Go Premium for a chance to win a PS4. Enter to Win

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 2261
  • Last Modified:

Group Policy - IE - Need to pre-populate Trusted Site list without blocking users from adding their own

We need to push out a list of IE Trusted Sites and disable the popup blocker.   This GP is in place and works.

But the GP also prevents the user from adding new Trusted sites.

- How can we pre-populate the list of Trusted Sites without preventing the user from adding their own?
- Or if that's not possible is a reasonable workaround to forget about using Trusted sites and simply populate the "Pop-up Allow" list?

-----

(I'd prefer to get it to work with Trusted Sites in case we want to control other security settings on those sites, like Active-X)

Thank you
0
Bill
Asked:
Bill
3 Solutions
 
Neil RussellTechnical Development LeadCommented:
You can not do this with a group policy. In my mind it is a BIG let down in GPMC.
0
 
BillAuthor Commented:
So would one workaround be to assign all of these sites to another zone, say, the Intranet zone.  Most people don't use that one anyway.

That would leave the Trusted Sites zone free for users to edit.
0
 
discgmanCommented:
Have you looked into IEAK for IE 7 or IE 8? They have a lot of customization features. But you will need to create one package then install via Group policy installing over the previous version.

http://technet.microsoft.com/en-us/library/bb496428.aspx
0
What is SQL Server and how does it work?

The purpose of this paper is to provide you background on SQL Server. It’s your self-study guide for learning fundamentals. It includes both the history of SQL and its technical basics. Concepts and definitions will form the solid foundation of your future DBA expertise.

 
Donald StewartNetwork AdministratorCommented:
How are you applying the trusted zones ?

Are you using Computer Configuration –> Administrative Tools –> Windows Components –> Internet Explorer –> Internet Control Panel –> Security Page ->Site to zone assignment list ?

Or

User Configuration –> Administrative Tools –> Windows Components –> Internet Explorer –> Internet Control Panel –> Security Page ->Site to zone assignment list ?

0
 
BillAuthor Commented:
The User Configuration would be preferrable.  It would take effect on login.

We have a LOT of HP Thin Clients with Windows Embedded Standard.  Those have a write filter that prevents any permanent changes.  Therefore Computer Level group policy changes would likely either fail or be lost on reboot.  Rebooting these devices restores them to the read only image that's stored in memory.  Either that or we could enable Loopback processing, that might work.
0
 
Donald StewartNetwork AdministratorCommented:
I was asking if you were currently using either method? (For troubleshooting)
0
 
BillAuthor Commented:
We've tried both ways:  Computer and User.
Was working ok either way except that it was locking down a user's abilty to add additional Trusted Sites

(Also had a problem when trying to use wild cards like    *.SomeTrustedDomain.com    but that's not the primary issue)
0
 
Donald StewartNetwork AdministratorCommented:
Try a simple logon script using a .bat


@echo off
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\YourSite.com\www" /v https /t reg_dword /d 00000002
reg add "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\YourSite.com\www" /v http /t reg_dword /d 00000002
0
 
BillAuthor Commented:
Not sure a login .bat script is our best option.

I'm thinking of assigning all "trusted" sites to the "Intranet" zone and leaving the "Trusted Sites" zone alone.

That way users can still add their own "Trusted Sites" and we can still manage security on approved sites through GP.

Thoughts?
0
 
Donald StewartNetwork AdministratorCommented:
If that works for you, go for it.

I only suggested the logon.bat so that you could just add more "Reg add's" as you go and still allow for users to add their own
0

Featured Post

Simplify Active Directory Administration

Administration of Active Directory does not have to be hard.  Too often what should be a simple task is made more difficult than it needs to be.The solution?  Hyena from SystemTools Software.  With ease-of-use as well as powerful importing and bulk updating capabilities.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now