Home / server / Questions / 101410
Accepted
Scott Forsyth
Asked: 2010-01-11 22:27:12 +0800 CST

Changing default Internet Explorer Security Zone

  • 772

I would like to set the IE security zone to Medium-high for all new users on a server.

This is a standalone machine and ultimately I'll need to script it. I don't mind making a registry change or updating the local security policy.

I've had some success updating HKCU 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel

but that only applies to the current user. I see that it's possible to set IE to only use HKLM for all users, but I would rather not change that. I want to allow it to continue to use HKCU.

Where is the default key that is used when creating a new user? Or, can I use Local Security Policy, something like: Computer Configuration\Administrative Templates\Windows Components\Internet Explorer\something?

internet-explorer

2 Answers

  1. In order to change default behaviour for new accounts, you need to edit the Default User profile. However, this is not

    HKU\.DEFAULT

    As this is the hive for the Local System user account, despite its confusing name. (MSDN Reference)

    To edit the Default User Profile, you need to change the NTUSER.DAT from the Default profile directory (Location varies - C:\Documents and Settings\Default or C:\Users\Default etc)

    You can do this by using the Registry Editor as follows:

    • Run regedit
    • Click on the HKEY_USERS hive
    • Goto File -> Load Hive
    • Select the NTUSER.DAT from the relevant directory
    • Choose a Key Name (NB: This has no bearing on anything, it's purely a way to reference the hive while it's open.)
    • Expend your new hive and make any changes needed
    • Select the root of your new hive Goto File -> Unload Hive (This is important, as the file remains locked otherwise)

    This NTUSER.DAT now gets copied to new profiles, and they in turn get all of the settings.

    • 2
  2. Best Answer

    The key you're after should be:

    HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\CurrentLevel

    This won't apply anything to existing users, but should be copied to new local users when a profile is created.

    • 0