Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I need to add a site to trusted sites on all computers in my domain. I can do it with the "site to zone assignment list", however when I do, it locks trusted sites on the client computer "this setting is managed by your administrator". What I need is a way to add the site, make it persistant, and not affects the users ability to add trusted sites of thier own. (It's a development enviroment, sites are created and tested regularly, they need that ability.)

share|improve this question
up vote 2 down vote accepted

If you use logon scripts you could push a .reg file that has the trusted sites in there...that way you're not using the GPO to "take control".

Something similar is described here:

Also, if you don't want to replace what a user has already entered, there is a syntax to "append" data to a registry key...that way you can just add a global list but not wipe out individual additions already made by a user.

Here is some registry editing syntax :

share|improve this answer
I was hoping to avoid using logon scripts... GPO is so much cleaner. Can I stealth the script so its transparent to the user? – Matt Bear Dec 9 '12 at 7:27
You could use VB instead of a batch file and make the script invisible to the user...if you're more proficient with batch files you can use GPO to Run Legacy Logon Scripts Hidden. – user72593 Dec 9 '12 at 7:53
Your statement that GPO is cleaner than Logon scripts makes me think that you don't really understand either one. A Logon script can and should be configured in a GPO, not on the properties of the user account. By default Logon scripts called from a GPO run hidden. – joeqwerty Dec 9 '12 at 13:49

Assuming you have WinNT6 clients (Vista / Win7 / Win8), use a Group Policy preference setting to add the REG entry. Preference settings do not restrict the user's UI. Job done.

See Registry Extension TechNet Article for more info.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.