Comments on: Troubleshooting Microsoft Group Policy Site to Zone Mapping

By: Carl Webster

Carl Webster — Sun, 22 May 2022 12:04:50 +0000

In reply to steve.

This makes no sense, You didn’t read the article, but you say the info wouldn’t have helped you anyway. How would you know?

Webster

By: steve

steve — Wed, 18 May 2022 10:51:38 +0000

Hi Webster, i didnt really find this very useful considering that my laptop has been applying the Internet Explorer Zonemapping Policy for around 10 minutes and the information provided has not reassured me that it will be done any sooner. Bearing in mind, i didnt actually read the article , but i doubt it would’ve helped anyway.

Praise God, Lod Jesus, Steve.

By: Carl Webster

Carl Webster — Sat, 20 Jun 2020 15:32:33 +0000

In reply to Kuff. No, sorry I don't. Webster

By: Kuff

Kuff — Mon, 27 Apr 2020 11:41:31 +0000

Thank for this great article! One of the problem I got is that I need to use Internet Explorer Enhanced Security on some machine where I need to use the MMCs. So they say just to add “about:security_mmc.exe” as an exception… This don’t work. Do you have something for this particular case? Thx a lot!

By: Eric Michaud

Eric Michaud — Thu, 19 Mar 2020 15:54:22 +0000

Add another invalid entry to the list:
*.amazonaws.com

I don’t understand why this specific entry would be invalid, but as it turns out, at least as of 3/19/2020 with Windows 10 1803 March 2020 CU installed that you cannot use any variation of *.amazonaws.com.

Few other places where this is mentioned:
https://answers.microsoft.com/en-us/ie/forum/ie11-iewindows_10/cannot-add-amazonawscom-to-trusted-sites-in/377c17b7-94c6-4171-92bb-fe7283a98d7f

https://stackoverflow.com/questions/56438546/cannot-add-amazonaws-com-to-trusted-sites-in-internet-explorer-11

By: Carl Webster

Carl Webster — Mon, 16 Jul 2018 11:50:01 +0000

In reply to Stephan. I don't believe using mapped drives is possible. Webster

By: Stephan

Stephan — Wed, 11 Jul 2018 14:35:20 +0000

Hi Carl,

we’re struggling with adding mapped network drives like X:\
Already tried many constellations like
file://X:\
file:\\X:\
file:\X:\
file://\\X:\

Adding the computer wich contains the mapped drive by name or ip-address doesn’t help either.

Any ideas?

Thank You and cheers,
Stephan

By: Carl Webster

Carl Webster — Fri, 02 Dec 2016 13:24:21 +0000

In reply to Sami Närhi.

In the article by Martin referenced in my article, he states:

“Remark: In earlier versions of windows, if you provided a wildcard with a second level domain with only two letters (*.co.uk e.g.), this was an invalid entry. This was to prevent the whole SLD of some countrys to be added. At the time of this writing, this type of entry has become valid in Windows 10.”

http://evilgpo.blogspot.de/2016/03/internet-explorer-site-to-zone.html

Thanks

Webster

By: Sami Närhi

Sami Närhi — Fri, 02 Dec 2016 11:27:14 +0000

Excellent article – Thanks
I have found out that *.gov.uk and similar ‘two top level’ domains with asterisk give error message as well. (they are listed in registry zonemapkey but not in domains).
Do you know is there maximun number of sites/lines that can be added to zone aligment list?

By: Mike

Mike — Mon, 14 Nov 2016 15:43:44 +0000

In reply to Carl Webster. That was my other concern, the administrative burden of adding entries and potential for a typo. Thanks, think I'll wildcard them. (the joys of inheriting a setup from a departed sys admin)

By: Carl Webster

Carl Webster — Mon, 14 Nov 2016 12:56:38 +0000

In reply to Mike. You may gain a thousandth of a second or so but I believe you will gain more in management. I would rather see a short list than a long list. You would then, also, be able to see the list in the grey out zone mappings box in IE. Webster

By: Mike

Mike — Mon, 14 Nov 2016 09:47:19 +0000

Great article !
I’m looking to optimize the logon speed as much as possible, so this was an interesting topic.
In my secure environment, not connected to the internet, our Site to Zone assignment list contains many IP addresses of individual hosts.
Do you think logon processing would be quicker replacing with one or two wildcard entries ?

eg.
10.100.1.1
10.100.1.3
10.100.1.6
10.100.1.9
10.100.3.7
10.100.3.8
10.100.3.9
10.100.4.3
10.100.5.3
…
..

replacing with
10.100.1-5.*

By: Carl Webster

Carl Webster — Wed, 05 Oct 2016 16:05:17 +0000

In reply to Joachim.

Neither shows up and gpupdate reports no errors. Article has been updated.

Thanks

Webster

By: Joachim

Joachim — Tue, 04 Oct 2016 12:48:56 +0000

Thanks for this great post!

Would you mind testing the following:

file:\\192.168.0.1
or another working IP address

and also

file:\\servername
without the domain

By: Erik Ardengård

Erik Ardengård — Thu, 22 Sep 2016 07:15:29 +0000

Great one! Thanks.

By: Alain Assaf

Alain Assaf — Fri, 11 Mar 2016 17:35:40 +0000

Great article Carl. You really pulled back the veil on these site to zone error messages which I’ve encountered for years.