Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

When adding a list of trusted sites to Internet Explorer 11 in Windows 7 Professional SP1, there is a checkbox called "Require server verification (https:) for all sites in this zone".

Is there a way to modify the system's group policy to check or uncheck this checkbox? Perhaps it is something I can find via gpedit.msc?


P.S. Just to make sure we are on the same page, this is the dialog I am talking about: enter image description here

share|improve this question
up vote 3 down vote accepted

As far as I'm aware a specific group policy option doesn't exist, which means editing the registry directly using, for example, a login script (...referenced from a group policy)

The specific key is: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags

or if you want to change the setting for specific users, then: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags

To work out what to set the Flag DWORD to we need to reference this kb article - - which I'll paste verbatim

The Flags DWORD value determines the ability of the user to modify the security zone's properties. To determine the Flags value, add the numbers of the appropriate settings together. The following Flags values are available (decimal):

   Value    Setting
   1        Allow changes to custom settings
   2        Allow users to add Web sites to this zone
   4        Require verified Web sites (https protocol)
   8        Include Web sites that bypass the proxy server
   16       Include Web sites not listed in other zones
   32       Do not show security zone in Internet Properties (default
            setting for My Computer)
   64       Show the Requires Server Verification dialog box
   128      Treat Universal Naming Connections (UNCs) as intranet

Assuming that you're happy with just setting a specific permission for everyone you could set the flags key to 67 (for example), by putting the following command in a login script, which would turn on the below flags:

REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" /v Flags /t REG_DWORD /d 67 /f
  • Allow changes to custom settings
  • Allow users to add Web sites to this zone
  • Show the Requires Server Verification dialog box
  • Treat Universal Naming Connections (UNCs) as intranet connections

If on the other hand you want to ONLY change the SSL check box, then you'll need to use bitwise operators on the existing value, something like this in PowerShell:

$key = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\'
$FlagsDWORD = (Get-ItemProperty -Path $key -Name Flags)
if($FlagsDWORD.Flags -band $SSLREQUIRED)
    Set-ItemProperty -Path $key -Name Flags -Value ($FlagsDWORD.Flags - $SSLREQUIRED)
share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.