content

  • February 22, 2018
  • 1 reply
  • 4343 views

Hi!

After an inital block at the beginning of the year we are now looking to enable Flash again on Win10 (1703 and 1709)

Is there a way of whitelisting sites? We have EnterPriseModeList enabled so IE or Edge both are viable solutions.

Basically looking for "EnableIEClickToPlay" funktion for Win10

Thanks for any help!

    This topic has been closed for replies.
    Correct answer jeromiec83223024

    Your assertion is technically correct.  Our goal with the feature was to fill the void for Internet Explorer on older Windows versions.  The other browsers already had similar controls in place.  Adding our own controls would not replace or supersede the ones already in the host browser, and we weren't looking to double-prompt people or introduce redundant sets of controls.

    If you find that the administrative controls in a particular browser are inadequate for your needs, we'd recommend that you talk to the relevant browser vendor(s).

    For Edge, it looks like you either get to allow or disable Flash Player wholesale across the browser, but there's no whitelist offered.  Alternatively, you can leave Flash Player enabled, but have ClickToRun enabled with a whitelist.  It's not perfect, but it would significantly limit your exposure.  The user would have to manually allow content to play, and it's pretty unlikely that banner ads and other injected page content would get activated.

    Anyway, I found some documentation here, but they don't describe how to configure the allow list:

    Group Policy and Mobile Device Management settings for Microsoft Edge (Microsoft Edge for IT Pros) | Microsoft Docs

    I've got an email in to the Edge team to see if they can share some guidance on how to approach this.

    1 reply

    jeromiec83223024
    Inspiring
    February 26, 2018

    I'm not quite clear about what you did or what you're looking to do.


    The available configuration options for Flash Player are enumerated in the Flash Player administrator's guide:Adobe Flash Player Administration Guide for Flash Player | Adobe Developer Connection

    That said, the browsers are imposing click-to-play behavior on Flash Player (with the exception of ActiveX on Windows 7 and below, which we voluntarily added).  The configuration flag you're referencing is related to that functionality.

    For all other browsers and operating systems, you'll need to look at administrative controls for those browsers and operating systems.

    A quick Google search turns up the following:

    Group Policy and Mobile Device Management settings for Microsoft Edge (Microsoft Edge for IT Pros) | Microsoft Docs

    There's an "Allow Flash" option that looks like it would be appropriate.

    I can't find a precise set of administrative options for IE11 on Win10, but I imagine that the approach is similar, if required.


    This looks like the right neighborhood to me, but I didn't find a comprehensive list of options:Internet Explorer 11 (IE11) - Deployment Guide for IT Pros (Internet Explorer 11 for IT Pros) | Microsoft Docs

    tims27342635
    Participant
    February 28, 2018

    Hi Jeromiec83223024!

    Thanks for your reply. We would like to control (whitelist) which sites are allowed to use flash on the Win10 plattform (1709)

    If I understand correctly, current settings allow only "on or off". On would mean we hand Pandora's box over to the users, off means we shut the door completely.

    The documents you refer to is what I have read and base my question on. It appears that on Win7 and below there is a function in flash that is not available to flash on Win10 - in this case whitelisting. Is that true?

    jeromiec83223024
    jeromiec83223024Correct answer
    Inspiring
    February 28, 2018

    Your assertion is technically correct.  Our goal with the feature was to fill the void for Internet Explorer on older Windows versions.  The other browsers already had similar controls in place.  Adding our own controls would not replace or supersede the ones already in the host browser, and we weren't looking to double-prompt people or introduce redundant sets of controls.

    If you find that the administrative controls in a particular browser are inadequate for your needs, we'd recommend that you talk to the relevant browser vendor(s).

    For Edge, it looks like you either get to allow or disable Flash Player wholesale across the browser, but there's no whitelist offered.  Alternatively, you can leave Flash Player enabled, but have ClickToRun enabled with a whitelist.  It's not perfect, but it would significantly limit your exposure.  The user would have to manually allow content to play, and it's pretty unlikely that banner ads and other injected page content would get activated.

    Anyway, I found some documentation here, but they don't describe how to configure the allow list:

    Group Policy and Mobile Device Management settings for Microsoft Edge (Microsoft Edge for IT Pros) | Microsoft Docs

    I've got an email in to the Edge team to see if they can share some guidance on how to approach this.