Find out the launch points of active IE instances of windows

Question

We have an application that runs as service on windows. The service periodically checks for active Internet Explorer instances using SHDocVw.ShellWindows(). With this, we are able to capture the URL in each of the IE instances.

My Question: Is it possible to find out how the webpage in each of these IE instances were launched. For example -

• Did user type in url in IE to load the webpage?
• Did the user select the link from another IE tab to launch ?
• Did the user launch IE instance from another desktop application like outlook etc

Thank you.

Writhe

To fully spy on IE, you have to use real spy tools: en.wikipedia.org/wiki/Browser_Helper_Object . If you control the desktop, you can configure a BHO that can spy on IE (in this case, since it's in-process, and has access to IE's object model, it can do a lot of things) and report back to your service. – Mythify

Answer 1

The closest thing I could find to your specific requirement was this also check out the part 2 of the same blog where some edge cases have been discussed.

The part 1 of the blog talks about a registry key named TypedURLs (path: HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\TypedURLs) which can be found in the registry editor, the rules of updation of this key are like this:

If a link is copied and pasted from a web page to the URL address bar and the user hits enter, this will also populate the key, as this is akin to physically typing in the entire address. If an invalid address of a webpage or resource that cannot be located is entered, the key will not be populated until either the connection or the request is completed (whether it succeeded or failed). If IE’s Stop function is selected before the connection is finished or the resource is located, the key will not be populated.

It is important to note that websites visited with the browser via hyperlinks, redirects, the IE Favorites menu or the user’s home page will not populate this key. Also, when a user selects to delete their browsing history using IE’s built-in function, this key is cleared.

Hope it helps!

Privateer

Thank you for the links and your time. I read the blogs. It can partially solve the problem. But the method is not reliable as stated in part 2. – Writhe

Yes I understand that it's not that reliable and I will definitely suggest you against it if the required functionality is security oriented but if you are looking for an add on kind of functionality like Microsoft's AutoComplete (mentioned in the first part of the blog) then I believe this should do the job. – Privateer

Please note: As the key is HKEY_CURRENT_USER and we are talking about a service, by default you will read the service's user's activity which will be probably none. So you must implement reading multiple keys, each user's hive's. Also it is possible the service account will not have the access permission to those hive's, depending how the service launch was configured. – Munafo