Our Active Directory domain consisting of Windows Server 2012 R2 servers and Windows 7 workstations configures Internet Explorer security zones using this Group Policy setting:

Computer Configuration/Policies/Administrative Template/Windows Components/Internet Explorer/Internet Control Panel/Security Page/Site to Zone Assignment List

However, this has no effect on the servers, which have IE Enhanced Security Configuration enabled. How do I configure them using Group Policy? Ideally, I'd want the same settings to apply both with and without ESC without listing them twice.

  • Did you tried the same setting from User Configuration, not Computer. I guess your server act as terminal server ? – yagmoth555 Apr 15 '16 at 12:50
  • I haven't tried that, but we have "Security Zones: Use only machine settings" enabled and I don't want to change that. Users connect to that server via RDP, yes. – EM0 Apr 15 '16 at 13:13

There are separate settings under each ZoneMap key for “ESC on” and “ESC off”. If ESC is on, only those settings under the EscDomains and EscRanges subkeys are used; if ESC is off, only the settings under the Domains and Ranges subkeys are used.


As you want a machine setting, those would be configured like that;

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains\mytest.org ... ]

As the settings is not there via the normal ZoneMap GPO setting, I recommand a GPP to set the registry item within your GPO

  • I tried this, but it had no effect. That is, the registry value was added, but my Trusted Sites zone is still empty when I view it in Internet Settings. (There were already other domains listed under the EscDomains registry key, such as runonce.msn.com, and they don't appear under Trusted Sites, either.) – EM0 Apr 18 '16 at 15:00
  • @EM I seen report that if the two branches are set, Domain & EscDomain a bug can happen, thus leading to your bug (empty list). Is it something you can test out on your TS ? – yagmoth555 Apr 18 '16 at 17:33
  • Turns out it was something quite similar to that - see my answer. Thanks for your help! – EM0 Apr 19 '16 at 9:48

In addition to adding EscDomains registry keys per yagmoth555's answer, I had to set HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915\* to 1 (DWORD) for the registry settings to be applied.

https://support.microsoft.com/en-gb/kb/918915 describes the problem. I initially ignored it, because it's for Windows Server 2003 and we're running 2012 R2. It turns out that, while the hotfix doesn't need to be applied to later Windows Server versions, it still needs to be enabled using this registry key.

  • I tried quite a lot of permutations of this, and I don't think you do need the FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915 key workaround beyond Windows Server 2003. I think you've just got to be careful about which key path you use to get to the EscDomains key. For me, when I put my intranet sites under the HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\EscDomains key, everything worked fine. Note that there is a Policies key in the path, which is presumably where group policy configuration of the site/zone assignments goes. – Adam Goodwin Jun 20 '16 at 0:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.