Questions[security-zones](server)

Normally we have just 4 security zones listed under the security tab in Internet Options. For some reason, a 5th security zone, called My Computer is being added to various users, seemly at random. It has become quite a nuisance as it locks down the user from being able to run various applications on their computer or through the network.

We have a registry fix, but we would really like to track down what is causing it to happen in the first place. We've looked through our Group Policies, but can not find any anomalies that would activate this extra zone.

Here's what the security tab normally displays:

Normal Security Tab

And here's what an affected users security tab looks like:

My Computer added Security Zone

We are currently facing a debate regarding the Internet Explorer's setting 'Initialize and script ActiveX controls not marked as safe for scripting'.

I have been maintaining an in-house application that uses Outlook's and Word's automation to send email and generate letters. As it is an internal application, the url of the application is detected as 'Local Intranet'.

Our Sysadmins have changed the GPO of our workstation and disabled this setting. Unfortunately, this broke the script that was automating Office. Now we have a debate around the questions:

1. should we change this setting back?
2. or change the security of the local intranet zone to low (which would allow the script to run - with a prompt)?
3. or should we re-develop the application in order not to use office automation?

Of course, as a developer, I would recommend the first or the second solution. But, I'd like to make sure that I'm not asking for something that would put our company's security at stake.

Does anyone have any experience? feedback on such a topic?

Basically, I would like to do .... this.....

http://www.howtogeek.com/howto/windows-vista/disable-the-annoying-this-page-has-an-unspecified-potential-security-risk-when-using-files-on-a-network-share/

.... via group policy. I have a largish number of machines to update, all at the same time, and 1 day to do it! Any help will be appreciated :)

I'm trying to set up a GPO to add 3 sites to the Trusted sites zone and change some of the security settings for the same zone (Allow unsigned ActiveX and such).

I used a clean PC and added the settings to Internet Explorer, started gpmc and imported the settings for Security/Securityzones under Internet Explorer Mainteneance, which works but imports all the settings for all security zones which isn't really what i want.

How do i just get the settings for the Trusted sites zone?

Following the instructions for making .CHM files work on a network drive, when using example 2 - setting MaxAllowedZone - I see that I have to raise it to 3 - Internet to get CHM files to work.

I would conclude that this means my main shared network folder on the file server (W2K3) is in the "Internet" security zone, even though this should be "Local Intranet".

I suspect that is alos the cause of some of the additional security checks when copying files around or opening them.

Is that an Internet Explorer Setting, or is something else amiss? Would that affect e.g. opening files from the file server through Windows Explorer? Can this setting be changed through group policies?

Local network is a domain with Active Directory running on W2K3 SBS, the file share runs on a separate (virtualized) machine on W2K3.

[edit] Client OS where observed is Windows 7 Ultimate. Other client OS'es in use are XP Pro, Win 7 Pro, and a few Vistas (that are about to be replaced).