Hello All,
I have been having an issue with site to zone propagation via GPO that has me perplexed. I'll provide environment details first and then explain what I've done.
Cloud based environment with two Windows 2008R2 servers (one DC and one functioning as a workstation) and 4 Linux servers (which I only mention because the internal website we access resides on one of them but for all intents and purposes they are irrelevant)
running IE 11 and both servers have all update to date patches. IE ESC is disabled on both systems as this was seeming to prevent GPO propagation of our Intranet Site in the Intranet Zone on both the server and workstation via GPO. Terminal Services
(RDP) is being used to access both servers.
I've run gpupdate /force and the policy propagates properly to push *.test.com (that is strictly an example) to each server and it sporadically applies to my test accounts. I've come to the conclusion that everything in the background is working properly
however the point of issue is when you log on using a brand new test account with proper (non-administrative) groups and permissions. How I've come to this conclusion is because when you logon to a new user account for the first time and launch IE 11
it gives you the chance to Setup IE for the first time, disregard setting it up, or just cancel out altogether. It doesn't appear to matter what I do as it disables the Zones and doesn't show the *.test.com site that I am pushing. HOWEVER if I
go to the Advanced Tab of Internet Settings and hit the Rest Internet Settings button and logoff/reboot and then log back on the site shows up properly and I am able to edit the various zones.
Why this is an issue is that we are developing a test environment that allows us to provision accounts to Active Directory and create workflows that send notifications to new users. The new user receives their credentials (not via email) and logs on
and is able to request other services and is granted these by workflow approvals from management. The user should only need to launch IE and enter the URL (which we'll be pushing by GPO homepage setting) to get to the provisioning application and Single
Sign-on (SSO) is enabled and functioning properly within the environment. It is functioning to such a degree that a user should only need to use a PIV card and corresponding PIN number to logon to the workstation and then through SSO launch IE 11 (or
Firefox or Chrome as we're agnostic) to get to the provision application. Due to something within IE 11 we are unable to make this a truly seamless process for new users as we can't just say logoff and back on and it will work.
Final notes, this is a TEST/DEV environment and there is no fear of a "user" fouling up the works as the only ones with access to the site and user accounts are the development and support team (very small). So please no comments regarding
maintaining access vs security as this is not necessary at this part of the project (we've already got multiple levels of security and certificates in place, etc, etc).
I hope that I've explained everything clearly as possible and I'm hoping others have had a similar problem and that an easy resolution is available. Once again, I can make things work, however this needs to be a seamless process going forward.
I've already read through numerous blogs on the issue and I know that others have/are experiencing problems like this.
Best regards
