Windows – GPO IE Security Zones

There is no native way to do this with Group Policy.

Others will come along and suggest you write a login script for the users to set the Site to Zone Assignments locally on the machine which will still allow them to add/change sites. I think that's a really bad idea personally.

We handle this by getting Site/Deskside Support to ascertain the problem, and then submit a ticket to us to add the site. We still retain control, because as professionals we know what's best. Not the users.

Does it create a little extra administrative overhead? Yes. Is it less overhead than all the extra work required to resolve infections and outbreaks in the environment? Yes.

The way we handle that scenario is to move their Test PCs into a Test Lab OU, create and link a GPO (that only sets the Site to Zone Assignment List) specifically to that OU, and delegate Group Policy Object Editing for that GPO to a member of the Dev/QA team.

They can then edit that single GPO to their hearts content.

The administrative UI for Internet Explorer Maintenance imports the entire "Security Zones" setting from the computer running the Group Policy Editor in one fell swoop. It does not allow granular selection of which security zone settings you'd like to import.

The import process in the Group Policy editor UI is just creating a "seczones.inf" file in the "user\Microsoft\IEAK\BRANDING\ZONES" subfolder of the GPO you're working within. You could customize that "seczones.inf" file to contain only "Trusted Sites" information (you'll probably need some technical implementation details about IE Security Zones to make the "seczones.inf" file make sense), but I doubt you'll ever be able to edit the file using the Group Policy Editor GUI again.

(I always felt like the "integration" of Internet Explorer Maintenance in Group Policy felt like it was very close to 5 o'clock on a Friday when it was "architected".)

Microsoft exposed a lot of IE Security Zone settings in "Administrative Templates" in later revs of Internet Explorer. You might look at using these settings (under "Windows Components \ Internet Explorer \ Internet Control Panel \ Security Page") to see if you can accomplish what you're looking for without using the Internet Explorer Maintenance Group Policy extension.