A system administrator observes that multiple domain-joined workstations consistently open an unwanted advertisement page whenever Microsoft Edge is launched. The administrator confirms that DNS queries using `nslookup` resolve accurately to internal servers, and manual inspection confirms the local `hosts` file contains no rogue IP mappings. Additionally, resetting browser user settings and clearing local cache only resolves the issue temporarily, as the unwanted URL re-populates as the startup page upon system reboot. Which of the following actions should the administrator take NEXT to permanently eliminate the redirection?
- Inspect and delete unauthorized Registry keys under the Group Policy policy hives, then audit Active Directory GPOs for malicious modifications.Answer
- BClear the browser cache, cookies, and site data, then uninstall all active browser extensions and plugins.
- CReconfigure the local host-based firewall to block inbound TCP port 80 and 443 traffic originating from the redirection server IP address.
- DLaunch Credential Manager in Control Panel and clear all cached web credentials associated with the unwanted domain.
Answer
Inspect and delete unauthorized Registry keys under the Group Policy policy hives, then audit Active Directory GPOs for malicious modifications.
Removing unauthorized Group Policy registry keys and auditing Active Directory GPOs targets the root cause of persistent browser redirects. When browser settings continuously revert back to an unauthorized URL after every reboot despite manual resets, an active Group Policy Object (GPO) or malicious policy registry key (under HKLM/HKCU Policy hives) is enforcing the setting upon system startup.
Step-by-Step Solution
Key Concept
Group Policy Registry Enforced Browser Hijacking Remediation