I need to deploy some trusted intranet sites into Intranet Zone in Internet Explorer. It works fine when using GPO at:

Setting Path: Computer Configuration/Administrative Templates/Windows Components/Internet Explorer/Internet Control Panel/Security

Page Supported On: At least Internet Explorer 6.0 in Windows XP Service Pack 2 or Windows Server 2003 Service Pack 1

Problem is this settings also affect other zones making it impossible for people in company to add sites to other zones themselves.

Is there a way to fix this so that Intranet Zone is deployed thru GPO and rest of settings stay in gesture of users?

  • could you provide the details how to apply this because the site provided by @smassey is down Aug 9, 2014 at 10:42

3 Answers 3


Another option to deploy websites to a zone using Group Policy Preferences is to deploy them as a Registry Preference. This site outlines how to set that up.

I use this method to deploy Trusted Sites to a virtual desktop environment.

  • could you provide the details in here again because the site is down? Aug 9, 2014 at 10:42

Turn off the Zone to Assignment list, you still have it enabled. I would disable it so turns off that forced feature (if you just go unconfigured, everyone that has it enabled will stay enabled I believe) and then use the preferences. The policy (if still in effect which it sounds like it is) is overriding the preferences.


You can accomplish this using Group Policy Preferences. This is if you have a 2008 R2 DC and your environment has been prepped for it. GP preferences allow you to push settings (in your case User IE zone settings), and still allow users to modify them. Also note that you would need the Client Side Extensions installed on any non-Windows 7 machines for this to work.

Once you have your environment ready, from the 2008 R2 DC, go into the GPMC and create a new GPO. Edit the GPO and you will see new sections in both the Computer and User configurations called "Preferences". Expand the User preferences to see "Internet Settings". Right click "Internet Settings" and create a new Preference item. Modify this item as you would a local IE settings GUI window. If you want these settings to only be applied once and then allow the user to add/ remove/ etc: When modifying the preference item, go to the "common" tab and check the "apply once..." box.

  • I do have 2008 R2 DC so I'll try it.
    – MadBoy
    Jun 27, 2011 at 13:01
  • Does it allow for us to keep deploying the site list and if user changes the site list (removes the ones applied by gpo) it will upload it back without affecting other user entries?
    – MadBoy
    Jun 27, 2011 at 13:06
  • The other problem is that sites are disabled and cannot be modified.
    – MadBoy
    Jun 27, 2011 at 13:08
  • If you don't use the "apply once..." check box, yes, entries on the list will be re-applied once the GPO refreshes.
    – HostBits
    Jun 27, 2011 at 13:10
  • What about the last problem (that sites are disabled).
    – MadBoy
    Jun 27, 2011 at 13:19

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.