Internet Explorer Setting Via Group Policy

Internet explorer settings are a combination of the local machine registry settings and the current user registry settings.  Whichever is the most restrictive is the policy that takes effect.  Changing the local machine policy on the terminal server is easy enough, however it will typically not work because the current user settings end up taking preference.

There are two ways to tackle this issue.  The first way is to:
1. Set the trusted site within the Local machine registry settings
2. Set the local machine registrry settings to be used ONLY and not the current user registry settings. This causes all users to have the same settings. (NOTE: the current users settings still show up the UI however the Local machine settings are in effect.

1. Add a new key to HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap called "Domains"  It is within this registry hive that you can manually add trusted sites that apply to the entire local machine.  In this case the terminal server.  The way this works is that you add a key for each domain that you want to trust.  For about:internet you create a new key called "internet" within Domains.  Within internet you create a REG_DWORD value named "about" and then assign it the hexadecimal value 2 (which means this site is in zone 2 (trusted)).  Another example would be  You would create a key called and then within create a REG_DWORD value named * (for all subdomains) and then assign hexadecimal 2.

You can even log in as yourself and go to HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains and you will be able to see how the ones you have added from within IE show up.  Essentially you need to recreate this in the Local Computer hive instead of your current user one.

2.  This may not be neccessary, but there is a registry setting that you can add to cause all users to use the local machine settings for IE and not their individual user settings.  (NOTE: this can be very difficult to manage becasue now you must make all IE configs within the local machine registry this is not advised unless you find it neccessary)

This is easier to paste from technet:
"If the Security Zones: Use only machine settings setting in Group Policy is enabled, or if the Security_HKLM_only DWORD value is present and has a value of 1 in the following registry subkey, only local computer settings are used and all users have the same security settings:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings
With the Security_HKLM_only policy enabled, HKLM values will be used by Internet Explorer. However, the HKCU values will still be displayed in the zone settings on the Security tab in Internet Explorer. In Internet Explorer 7, the Security tab of the Internet Options dialog box displays the following message to indicate that settings are managed by the system administrator: "

Full article:

The second way is to add these keys to the zonemap of each user that you needs current user directory.  I would reccommend trying to add on the local machine first.  Note that despite these settings these sites will not show up in the trusted sites. Only keys added in the current user hive show up in the UI.

Post a Comment

Previous Post Next Post