As far as I'm aware a specific group policy option doesn't exist, which means editing the registry directly using, for example, a login script (...referenced from a group policy)
The specific key is:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags
or if you want to change the setting for specific users, then:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags
To work out what to set the Flag DWORD to we need to reference this kb article - http://support.microsoft.com/kb/182569 - which I'll paste verbatim
The Flags DWORD value determines the ability of the user to modify the security zone's properties. To determine the Flags value, add the numbers of the appropriate settings together. The following Flags values are available (decimal):
Value Setting
------------------------------------------------------------------
1 Allow changes to custom settings
2 Allow users to add Web sites to this zone
4 Require verified Web sites (https protocol)
8 Include Web sites that bypass the proxy server
16 Include Web sites not listed in other zones
32 Do not show security zone in Internet Properties (default
setting for My Computer)
64 Show the Requires Server Verification dialog box
128 Treat Universal Naming Connections (UNCs) as intranet
connections
Assuming that you're happy with just setting a specific permission for everyone you could set the flags key to 67 (for example), by putting the following command in a login script, which would turn on the below flags:
REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" /v Flags /t REG_DWORD /d 67 /f
- Allow changes to custom settings
- Allow users to add Web sites to this zone
- Show the Requires Server Verification dialog box
- Treat Universal Naming Connections (UNCs) as intranet connections
If on the other hand you want to ONLY change the SSL check box, then you'll need to use bitwise operators on the existing value, something like this in PowerShell:
$SSLREQUIRED = 4
$key = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\'
$FlagsDWORD = (Get-ItemProperty -Path $key -Name Flags)
if($FlagsDWORD.Flags -band $SSLREQUIRED)
{
Set-ItemProperty -Path $key -Name Flags -Value ($FlagsDWORD.Flags - $SSLREQUIRED)
}