IE 11 security settings / Server 2012 domain joined server

Can someone clarify how the Security settings are automatically managed on domain jointed computers in IE 11 / Server 2012 R2:

There seem to be different settings depending on the IE Enhanced Security Settings.

I particular if IE Enhanced Security Settings are on, Security is forced to High for Internet and admins cannot change it.

If IE Enhanced Security Settings is off for admins Security is forced to Medium High and admins cannot change it

If IE Enhanced Security Settings is off Security is Medium-High and admins can change it

Is this by design?

Run As Administrator seems to have no effect.

This only happens on domain joined systems

CarolChi