0

So I just set a user level GPO to apply a website to the trusted sites zone. It works when logging in to a desktop and trying to go to the website and the website shows up in the trusted sites zone just fine. Now the problem is when trying to RDP to a terminal server the user can not go to the site and it doesn't show up in the trusted sites zone. Any ideas?

Improve this question
6
  • 2
    Is this a Computer Configuration setting or a User Configuration setting? Where is the GPO linked?
    – joeqwerty
    Apr 11, 2014 at 0:27
  • well we started off with computer configuration and that didn't do anything. user configuration is what gets it to work so far. also it is linked in active directory to the OU that i made just for testing this particular setting.
    – user3204742
    Apr 11, 2014 at 0:45
  • Is it linked to the OU where the computer accounts are or the OU where the user accounts are?
    – joeqwerty
    Apr 11, 2014 at 0:46
  • It is linked to the OU where the user resides.
    – user3204742
    Apr 11, 2014 at 0:48
  • Shameless self-promotion ahead. Learn about how Group Policy is applied so that you can diagnose this yourself: serverfault.com/a/588122/7200
    – Evan Anderson
    Apr 16, 2014 at 2:14

2 Answers 2

Reset to default
1

The core issue is simply this, Microsoft's GPO for site to zone assignment is broken when IE ESC is enabled.

Here is a list of how the site assignments are stored.

  • NO ESC, NO GPO, Using the UI: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
  • WITH ESC, NO GPO, Using the UI: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains
  • NO ESC, WITH GPO: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains
  • WITH ESC, WITH GPO: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains

The problem is the last entry. The situation where you are using ESC and a GPO. When using ESC, Internet Explorer looks for the "EscDomains" sub key not the "Domains" sub key. The GPO is not applying your requested zone assignments to the key were IE is going to look for them. Unfortunately, I don't know how to fix that either.

Improve this answer
1
  • which option should be used in case that I try to apply a GPO for adding keys to the registry?
    – Kristof Tak
    Aug 15, 2014 at 10:47
0

If gpresult shows the gpo is applying, I would guess the terminal server is configured for Internet Explorer Enhanced Security Configuration (ESC). That can be disabled in Server Manager.

If the gpo is not applying, it may be due to the terminal is configured for loopback gpo processing.

Improve this answer
1
  • We are trying to avoid disabling EAC as we use it to accomplish other security measures for internet access. we can see through rsop that the gpo is applying properly but in trusted sites and even in the registry the sites are not being applied.
    – user3204742
    Apr 15, 2014 at 22:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .