Windows 8.1 Update always sets Bing as Search Provider (IEAK doesn´t tell it to)

Question

Hello,
I´m building a Windows 8.1 (with Update 1)-Image for my Company and want to customize IE11. Everything works fine, beside two things:
1. In my IEAK-Package I add Google as search provider and set it to default. The IE-branding-package is applied during the building of the image. But when I log in the first time, IE comes up with Bing as default and Google as additional search provider.
First I thought this has anything to do with SCCM installing the branding pack as LocalSystem during the task sequence, but with some testing, I found out, that Win 8.1 Update 1 (KB2919355) was my Problem! If I install my branding package to Windows 8.1 (without
Update 1), Google is set as default search provider for accounts that already exist and for new accounts. When Update 1 is applied and my Branding pack runs after that, Google is set as default search provider for existing accounts only, but not for new accounts,
they get Bing! It doesn´t matter if I do that as LocalSystem within a task sequence or as local admin, with Update 1 - Bing, without - Google! I also tried to set the HKCU\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope-value in the "Default
User" and imported the {xxxx...xxxxx}-Search Provider-Value for Google, but this seems to be overwritten by some first logon command. Is there any Win 8.1 or IEAK-Hotfix to correct this behaviour?
2. This one is AFAIK in every IEAK since IE8, but it´s annoying anyway: you select that no MS Defaults should be added, and that only items created by the Administrator should be deleted, in the "Browsing Options" of IEAK but (in
the case of IE11) this one "Bing"-favorite resides there and says "Hello!" to every new user.
Problem 1 is the bigger one, but I´m glad about every kind of help and every answer!
Kind Regards, Chris

Answer 1

So it did.  The settings are being customized by "ie4uinit.exe -UserConfig" during Active Setup for each new user.  I could not find where it was picking up its orders, otherwise I would have edited the ieuinit.inf or registry or xml
file rather than attempt to undo the damage using the below method.  Documentation on ie4uinit.exe was nonexistent or hidden, and I didn't have the patience to keep filtering and trawling through 7000 reg entries to find the source of the problem.
As a test, disabling / renaming / removing the "stubpath" fixed the problem, but also vanished the Metro IE icon.  I didn't pursue this further to see if this was a simple fix, choosing instead to make things a little more complicated:
During the deployment task sequence, I create another registry key under "Installed Components" in Active Setup.  I don't know if there's a way to control the order of execution, but I think I got lucky enough that my stuff executes after
the other commands per user.
Task script (during deployment):
REM Prep for active setup to undo 8.1 Update 1 Bing evilness
MD c:\temp\bingremove
XCOPY hklm_scope.reg c:\temp\bingremove
XCOPY hkcu_scope_current.reg c:\temp\bingremove
XCOPY RedoSearchScopes.cmd c:\temp\bingremove
REG.EXE import RedoSearchScopes.reg
RedoSearchScopes.reg
Windows Registry Editor Version 5.00
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\RedoSearchScopes]
@="Redo IE Search"
"IsInstalled"=dword:00000001
"ComponentID"="REDOBING"
"StubPath"="C:\\temp\\bingremove\\RedoSearchScopes.cmd"
RedoSearchScopes.cmd
REM Clear & Add search links
REG.EXE delete "HKCU\Software\Microsoft\Internet Explorer\SearchScopes" /f
REG.EXE delete "HKLM\Software\Microsoft\Internet Explorer\SearchScopes" /f
REG.EXE import c:\temp\bingremove\hklm_scope.reg
REG.EXE import c:\temp\bingremove\hkcu_scope_current.reg
del /f /q %USERPROFILE%\Favorites\Bing.url
del /f /q %USERPROFILE%\..\Default\Favorites\Bing.url
hklm_scope and hkcu_scope_current are exports of searchscopes that I'm reasonably happy with.  Except after
KB2988414, my users are prompted to approve my change away from the default of Bing, only once.  So MS wins again, unless I go uninstall that update and block it - except it was part of a cumulative rollup!
Anyway, I don't even care that much about which search engine goes, but search suggestions were ON by default, which is a big nono when dealing with sensitive work.  Search suggestions mean that all text in a browser address bar is logged and stored
by the search company.
A creative workaround I hadn't thought of was to keep the Bing GUID and change all the values underneath to your search engine of choice:
http://www.laurierhodes.info/?q=node/81
I was considering this, but it still feels a bit hacky, and I'm sure it would only be a matter of time before something breaks it.
Oh, well.  Not the ideal solution, and I resent beyond words the inability to set something from an administrator's task and then have the OS second-guess me and undo my changes via an update meant to give more control to users who could not care less
about these "enable" or "approve" prompts.
Thanks for the tip, R.A.