7

When adding a list of trusted sites to Internet Explorer 11 in Windows 7 Professional SP1, there is a checkbox called "Require server verification (https:) for all sites in this zone".

Is there a way to modify the system's group policy to check or uncheck this checkbox? Perhaps it is something I can find via gpedit.msc?

Thanks!

P.S. Just to make sure we are on the same page, this is the dialog I am talking about: enter image description here

2 Answers 2

4

As far as I'm aware a specific group policy option doesn't exist, which means editing the registry directly using, for example, a login script (...referenced from a group policy)

The specific key is: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags

or if you want to change the setting for specific users, then: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags

To work out what to set the Flag DWORD to we need to reference this kb article - http://support.microsoft.com/kb/182569 - which I'll paste verbatim

The Flags DWORD value determines the ability of the user to modify the security zone's properties. To determine the Flags value, add the numbers of the appropriate settings together. The following Flags values are available (decimal):

   Value    Setting
   ------------------------------------------------------------------
   1        Allow changes to custom settings
   2        Allow users to add Web sites to this zone
   4        Require verified Web sites (https protocol)
   8        Include Web sites that bypass the proxy server
   16       Include Web sites not listed in other zones
   32       Do not show security zone in Internet Properties (default
            setting for My Computer)
   64       Show the Requires Server Verification dialog box
   128      Treat Universal Naming Connections (UNCs) as intranet
            connections

Assuming that you're happy with just setting a specific permission for everyone you could set the flags key to 67 (for example), by putting the following command in a login script, which would turn on the below flags:

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" /v Flags /t REG_DWORD /d 67 /f
  • Allow changes to custom settings
  • Allow users to add Web sites to this zone
  • Show the Requires Server Verification dialog box
  • Treat Universal Naming Connections (UNCs) as intranet connections

If on the other hand you want to ONLY change the SSL check box, then you'll need to use bitwise operators on the existing value, something like this in PowerShell:

$SSLREQUIRED = 4
$key = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\'
$FlagsDWORD = (Get-ItemProperty -Path $key -Name Flags)
if($FlagsDWORD.Flags -band $SSLREQUIRED)
{
    Set-ItemProperty -Path $key -Name Flags -Value ($FlagsDWORD.Flags - $SSLREQUIRED)
}
1
  • 1
    You would need to add 128 to 67 to enable "Treat Universal Naming Connections (UNCs) as intranet connections"
    – JulioQc
    Mar 11, 2020 at 16:20
0

JuilioQc's response seems accurate based on the Microsoft documentation:

The Flags DWORD value determines the ability of the user to modify the security zone's properties. To determine the Flags value, add the numbers of the appropriate settings together. The following Flags values are available (decimal):

Value  Setting
------------------------------------------------------------------
1      Allow changes to custom settings
2      Allow users to add Web sites to this zone
4      Require verified Web sites (https protocol)
8      Include Web sites that bypass the proxy server
16     Include Web sites not listed in other zones
32     Do not show security zone in Internet Properties (default setting for My Computer)
64     Show the Requires Server Verification dialog box
128    Treat Universal Naming Connections (UNCs) as intranet connections
256    Automatically detect Intranet network

If you add settings to both the HKEY_LOCAL_MACHINE and the HKEY_CURRENT_USER subtrees, the settings are additive. If you add Web sites to both subtrees, only those Web sites in the HKEY_CURRENT_USER are visible. The Web sites in the HKEY_LOCAL_MACHINE subtree are still enforced according to their settings. However, they are not available, and you cannot modify them. This situation can be confusing because a Web site may be listed in only one security zone for each protocol.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .