Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I have a policy that I created a few years back that modifies the users IE security settings as well as adding Trusted Sites to the trusted sites zone.

I can open the INF file in the SYSVOL share on the DC and see the particular area where the settings are kept:

\DC01\sysvol\domain.com\Policies{31B2F340-016D-11D2-945F-00C04FB984F9}\USER\Microsoft\IEAK\BRANDING\ZONES

the file is seczones.inf

My question is...can I modify this file directly or no? The only way to modify this setting is to do the whole "IMPORT SETTINGS" button in the GPMC from a client's IE to make these changes, but that seems like a pain to just add one more site to the trusted sites.

My other option was to simply create a vbscript to add the new site as a login script, but I'm curious if I can actually modify the INF file directly and have it take affect. Or would it screw it up?

If there's some other way to add trusted sites through a GPO without the site to zone assignment option I'm all ears...I just want to add a site not overwrite any current sites, etc.

share|improve this question

2 Answers 2

up vote 4 down vote accepted

You can edit it directly, but you need to make sure that you're 100% correct with your syntax, otherwise the GPO won't be processed by the clients. There is no validation when you do this, so it's strongly encouraged that you use the GPMC for this rather than notepad.

share|improve this answer
    
Doesn't the OP need to change the version number in the GPT.ini file for the GPO after editing the inf file in order for the GPO to be processed again during foreground or background refresh? It's always been my understanding that the CSE's don't "reapply" GPO settings if the GPO hasn't changed since the last refresh. –  joeqwerty Jul 26 '12 at 14:24
    
@joeqwerty - yeah I figured I might need to do that as well. I actually decided against messing with it, since I was concerned that such a simple idea would reap disastrous consequences. I ended up with a regedit /s regkey.reg "startup script" instead. –  TheCleaner Jul 26 '12 at 16:31

There are definitely times where the only way to get what you want a policy to do is directly editing policy files.

I had a group policy preference that needed to have a tab character embedded into a registry item. There is a bug in the UI that stops this from functioning in any fashion other than a direct edit.

The one caveat I've found is that after certain edits are made - I'm not sure if it will apply in this case - opening the policy in the GPMC can revert the custom changes.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.