Configuring only one Internet Explorer zone (IntranetZone) thru GPO without affecting other zones

There is no native way to do this with Group Policy.

Others will come along and suggest you write a login script for the users to set the Site to Zone Assignments locally on the machine which will still allow them to add/change sites. I think that's a really bad idea personally.

We handle this by getting Site/Deskside Support to ascertain the problem, and then submit a ticket to us to add the site. We still retain control, because as professionals we know what's best. Not the users.

Does it create a little extra administrative overhead? Yes. Is it less overhead than all the extra work required to resolve infections and outbreaks in the environment? Yes.

The way we handle that scenario is to move their Test PCs into a Test Lab OU, create and link a GPO (that only sets the Site to Zone Assignment List) specifically to that OU, and delegate Group Policy Object Editing for that GPO to a member of the Dev/QA team.

They can then edit that single GPO to their hearts content.

This does clear all the users prevoiusly added sites to ALL their securitys lists.

1. Open Group Policy Manager
2. Create New GPO and Link it.
3. Edit GPO.
4. Browse to User Config -> Admin Temp -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page
5. Open "Site to Zone Assignment List"
6. Enable it
7. Click Show and add your site name and the value 2 for the Trusted Zones list

Keith