Include All Network Paths (UNCs)

[Gerry Hickman]

Hi,

There are three tick boxes in "IE6SP1 : Options : Security (Tab) : Local
Intranet (Icon) : Sites (Button)", one of these tick boxes is "Include All
Network Paths (UNCs)".

In the Windows XP SP2 version of INETRES.ADM there's a section where you can
control this setting from group policy. However, I can't get it to work on
Win2k. (it makes sense it won't work because it requires "IE6SP2"). Here's a
snip of the ADM file

POLICY !!IZ_UNCAsIntranet
#if version >= 4
SUPPORTED !!SUPPORTED_IE6SP2
#endif
EXPLAIN !!IZ_ExplainUNCAsIntranet
KEYNAME "Software\Policies\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap"
VALUENAME "UNCAsIntranet"
VALUEON NUMERIC 1
VALUEOFF NUMERIC 0
END POLICY

I tried manually hacking this registry key manually while logged in as a
user (HKCU) and it still didn't work! If I change the setting in IE's User
Interface I can see this reg key gets changed, but if I cange the reg key it
does not seem to be reflected in the UI?? It seems the UI is doing more than
just changing this one key?

In short, my question is; how can I emulate this policy on win2k machines?

 

[Gerry Hickman]

I tried manually hacking this registry key manually while logged in as a
user (HKCU) and it still didn't work!

OK, Behind the scenes, IE6SP1 is changing two keys at once. If you adjust
both keys in synch you can control this setting. Actually, I'd be surprised
if this policy actually works on XPSP2 (unless they changed the IE6SP2 logic
to only require one key to be changed?). On Win2k with IE6SP1 you can use
the following:

HKCU keys for setting Intranet zone to include UNC paths
Change the two keys below, make sure settings are in synch!

key: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\ZoneMap\UNCAsIntranet
value: 0x0 // off
value: 0x1 // on

key: HKCU\Software\Microsoft\Windows\CurrentVersion\Internet
Settings\Zones\1\Flags
value: 0x53 // off
value: 0xD3 // on

Strange?

Actually, thinking back to the IEAK, and the way it works for other SecZones
policies, it kind of makes sense because the official way to deploy SecZones
settings is to have to "import" them into the GP (IE prefs) or IEAK policy
editor from the machine you're sitting in front of at the time. If you
imported the whole of SecZones, it WOULD work, because the settings would be
in synch.

Personally, I hate the option of having to import the whole of SecZones from
a local machine. It just seems flawed and anyway it makes a lot of network
traffic and a huge registry.pol file.