Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I need to deploy some trusted intranet sites into Intranet Zone in Internet Explorer. It works fine when using GPO at:

Setting Path: Computer Configuration/Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security

Page Supported On: At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1

Problem is this settings also affect other zones making it impossible for people in company to add sites to other zones themselves.

Is there a way to fix this so that Intranet Zone is deployed thru GPO and rest of settings stay in gesture of users?

share|improve this question
add comment

3 Answers

up vote 1 down vote accepted

Another option to deploy websites to a zone using Group Policy Preferences is to deploy them as a Registry Preference. This site outlines how to set that up.

I use this method to deploy Trusted Sites to a virtual desktop environment.

share|improve this answer
add comment

Turn off the Zone to Assignment list, you still have it enabled. I would disable it so turns off that forced feature (if you just go unconfigured, everyone that has it enabled will stay enabled I believe) and then use the preferences. The policy (if still in effect which it sounds like it is) is overriding the preferences.

share|improve this answer
add comment

You can accomplish this using Group Policy Preferences. This is if you have a 2008 R2 DC and your environment has been prepped for it. GP preferences allow you to push settings (in your case User IE zone settings), and still allow users to modify them. Also note that you would need the Client Side Extensions installed on any non-Windows 7 machines for this to work.

Once you have your environment ready, from the 2008 R2 DC, go into the GPMC and create a new GPO. Edit the GPO and you will see new sections in both the Computer and User configurations called "Preferences". Expand the User preferences to see "Internet Settings". Right click "Internet Settings" and create a new Preference item. Modify this item as you would a local IE settings GUI window. If you want these settings to only be applied once and then allow the user to add/ remove/ etc: When modifying the preference item, go to the "common" tab and check the "apply once..." box.

share|improve this answer
    
I do have 2008 R2 DC so I'll try it. –  MadBoy Jun 27 '11 at 13:01
    
Does it allow for us to keep deploying the site list and if user changes the site list (removes the ones applied by gpo) it will upload it back without affecting other user entries? –  MadBoy Jun 27 '11 at 13:06
    
The other problem is that sites are disabled and cannot be modified. –  MadBoy Jun 27 '11 at 13:08
    
If you don't use the "apply once..." check box, yes, entries on the list will be re-applied once the GPO refreshes. –  Cheekaleak Jun 27 '11 at 13:10
    
What about the last problem (that sites are disabled). –  MadBoy Jun 27 '11 at 13:19
show 2 more comments

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.