Home / server / Questions / 594668
Accepted
hpy
Asked: 2014-05-13 17:27:16 +0800 CST

Group policy to check/uncheck "require HTTPS" in Internet Explorer 11 trusted sites list?

  • 772

When adding a list of trusted sites to Internet Explorer 11 in Windows 7 Professional SP1, there is a checkbox called "Require server verification (https:) for all sites in this zone".

Is there a way to modify the system's group policy to check or uncheck this checkbox? Perhaps it is something I can find via gpedit.msc?

Thanks!

P.S. Just to make sure we are on the same page, this is the dialog I am talking about: enter image description here

security

1 Answers

  1. Best Answer

    As far as I'm aware a specific group policy option doesn't exist, which means editing the registry directly using, for example, a login script (...referenced from a group policy)

    The specific key is: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags

    or if you want to change the setting for specific users, then: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\Flags

    To work out what to set the Flag DWORD to we need to reference this kb article - http://support.microsoft.com/kb/182569 - which I'll paste verbatim

    The Flags DWORD value determines the ability of the user to modify the security zone's properties. To determine the Flags value, add the numbers of the appropriate settings together. The following Flags values are available (decimal):

       Value    Setting
   ------------------------------------------------------------------
   1        Allow changes to custom settings
   2        Allow users to add Web sites to this zone
   4        Require verified Web sites (https protocol)
   8        Include Web sites that bypass the proxy server
   16       Include Web sites not listed in other zones
   32       Do not show security zone in Internet Properties (default
            setting for My Computer)
   64       Show the Requires Server Verification dialog box
   128      Treat Universal Naming Connections (UNCs) as intranet
            connections

    Assuming that you're happy with just setting a specific permission for everyone you could set the flags key to 67 (for example), by putting the following command in a login script, which would turn on the below flags:

    REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2" /v Flags /t REG_DWORD /d 67 /f
    • Allow changes to custom settings
    • Allow users to add Web sites to this zone
    • Show the Requires Server Verification dialog box
    • Treat Universal Naming Connections (UNCs) as intranet connections

    If on the other hand you want to ONLY change the SSL check box, then you'll need to use bitwise operators on the existing value, something like this in PowerShell:

    $SSLREQUIRED = 4
$key = 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\'
$FlagsDWORD = (Get-ItemProperty -Path $key -Name Flags)
if($FlagsDWORD.Flags -band $SSLREQUIRED)
{
    Set-ItemProperty -Path $key -Name Flags -Value ($FlagsDWORD.Flags - $SSLREQUIRED)
}
    • 4