intune manage IE trusted sites

Copper Contributor

I have a config policy that allows 3 trusted sites in IE, however this blocks the user from adding there own if they want to. Is there a way to allow users to edit the trusted sites list while having this config profile enabled?  or does this profile lock it down?

 

ablake2035_0-1588608613302.png

 

9 Replies

You have to add it from your side whether using Intune Administrative templates or OMI profile (like your screenshot), which makes it grayed out for end user.

 

The only workaround is to run Intune PS and add Trusted Sites registries that you want to add. With this option, the user can still add sites from his end (check screenshot) Example of Registry in PS:

 

Hope this helps!

Moe

 

 

$RegLoc1 = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\example.com"

$RegLoc2 = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\example.com\child"

$Name = "https"

New-Item -path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\example.com"

New-Item -path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\example.com\child"

 

New-ItemProperty -Path $RegLoc2 -Name $Name -PropertyType Dword -Value 2

 

 

@Moe_Kinanithank you for your response I will take a look at this.

 

thanks

 

@Moe_Kinani 

 

Hi Moe,

 

I have pushed the PS script and can confirm it did create the registry keys as intended, however:

1- Users are still unable to modify or add new trusted sites.

2- Although the keys can be viewed in the registry, they are NOT showing up in "Internet Options", Trusted Sites.

 

Any suggestions?

HI,

Are you sure/could you confirm the policy you created earlier is no longer active?
Confirming that the PSscripts are successfully pushed using Intune and we can see the new keys in the registry, however, users are still unable to add their own sites.

Steps performed:

1- Configuration Profiles --> Site to Zone Assignment List completed (\Windows Components\Internet Explorer\Internet Control Panel\Security Page) --> no changes in sites under Internet options-> Trusted sites, still shows the old ones.

2- Security Baseline, IE (users adding sites / changing policies set to "NOT Configured" ). Not configured -> No changes, still the old sites, users can not add trusted sites.

3- Added a Powershell script to create the keys and set the value(2), and pushed it using Intune, can confirm that the keys have been added to endpoints, however no reflections under trusted sites, users can not add sites.(HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\xxx.com)

4- Added a configuration profile so that Intune policies get precedence over on-prem GPOs, still no changes.

Any suggestions?
Hi, I am testing it right now. I have created the same CSP as you did earlier I will let you know what the problem is.

@SamSONACA 

 

The first thing to check if the OLD CSP is no longer tattooed to the device

Open the registry: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\

Rudy_Ooms_0-1617709078603.png

Best practise is to make sure the CSP is configured to disabled 

Rudy_Ooms_1-1617709334517.png

When I configure the setting to disabled/ within a few minutes I can add websites again.

After you can add website manually again, you can add them with the powershell script mentioned earlier

 

$RegLoc1 = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\example.com"

$RegLoc2 = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\example.com\child"

$Name = "https"

New-Item -path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\example.com"

New-Item -path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\example.com\child"

 

New-ItemProperty -Path $RegLoc2 -Name $Name -PropertyType Dword -Value 2

 

 

 

 

 

@Rudy_Ooms_MVP 

 

Hi Rudy,

 

Although the old CSP was deleted a while ago, we still see the below keys.  I can confirm that if/when I delete the keys, I would be able to add the trusted sites, however, as soon as I sync with Intune, all the keys do come back!!

 

Checking the Intune sites, the CSP has been removed, so not sure how the keys are getting the old values.

 

Please review the keys that show the old values after re-syncing with Intune.

 

Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\current\device\InternetExplorer
---
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\PolicyManager\Providers\0FA8DA3E-8FE8-4E82-B46C-450D345BE532\default\Device\InternetExplorer
---
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Provisioning\NodeCache\CSP\Device\MS DM Server\Nodes\6604
---
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapKey
--
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\
--
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMapKey
---
Computer\HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Regedit

 

 

Are the devices in question domain joined, hybrid, or Azure AD joined?