Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are currently using the following Group Policy to control the Internet Explorer security zones:

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page
Then setting the Site to Zone Assignment List with the various values using the following chart:

   Value    Setting
   ------------------------------
   0        My Computer
   1        Local Intranet Zone
   2        Trusted sites Zone
   3        Internet Zone
   4        Restricted Sites Zone

This works well; however, users are then unable to edit (or especially add) to their zone settings. Is there a way to lock in our custom zone settings while still giving users the ability to add their own sites to the security zones?

Yes, I do realize the slight security risk in opening this up.

share|improve this question

3 Answers 3

up vote 2 down vote accepted

There is no native way to do this with Group Policy.

Others will come along and suggest you write a login script for the users to set the Site to Zone Assignments locally on the machine which will still allow them to add/change sites. I think that's a really bad idea personally.

We handle this by getting Site/Deskside Support to ascertain the problem, and then submit a ticket to us to add the site. We still retain control, because as professionals we know what's best. Not the users.

Does it create a little extra administrative overhead? Yes. Is it less overhead than all the extra work required to resolve infections and outbreaks in the environment? Yes.


Edit following comment:

The way we handle that scenario is to move their Test PCs into a Test Lab OU, create and link a GPO (that only sets the Site to Zone Assignment List) specifically to that OU, and delegate Group Policy Object Editing for that GPO to a member of the Dev/QA team.

They can then edit that single GPO to their hearts content.

share|improve this answer
    
That is the way we currently operate. The problem comes from our developers or QA staff who need to test specific configurations. We either add a "bogus" site to everyone's zone or they test with a machine outside of our control. Neither is ideal. –  Doug Luxem Nov 16 '09 at 16:44
    
Edited......... –  Izzy Nov 16 '09 at 16:49
    
Don't want to delegate to a developer? Can't blame you! ;) –  Izzy Nov 16 '09 at 21:24

Not with Group Policies, but there is a way with Group Policy Preferences. This is a new feature that they introduced with Windows 2008 and is 'the new way' of doing Group Policies. It allows you to prepopulate your clients with your desired configurations, but still give them the freedom to add and remove. It also can replace most of your Login script requirements, speeding up login times.

You don't actually need a 2008 domain to use them, it'll work with a 2003 or 2000 domain. You just need to have a 2008, Vista or Win 7 machine to create the Group Policy Preferences from. You also need the Group Policy Preference client to be installed on your clients.

share|improve this answer

I have found the program ZonedOut to be quite helpful. Maybe it will help you accomplish what you need. You may be able to set and lock the regular UI and use ZonedOut to still add additional urls.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.