Question

Difficulty: Very hardWeb Browser Security and Pop-Up/Redirect Troubleshooting

A system administrator observes that multiple domain-joined workstations consistently open an unwanted advertisement page whenever Microsoft Edge is launched. The administrator confirms that DNS queries using `nslookup` resolve accurately to internal servers, and manual inspection confirms the local `hosts` file contains no rogue IP mappings. Additionally, resetting browser user settings and clearing local cache only resolves the issue temporarily, as the unwanted URL re-populates as the startup page upon system reboot. Which of the following actions should the administrator take NEXT to permanently eliminate the redirection?

  1. Inspect and delete unauthorized Registry keys under the Group Policy policy hives, then audit Active Directory GPOs for malicious modifications.Answer
  2. B
    Clear the browser cache, cookies, and site data, then uninstall all active browser extensions and plugins.
  3. C
    Reconfigure the local host-based firewall to block inbound TCP port 80 and 443 traffic originating from the redirection server IP address.
  4. D
    Launch Credential Manager in Control Panel and clear all cached web credentials associated with the unwanted domain.

Answer

Inspect and delete unauthorized Registry keys under the Group Policy policy hives, then audit Active Directory GPOs for malicious modifications.
Removing unauthorized Group Policy registry keys and auditing Active Directory GPOs targets the root cause of persistent browser redirects. When browser settings continuously revert back to an unauthorized URL after every reboot despite manual resets, an active Group Policy Object (GPO) or malicious policy registry key (under HKLM/HKCU Policy hives) is enforcing the setting upon system startup.

Step-by-Step Solution

1
Analyze the persistent symptom after standard remediation steps failed.
Standard browser resets and clearing local profile data failed to persist across reboots, indicating an external policy mechanism is reapplying the settings.
When local browser configurations revert after a system reboot, central management tools like Windows Group Policy or malicious registry policies are enforcing the settings.
2
Rule out network-level and local host file redirects.
DNS resolution via `nslookup` is verified correct and the `hosts` file contains no malicious entries.
Verifying DNS and hosts files narrows the root cause specifically to browser configuration management rather than name resolution tampering.
3
Locate and remediate enforced policy entries in the Windows Registry and Active Directory GPOs.
Removing forced policy registry keys under `HKLM\SOFTWARE\Policies\Microsoft\Edge` or `HKCU\SOFTWARE\Policies\Microsoft\Edge` and fixing the domain GPO prevents automatic re-application of the home page setting.
Policies applied via GPO write to protected registry paths that override user-configured browser preferences during startup and system boot.

Key Concept

Group Policy Registry Enforced Browser Hijacking Remediation
Rate this question