Sign up ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I would like to set the IE security zone to Medium-high for all new users on a server.

This is a standalone machine and ultimately I'll need to script it. I don't mind making a registry change or updating the local security policy.

I've had some success updating HKCU

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel

but that only applies to the current user. I see that it's possible to set IE to only use HKLM for all users, but I would rather not change that. I want to allow it to continue to use HKCU.

Where is the default key that is used when creating a new user? Or, can I use Local Security Policy, something like: Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\something?

share|improve this question

2 Answers 2

up vote 0 down vote accepted

The key you're after should be:

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel

This won't apply anything to existing users, but should be copied to new local users when a profile is created.

share|improve this answer
That seems like it should work. I tried that previously too. It doesn't seem to work for me and I just retried a few times. There isn't a key already at that path so I created a new key with just CurrentLevel, but it didn't take. I then exported my existing key, changed the patch and imported the whole key, but that didn't work either. I test by creating a new user and check checking the HKCU to see if the key is different then the original default. – Scott Forsyth - MVP Jan 16 '10 at 14:22
Interesting. On my Windows 7 machine there was a key right down to that path, even though I haven't done any customising. Hope you have some better luck! – Mark Henderson Jan 16 '10 at 20:50

In order to change default behaviour for new accounts, you need to edit the Default User profile. However, this is not


As this is the hive for the Local System user account, despite its confusing name. (MSDN Reference)

To edit the Default User Profile, you need to change the NTUSER.DAT from the Default profile directory (Location varies - C:\Documents and Settings\Default or C:\Users\Default etc)

You can do this by using the Registry Editor as follows:

  • Run regedit
  • Click on the HKEY_USERS hive
  • Goto File -> Load Hive
  • Select the NTUSER.DAT from the relevant directory
  • Choose a Key Name (NB: This has no bearing on anything, it's purely a way to reference the hive while it's open.)
  • Expend your new hive and make any changes needed
  • Select the root of your new hive Goto File -> Unload Hive (This is important, as the file remains locked otherwise)

This NTUSER.DAT now gets copied to new profiles, and they in turn get all of the settings.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.