I've enhanced the IE security zone comparison utility that I posted here a few weeks ago.  The new version shows the effective settings for a selected zone, based on the precedence rules for User and Computer policies and preferences (as described here) and whether only Machine settings are used.  Pick an IE security zone (such as Intranet), and the new IEZoneAnalyzer will show what settings are in effect and where those settings come from.

[Update 14 April 2011:  just posted IEZoneAnalyzer v3 with lots of new features.  See http://blogs.technet.com/b/fdcc/archive/2011/04/14/iezoneanalyzer-v3.aspx]