re: Internet Explorer’s Explicit Security Zone Mappings

eoxaal — Tue, 17 Jan 2012 14:34:22 GMT

My testing in a Windows Server 2008 terminal server with IE7 contradicts your otherwise excellent article on one point.

a) I find that a setting for a site in

HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap

takes precedence over any setting affecting the same site under

HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap

not the other way round as stated in the article.

E.g. if foo.com is set as "trusted" in the HKLM policy, there is no way to override that zone assignment for foo.com or any sub domains of foo.com under HKCU.

b) IP-address zone assignment also deserves a mention: Interestingly, making a zone assignment for an IP address in the machine site-to-zone policy precludes making a site-to-zone assignment *for any other* IP address under HKCU.

However, a workaround (which I can not find documented anywhere) for this limitation is to create a key for the IP address you wish to assign to a zone directly under ZoneMap\Domains (instead of the documented entries under "Ranges", that is:

HKCU\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\x.y.z.w

[Aaron Margosis] On (a) you are probably correct - in general HKLM policies do take precedence over HKCU policies. I think I may have copy/pasted lines from non-policy stuff earlier in the document (where HKCU overrides HKLM) and failed to re-order them when typing in the "Policies" part of the key path.

Your (b) finding is interesting - I'll have to test that.

15-May-2012: Finally had some time to look at (a) and confirmed what you found. Computer policies do take precedence over User policies, as expected. The bug was in my write-up here AND in IEZoneAnalyzer v3.5.0.3. Both have been fixed. Still need to investigate (b) above.

re: Internet Explorer’s Explicit Security Zone Mappings

Ron D — Thu, 20 Oct 2011 13:43:52 GMT

Great info Aaron. We are continually "adjusting" how to do our site-to-zone. I might add: one other major factor is if users are pointing to autopac files in IE: sites are assigned to Intranet Zone if the autopac rules states "return direct".