Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have a group policy (which ONLY deals with the zone assignment) -that is continually switching on and off with reboots.

I thought it was a conflicting group policy but when I run group policy modeling report it doesn't show any descrepancies that I can see.

I thought it may be an issue with one domain controller wasn't replicating my policy change to the other one, but this isn't the case.

I checked both domain controllers and they show the same information.

The assignment is on a user basis and is in: user configuration > administrative templates > windows components > internet explorer > internet control panel > security and is site to zone assignment.

share|improve this question

migrated from Dec 22 '09 at 22:44

This question came from our site for professional and enthusiast programmers.

GP modeling/RSOP is an excellent tool to show what should be applied. Sometimes gpresult will provide a more realistic picture of what actually was applied. You may want to run gpresult /z > gp.txt on the machine where the policy is out of whack. Inspect the file to verify that your policies and settings are applied and not filtered out, and no unexpected policies are being applied.

share|improve this answer

I found that simply viewing the GP for Security Zone's in Internet Explorer could cause the settings in use for the currently logged in user to be applied over the top of whatever you think you are setting. This has caught us out many times, where someone has tried to figure out what the GP settings are, and then reset them without meaning to.

So when you want to set the security for your GP, first set the security zones in IE the way you want to apply them, whilst logged in with the account you will use to make the GP change. Then do the GP change. That way, if GP grabs any settings from IE, they are the settings you want.

Could be quite complicated if you have a lot of different policies for this. I'm not clear what the "official" way of updating this is supposed to be.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.