locked
GPO User Settings Not Applying When SCM Computer Settings Applied RRS feed

  • Question

  • I can apply 'Site Zone Assignement' successfully to user:
    User Settings -> Administrative Templates -> Windows Components -> Internet Explorer -> Internet Control Panel -> Security Page.
    I can use this to add sites to trusted sites.

    When I apply the 'Security Compliance Manager' 4.0 Internet Explorer GPO template to the workstation, the user site zone assignment settings "stop taking". I say stop taking, because according to group policy modeling, and gpresult, the user GPO is present and applied.

    Of note:
    If I change the 'Site Zone Assignement' to a computer setting, it takes. {My manager doesn't want to do this}
    If I enable loopback processing it does not take.

    I've seen this issue on windows 7 and 10 Enterprise x64 clients.
    I feel like there is something set in the SCM internet Explorer GPO set that's preventing user settings (whether from GPO or user) from applying, but I can't put my finger on it. Does anyone else know?

    P.S. Link to SCM: https://blogs.technet.microsoft.com/secguide/2014/09/04/scm-baselines-for-windows-8-1-ie-11-and-server-2012-r2-are-now-live/
    http://go.microsoft.com/fwlink/?LinkID=507389&clcid=0x409
    Internet-Explorer-11-Security-Compliance-Baseline_Attachments-2.cab\BaselineDocuments\94949772-335f-402b-bb8e-9904a31b1cba\Internet Explorer 11 CCE Reference.xlsm


    Friday, August 25, 2017 11:02 PM

All replies

  • probably more of a Group Policy question?

    Assuming you are using Domain Group Policy, are you correctly configuring the GP Link Order/Precedence, so that your desired "winning" GP actually wins?For SCM, you should note that SCM is now retired: https://blogs.technet.microsoft.com/secguide/2017/06/15/security-compliance-manager-scm-retired-new-tools-and-procedures/

    (that doesn't mean that it won't work, but you won't get any support for it any more, so it's probably time to move away from SCM, rather than introduce it to Win10)

    You can manage S2Z assignments via GPP-Registry (that's what we do), if you want that flexibility.


    Don [doesn't work for MSFT, and they're probably glad about that ;]

    Sunday, August 27, 2017 5:01 AM