none
How to centrally deploy site to zone mappings for IE11 on Windows Server 2008 R2

    Question

  • Hello everybody,

    in a 2008R2-based network, the classic policy in the user settings administrative templates for setting the site-to-zone mappings does not work any more (as announced, if I remember correctly). A workaround could be using group policy management on a Windows 10 client with RSAT installed and using preferences. We tried this today at a customer's site, however:

    a) The settings can be added up to IE 10, but not specially for IE 11. Should the IE 10 settings work on IE 11 (running on 2008 R2 terminal servers)?

    b) We can set many things in the internet settings preferences. However, the "sites" button for the site-to-zone mapping is disabled, so we cannot enter any entries. Why?

    What is a supported way to deploy site to zone mappings for many users on Windows Server 2008 R2 terminal servers please?


    Best Regards, Stefan Falk

    Tuesday, April 11, 2017 7:40 PM

All replies

  • Hi Stefan,
    a) You could download the IE11 Administration Templates (ADM file) from: http://www.microsoft.com/en-gb/download/details.aspx?id=40905, and as far as I know, we could also chose IE10 which works.
    b) Please have a try to deploy the registry keys for site to zone mapping using group policy preference, you could follow the details from: https://blog.thesysadmins.co.uk/group-policy-internet-explorer-security-zones.html
    Please Note: Since the web site is not hosted by Microsoft, the link may change without notice. Microsoft does not guarantee the accuracy of this information.
    Best regards, 
    Wendy

    Please remember to mark the replies as answers if they help.
    If you have feedback for TechNet Subscriber Support, contact tnmff@microsoft.com

    • Marked as answer by Stefan Falk Wednesday, April 12, 2017 9:33 AM
    • Unmarked as answer by Stefan Falk Thursday, April 27, 2017 1:32 PM
    Wednesday, April 12, 2017 6:42 AM
    Moderator
  • Hello Wendy,

    Thank you for your prompt answer. We will try the ADMX first and return here if that does not work.


    Best Regards, Stefan Falk

    Wednesday, April 12, 2017 9:33 AM
  • Hello again,

    Unfortunately, the new ADMX did not help anything: Site-to-Zone-GPO still does not work, and preferrences still to not offer IE 11.

    I have now tried to deploy the zone mappings directly als registry preferences. The customer will test and I will return here with the results.


    Best Regards, Stefan Falk

    Friday, April 21, 2017 12:12 PM
  • > a) The settings can be added up to IE 10, but not specially for IE 11. Should the IE 10 settings work on IE 11 (running on 2008 R2 terminal servers)?
     
    For IE11 to work, you might simply edit the XML and increase the hidden filterfile version max entry to 99...
     
     
    > What is a supported way to deploy site to zone mappings for many users on Windows Server 2008 R2 terminal servers please?
     
     
    We don't want them to add sites on their own, do we? :-)
     
     
    • Proposed as answer by DonPick Saturday, April 22, 2017 11:55 AM
    • Unproposed as answer by Stefan Falk Thursday, April 27, 2017 1:32 PM
    Friday, April 21, 2017 1:10 PM
  • Hello everybody,

    we tried deploying the registry values directly via GPO preferrences, but it does not work at all. Perhaps I made a mistake, perhaps not. I guess I will open a full PSS call and get some Microsoftie on to that machines.

    *sigh* Why can't the good old policy with the site-to-zone mappings simply continue to be supported? What do these devs think we are doing the whole day?

    So, we can close this here; I'll call into PSS. Thanks everybody for providing the tipps, hints and links.


    Best Regards, Stefan Falk

    Thursday, April 27, 2017 1:36 PM