Internet Explorer security settings that you set with a Group Policy object are not propagated

Article translations Article translations
Article ID: 316702
Expand all | Collapse all

Symptoms

Microsoft Internet Explorer security settings in an organizational unit Group Policy may not be applied to a user whose account is in the organizational unit. This behavior occurs after the user resets the security settings, logs off, and then logs on again.

Cause

This behavior occurs because Internet Explorer security settings in Group Policy that has not changed are not to be applied to a user, even if the user has changed the same security settings in the local browser. If you change the local security settings, the settings in the local registry are overwritten.

Resolution

To resolve this behavior, force the Internet Explorer settings in a Group Policy to always rewrite the appropriate registry keys when the user logs on to the computer:
  1. On a domain controller, open the Active Directory Users and Computers snap-in.
  2. Right-click the domain name, and then click Properties.
  3. Click the Group Policy tab, click the default domain policy, and then click Edit.
  4. Expand Administrative Templates under Computer Configuration in the Tree pane.
  5. Expand System under Administrative Templates, and then click Group Policy.
  6. Click Internet Explorer Maintenance Policy Processing in the Policy pane.
  7. Double-click Internet Explorer Maintenance Policy Processing to open the properties for Internet Explorer Maintenance Policy Processing.
  8. Click Enable on the Policy tab, and then click Process, even if Group Policy objects have not changed.
  9. Click OK to set the policy.
Note It takes approximately 45 minutes for this policy to propagate to all domain controllers and to all users. You can force the update on a user workstation if you type the following command at a command prompt on the user workstation:
secedit/refreshpolicy user_policy/enforce

More information

Each Group Policy is identified by a 32-digit GUID. The default domain policy GUID always starts with "31B," and the default organizational unit policy starts with "6AC." To locate the GUID for any custom policy, right-click the container for the policy, and then click Properties. Click the Group Policy tab, click the policy, and then click Properties. The GUID is displayed on the General tab in the Unique Name box.

Each Group Policy is stored on the computer where it was created. For example, you may create the Group Policy setting in the %SystemRoot%\Sysvol\domain_name\Sysvol\Policies folder, where domain_name is the name of the domain. The folder is named as the GUID for that policy. There is an Adm folder, a machine folder, and a user folder. In the Adm folder, you can locate the Inetres.adm file. This is the file where the Internet Explorer settings are stored. You can open the file by using a text editor such as Notepad.

Properties

Article ID: 316702 - Last Review: June 19, 2014 - Revision: 3.0
Keywords: 
kbenv kbprb KB316702
Retired KB Content Disclaimer
This article was written about products for which Microsoft no longer offers support. Therefore, this article is offered "as is" and will no longer be updated.

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com