Windows не удалось применить параметры internet explorer zonemapping

Hi All,

I have a large domain and a long list of websites that are trusted using the following group policy setting:

Administrative Templates > Windows Components > Internet Explorer> Internet Control Panel > Security Page >
Site to Zone Assignment List

On all (XP/vista/win7) workstations across the domain I’m getting the following error:

Log Name:  System
Source:  Microsoft-Windows-GroupPolicy
Event ID: 1085
Task Category: None
Level: Warning
Keywords:   Description: Windows failed to apply the Internet Explorer Zonemapping settings. Internet Explorer Zonemapping settings might have its own log file.

There’s nothing either side of this error in the log that shines any more light on the issue.

I know which group policy object its applying these settings but cant find which of the entries in the site to zone assignment list is causing this issue. I looked in the
Group Policy/Operational log but all I see is the following entry which says «completed» but is logged as an error:

Картинка с сайта: networksteve.com

After some research I’m guessing that the issue is an incorrect wild-card. This is what my trusted sites list looks like (with names removed of course):

Is there something obviously incorrect here?
Does anyone know where I could find an article that clearly outlines the acceptable wildcard syntax for the
«Security page\ site to zone assignment list» group policy?  Ive read every forum post, website and blog I could find on the internet but nothing is clear and I wasn’t able to find an MS document that steps it out. I’ve also changed the
existing list a number of times based on blog posts etc but had no luck.

**Please Note**
I dont want to change to a different method or have an intellectual debate re why I would have these sites/wildacrd/policy set. I’m really looking to see what entry is invalid and where the documentation is for this policy setting so i can make sure they are
always correct in the future. 

thanks in advance for your time and assistance
Simone

PS: I’ve already read the following posts a number of times:

• I get no data but have identified the GP that is causing the issue:
  
  A test case for troubleshooting group policy application Event ID 1085 and 7016 — http://blogs.technet.com/b/askds/archive/2008/08/21/a-test-case-for-troubleshooting-group-policy-application-event-id-1085-and-7016.aspx 
  
• I dont have any 2 letter domain names:
  Problems Adding Top-Level Domains to Zone Sites List — http://support.microsoft.com/kb/259493
  
• I tried formatting the list per this article:
  [Solved] The Group Policy client-side extension Internet Explorer Zonemapping failed to execute  — http://daily-it.blogspot.com.au/2008/09/solved-group-policy-client-side.html
• Has no domain wildcard format info:
  Behavior of Site to Zone Assignment List  — http://blogcastrepository.com/blogs/mattbro/archive/2006/09/07/2183.aspx
• Great article, no wildcard data:
  Internet Explorer Policy Settings  — http://technet.microsoft.com/en-us/library/bb457144.aspx

• Internet zonemapping problem: http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/a8756a27-b562-42ad-8782-87d284e6bcfb/
• Spiceworks Event 1085 (Warning) — http://community.spiceworks.com/windows_event/show/1582-microsoft-windows-grouppolicy-1085
• Event ID 1085 Application of Group Policy — http://technet.microsoft.com/en-us/library/cc727303%28v=ws.10%29.aspx
  Application of group policy — http://technet.microsoft.com/en-us/library/cc727312%28v=ws.10%29.aspx
• Evt ID 1085 GP client-side extension IE ZoneMapping failed to exec  — http://www.winvistatips.com/evt-id-1085-gp-client-side-extension-ie-zonemapping-failed-exec-t706399.html
• Event 1085 — Internet Explorer Zonemapping — http://www.minasi.com/forum/topic.asp?TOPIC_ID=29206
• EventID.net — http://www.eventid.net/display.asp?eventid=1085&eventno=1412&source=Userenv&phase=1
• Event ID 1085 — Internet Explorer Zonemapping failed to execute — http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_24897522.html

.

.

.

UPDATE:

I disabled the original policy and created a new one with only one trusted site address in it. Then I logged into a clean test machine did some testing.What I found after a few hours of testing was; regardless of the site that I have listed in group policy
—

• The HKCU\Software\Policies\Microsoft\Current version\Internet Settings\Zone Map Key registry entry is
  always updated with that entry on the workstation. So the workstation’s registry always updates the key with
  *.sitename.com per the site that I have set in GP
• If I run GPUPDATE /FORCE over and over again, on the same machine, under the same user account, using the same DC I get:
  Failure, Failure, Failure, Success, Success, Success, Failure etc

I wasn’t able to determine any pattern to the failures, I tried stopping some of the processes on that machine but didn’t find anything that would make it fail/succeed reliably.
There is no AV or firewalls installed on my test machine

Anyone have any more ideas?  I think I might install filemon and try to capture some more data unless there’s a better tool?

• Edited by

  Wednesday, August 15, 2012 6:14 AM

Is there something obviously incorrect here?

http://servername.*  

Yes, there is something incorrect. You can only use ONE wildcard per entry, and it MUST be at the beginning of the hostname. And you are right — the rules are hardly documented Even MSDN has little information on it:
http://technet.microsoft.com/en-us/library/cc736412.aspx

sincerely, Martin

I think this article is the closest I’m going to get to an official answer
http://support.microsoft.com/kb/184456

Not sure why that didn’t show up in any Google /bing/ tech net or MS page searches.

• Marked as answer by
  Simone_Bennett
  Tuesday, April 10, 2012 2:01 AM
• Unmarked as answer by
  Simone_Bennett
  Wednesday, April 11, 2012 2:45 AM

I changed all of the entries to use the following format (per the MS article) and i still get the same error. Any more ideas?

Example:
*://*.domain.com

Hi Martin,

Thanks for the reply, I should have posted a response to your earlier post (sorry about that).

I’ve confirmed that the changes I’ve made to the GP are replicating and can see them applied if i run gpresult on the workstations.

Did you happen to recently change from using the «Internet Explorer Maintenance» portion of GPO to the «Site to Site Zone Assignment» to manage security zones?  Curiously. &n

OK…I fixed mine.  As I was reviewing the wildcard placements (as suggested by someone) I noticed the dot (.) looked a little fatter on a series of entries…but it was too small to tell.  So I copied the entries out into notepad and what do you
know, they were fricking commas.  Replaced the commas with periods and it works like a charm.  «Blind» luck.

Marvin

• Edited by
  MarvinJ
  Wednesday, August 01, 2012 7:57 PM

So I disabled the original policy and created a new one with only one trusted site address in it. Then I logged into a clean test machine did some testing.What I found after a few hours of testing was; regardless of the site that I have listed in group policy
—

• The HKCU\Software\Policies\Microsoft\Current version\Internet Settings\Zone Map Key registry entry is
  always updated with that entry on the workstation. So the workstation’s registry always updates the key with
  *.sitename.com per the site that I have set in GP
• If I run GPUPDATE /FORCE over and over again, on the same machine, under the same user account, using the same DC I get:
  Failure, Failure, Failure, Success, Success, Success, Failure etc

I wasn’t able to determine any pattern to the failures, I tried stopping some of the processes on that machine but didn’t find anything that would make it fail/succeed reliably.
There is no AV or firewalls installed on my test machine

Anyone have any more ideas?  I think I might install filemon and try to capture some more data unless there’s a better tool?

• Edited by
  Simone_Bennett
  Tuesday, August 14, 2012 9:26 AM
• Proposed as answer by
  Jackson WU
  Friday, May 31, 2013 8:01 PM

Hi Josh,

So it’s applying but because there’s a * at the front I’ll intermittently get the error?

Yes, and that’s straight from my Microsoft TAM. As long as you include an asterisk inside those site-to-zone mappings, you’ll continue to see them. The key is whether or not they’re working. In my environment, I’ve seen complete success using the
http://*.domain.com, or
https://*.domain.com, no matter if the site is http://www.domain.com or
http://milk.does.a.body.good.domain.com. Despite the success, we continue to see the errors. It’s much the same as Group Policy Preferences where you can apply a setting once, or repeatedly. If you apply
something repeatedly and it’s already set, lookout for some complaints in the application log. It really is annoying. There’s potential to play with the logging levels, but I’ll admit that my experience ranks as «novice» in this specific section of group policy.
This link might get the creative juices flowing:
http://blogs.technet.com/b/askds/archive/2008/07/18/enabling-group-policy-preferences-debug-logging-using-the-rsat.aspx

I see you’ve already read a number of articles including «a test case for troubleshooting those event IDs»… I sympathize with your efforts. I despise warnings and errors that I can’t solve or don’t want to see, but I’ve researched a number of them to death
and found that many are simply «normal». Uggg… I hope this helps, but please take my advice, as with anyone else’s out here, with caution. I’ve seen some crazy recommendations. I saw a recommendation to install SQL on a DHCP server to get failover clustering
up and running. I hope the guy asking for help didn’t listen to that one! : ) — josh

And you are right — the rules are hardly documented Even MSDN has little information on it:
http://technet.microsoft.com/en-us/library/cc736412.aspx

Unfortunately that is right.
My experience is, that anything you can type in manually (in the Internet Explorer) will also work as site-to-zone policy.
But this is only the expirience I have made.
Maybe there are still some exceptions.

I thought I’d fixed this in my environment due to a typo. One of the entries only had one «/» after the colon in the URL.

The entries are in the format «http(s)://FQDN» or «http(s)://*.subdomain.domain.com»

With a gpupdate/force the policy was updated without the warning occurring. Great I thought.

However, the warning occurs at next user logon.

I have decided to test the method detailed in this link.

http://community.spiceworks.com/how_to/show/325-deploy-ie-trusted-sites-through-group-policy-2008

Update:

The warning Event ID 1085 for Internet znemapping has been resolved.

The warning Event ID 1085 I have now is for Folder Redirection which is a different problem.

So, it appears that the Internet zonemapping error has been resolved.

Haven’t tested the other method yet, but it will probably be the preferred method as it allows modifcation for trouble-shooting purposes.

• Edited by
  MAGordon
  Monday, January 07, 2013 1:53 PM

Hi, 

If applicable please check User Configuration — >> Administrative Templates — >> Internet

Explorer — > Internet Control Panel — >> Security Page—>>Site
to Zone Assignment list>>Click on Show. Remove invalid entries.

Hi,

I had this problem too. I solved it.

My problem was that Zone mappings were defined in two policy objects.

First in ‘Default Domain Policy’ and in another ‘Internet Explorer Settings GPO’.

Of course, I lived in belief that Zone mappings are defined only in the second GPO so I configured that GPO to deny apply policy to my test workstation. When I refreshed the policy and tested again, I received the same error message. I then moved on and
discovered zone mappings in default domain policy. The settings there had the same sites listed as the ‘Internet Explorer Settings GPO’, but the values were missing. The values should have been ‘1 — Intranet’, ‘2 — trusted’ etc. Anyways, I removed Zone mappings
settings completely from default domain policy and it worked. And I found a few trailing «/» and surplus entries, like *.site.com and
https://www.site.com I corrected them and it works again.

I was experiencing the same error and solved with a behavior similar to the one that Marvin has experienced:

my (wrong) wildcard was like *://*contoso.com

and once I fixed it like *://*.contoso.com all went fine: the dot before the domain name was missing

• Edited by
  Filippo Morosini
  Wednesday, April 03, 2013 1:34 PM

The causes for our errors were:

1. Trying to map a top level domain to trusted site.  AKA «*.mil» and «*.gov»

2. Trying to define an IP address range with «*».  10.* and 10.*.*.* do not work, but 10.0.0.0-10.255.255.255 does.

so my problem with internet explorer zonemapping settings might have its own log file

resolution:
by default ie11 need https. 
so i add :

I’ve always used *.domain.com without issue for all my Site to Zone Assignment List entries. I just added a new entry today and started getting this error during GPUPDATE.

I resolved my issue however. What happened was I failed to enter a zone value with the new entry I added today. It doesn’t require you to enter a zone number in the value field. After I removed the bad entry and added a new one with the zone value this time,
it stopped producing the error in GPU

Hi All,

Just wanted to add to this thread. If you are recieving the zonemapping error, chances are you have either incorrectly used wildcards (see Lurge reply for valid entries) OR you have made a typo.

I have almost 50 sites that I have set via zonemappings and after copying / pasting into notepad, and applying some patience whilst i reviewed the entries, I found a few missing /’s and .’s. Once the typos were corrected, my zonemapping issues went
away.

Good Luck!

— Scott

Interestingly, it seems that IE Zonemapping does not like too short domain names either. I got the 1085 error as well and found this thread.

I had no typos or misplaced wildcards but I did have a mapping of the domain lm.se that caused the 1085 error. As soon as I removed it the error went away. I know it doesn’t like top level domains like *.se for example. My guess is it interpreted the two-letter
domain as a top level one. You learn something new every day…

So if I dont want to use protocols http vs. https, and I need wildcards, the only proper way would be:
*://*.contoso.com

Right?

I tried *://*.contoso.com and *.contoso.com
and with both I end up with «

Windows failed to apply the Internet Explorer Zonemapping settings. Internet » event ID 1085

Any ideas? It seems that instructions with about zone site assignment varies within different IE version. We are running IE11.

• Edited by
  yannara
  25 minutes ago