Internet Explorer 7 "runonce" Annoyance

Internet Explorer 7 has been out for some time now. However, computing services here on campus has just now decided to push the update out to all of our machines. We have about 45 or so machines and maybe half so far have the update. The problem is, upon first run IE7 displays the "Customization" runonce screen as opposed to the set homepage. Our users don't want to bother with this so Systems was tasked with globally removing this annoyance.

The first thing I did was track down the registry entries that were responsible for setting whether or not the runonce page would display. Turns out there are two entries that affect this:

HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Mail
"RunOnceHasShown" = 0
"RunOnceComplete" = 0

Normally, this would be an easy fix-- set both entries to DWORD value 1 and be done. However, there are 45 machines to deal with here, and they're all remote. When remotely editing the registry, HKEY_CURRENT_USER is not available so the settings can't be edited directly. Ugh- snag #1.
I dug a little deeper on the google and found that HKEY_USER can be used just as effectively provided I know the SID of the username currently logged into the machines (our machines are logged onto the domain as only one username). Ok, so how do I convert the username to the SID? Enter getsid.exe. Getsid uses the following syntax to compare the SID's of two user accounts:

getsid \\server1 account \\server2 account

The primary application here is that you would run getsid to compare the SID's of accounts on a primary and a backup DC. To reveal the SID of a single account just feed the same info in as \\server1 and \\server2. Included as part of Windows XP SP2 Support Tools, download can be found here.

Great! But I wanna make this a little more fluid since I'm going to be doing this in quantity. A little more digging yielded this batch file from a post on Windows IT Pro magazine site. It's a nifty snippet of code that, when fed the \\machinename account will store the SID in variable %sid% that can further be fed into other batch files etc. Perfect. The batch also only requires you enter the machine name/account once...even better.

So, now I've got my SID, I want to automate as best as I can the registry changes. I just threw this together. It's hard coded and ugly but it works for my purpose. I called it ie7reg.bat and the contents are as follows:

@echo off

set runonce="\HKU\%sid%\Software\Microsoft\Internet Explorer\Main" /v RunOnceComplete /t REG_DWORD /d 1 /f
set phish="\HKU\%sid%\Software\Microsoft\Internet Explorer\PhishingFilter" /v Enabled /t REG_DWORD /d 1 /f
set runshown="\HKU\%sid%\Software\Microsoft\Internet Explorer\Main" /v RunOnceHasShown /t REG_DWORD /d 1 /f

reg add %name%%runonce%
reg add %name%%phish%
reg add %name%%runshown%

The %name% variable is being supplied from a slightly modified usersid.bat so I only have to enter the machine name the one time-- when running usersid. Also notice I slipped a registry edit in there to go ahead and turn on the PhishingFilter of IE7 per our policy here.

And that's it. If all goes well the reg add command reports successful-- if not I know there's more than likely a connectivity issue with the target machine. Yay done.