Comments on: Best Practice: How to use Group Policy to configure Internet Explorer security zone sites

By: Best Practice: Roaming Profiles and Folder Redirection (a.k.a. User State Virtualization) : The Digital Jedi's Blog

Wed, 27 Feb 2013 04:06:40 +0000

[...] so that all servers will be Intranet Zone (e.g. file://*.contoso.local ). See my other blog postHow to use Group Policy to configure Internet Explorer security zone sites on how to do [...]

By: akhil

akhil — Mon, 04 Feb 2013 11:49:49 +0000

with this GPO can we block all internet traffic except google and some other sites to users in the domain??

By: John

John — Fri, 27 Apr 2012 15:48:11 +0000

GPP is server 2008 only and requires client side software correct?
Anyway to do achieve the same results (managed IE Zones without disabling user access) in a 2003 AD environment?

By: Adam Fowler

Adam Fowler — Sun, 08 Jan 2012 14:22:09 +0000

@alanburchill @auteched Worth noting that IE zones via this method http://t.co/qiaLSFK7 will wipe out settings from the old method!!!

By: Alan Burchill

Alan Burchill — Sun, 08 Jan 2012 13:36:05 +0000

@AdamFowler_IT this is how you do IE zones http://t.co/uKug8h9h /cc @auteched

By: Nicolas

Nicolas — Tue, 26 Jul 2011 14:05:11 +0000

Hello !

Is there somebody who know how to do the same but with Cookies ?

Because of that, I still have to use IEM which sucks…

Thx

By: Colin

Colin — Tue, 15 Feb 2011 07:16:35 +0000

Ditto. This was my conclusion a few years ago when researching the various IE management methods. Have been scripting the site/zone assignment manually since then. Primarily with GPP which is fairly simple to manage
Colin

By: Jeff

Jeff — Tue, 01 Jun 2010 13:43:25 +0000

Mike,

You will not have to resort to a script and SCCM. Contrary to what this blog entry says can’t be done, we do use GPP to set sites into speicfic security zones. But we don’t set it as a GPP Internet Setting. We use GPP to assign the sites to their proper zones in HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains. Doing it this way we configure the sites we need configured for the organization but do not block the users’ ability to add sites they need set for their individual machines.

Jeff

By: Patrick

Patrick — Mon, 17 May 2010 15:27:42 +0000

The configuration for regular zones works fine.
Bu the real pain starts when trying to cover zones for “Enahanced Security Configuration” which require
other hives in the registry (e.g. “HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ESCDomains\MyDomain”). I have not seen a Microsoft solution for that so far.
If anybody knows a smart solution and would share it, I’d really appreciate that.

By: Alan Burchill

Alan Burchill — Thu, 29 Apr 2010 07:13:29 +0000

I have not tried this for a while but i believe you can still do this if you configure it under the Internet Explorer Maintainence section of Group Policy…

By: Mike

Mike — Thu, 29 Apr 2010 07:02:41 +0000

Hi Alan.

Yup, that is right and excately how we do it, however there is one problem that is of slight concern

Once the Zones are set via this GP the user can not add his own and as banks etc. today rely on Trusted Zones this is a slight problem. Our IT policy allow for users to use their PC for personal business as well as work and thus it is a slight problem that they cant add Zones for eg. their bank etc.

I have been thinking, maybe one could make a script to set Zones and deploy this via SCCM 2007.

Br
Mike

By: Group Policy Center » Blog Archive » How to use Group Policy to mitigate security issue KB981374

Mon, 22 Mar 2010 20:20:14 +0000

[...] Once you have performed the above configuration changes be sure to add *.windowsupdate.microsoft.com, *.update.microsoft.com and any other site you require to run Active Scripting on to the trusted sites zone list. Instructions on how to do this can be found here How to use Group Policy to configure Internet Explorer security zone sites [...]

By: Group Policy Center » Blog Archive » Group Policy Setting of the Week 18 – Allow file downlaod (Internet Explorer)

Tue, 16 Mar 2010 10:47:57 +0000

[...] About the Author « How to use Group Policy to configure Internet Explorer security zone sites [...]

By: Alan Burchill

Alan Burchill — Sun, 14 Mar 2010 12:11:05 +0000

How to use Group Policy to configure Internet Explorer security zone sites http://bit.ly/bNHowK

By: GroupPolicy Center

GroupPolicy Center — Sat, 13 Mar 2010 20:00:25 +0000

Blog Post: How to use Group Policy to configure Internet Explorer security zone sites http://bit.ly/bNHowK