Interesting bug in with Dot net 3.5 and internet security zones - Semi advanced Registry tweaking

Copper Contributor

Hello everyone. 

I'm posting here because I'm out of ideas...


I have encountered what I think is a Bug in windows.


I'm working with a big company that aren't very found of tweaking their GPO or the AD.

But, they have special settings they want in the internet options trusted zones to be enabled.


So I found a way to do it with NTUSER.DAT file.

Which means, every time a new user is created it will pull the data from this "default" user configuration which is tweaked from the registry.


We have created such file, and it works great. Unless we install 3.5 .Net Framework.

Sounds odd, but hear me out.

I created a new naked image. with installed 4.X .Net framwork.

Created new user. Went to internet options - trusted sites - custom level.

Most of it are set to the default settings, but 3 of them are set to enable(example Registry entry name - dword 1004 set to 0)

Then. I go back to administrator. -> Install the 3.5 .Net framwork through control panel. ->Restart PC

Create new local user. -> Log in it. -> check the same trusted site, but all I get is the default settings. 

Checking the registry confirms it didn't transfer the settings correctly. But other locations like popup blocker addresses/ Trusted sites addresses are configured correctly(Same script)


So Now I'm confused. Why with only .net 3.5 does this?

I changed the HKEY_LOCAL_MACHINE's dword 1004 to 0 as well. Didn't help.

I even deleted the 3.5 net framework and created a new user. when logged in. all behold, it works again... Any insight is much appreciated  


Adding here a similar registry data that is located in the NTUSER.DAT which is called "Defuser"

It works only when 4.X .NET framework is installed alone. If I install it together with 3.5, this data is not pulled to a new user that the windows is creating.(Windows is in Japanese)


[HKEY_USERS\Defuser\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2]
"PMDisplayName"="Trusted sites [Protected Mode]"



0 Replies