According to this article, for all versions prior to Internet Explorer 11, it should be possible to use the HKLM hive to set Intranet/Trusted Sites zone assigments, noting:
- they will not be visible from within the UI
- HKCU + HKLM settings are additive so you have to take care to make sure the same site isn't in two zone mappings.
My testing on Internet Explorer 11 - Windows 10 (1610 + Creators Update), suggests that the HKLM hive is ignored, and these settings only work under HKCU.
Here's an example that doesn't work, this should set google.com as a Trusted Site:
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\domains\google.com] "https"=dword:00000002
.. and here's the same thing under HKCU that does:
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\domains\google.com] "https"=dword:00000002
I've been unable to find any updated documentation that confirms this behaviour, or provides an alternative approach to setting zone assignments at a machine level.
Plainly, I could use group policy, preference, or a login script, but I was hoping to be able to avoid these as they don't suit the scenario I'm working within.