Trusted Sites Not Displayed in GPO Editor on Windows Server 2025 (GPOADmin / GPMC) (4383678)

Administrators managing Group Policy Objects (GPOs) on Windows Server 2025 may observe that:

• Trusted Sites configured under:

  User Configuration / Computer Configuration  
  → Windows Settings  
  → Internet Explorer Maintenance / Internet Options  
  → Security Zones → Trusted Sites
  

  appear blank in the GPO editor

• However:

  • Running gpresult confirms that the Trusted Sites are applied correctly
  • Client machines (e.g., Windows Server 2019) receive and enforce the settings as expected
  • Newly added Trusted Sites may not appear visible in the legacy UI on Server 2025

This behavior may suggest that the GPO is not working correctly or that GPOADmin is not applying changes.

This is expected behavior on Windows Server 2025 and is not related to Quest GPOADmin.

Root Cause

• Microsoft has deprecated legacy Internet Explorer components in Windows Server 2025
• The GPMC (Group Policy Management Console) relies on these legacy components to render:
  • Internet Options UI
  • Security Zones / Trusted Sites configuration

As a result:

• The GPO editor UI no longer renders Trusted Sites correctly
• The settings still exist in the GPO as registry-based policy data
• The Group Policy engine continues to apply them correctly to clients

Important Clarification

• GPOADmin does not provide its own GPO editor
• It launches the native Microsoft GPMC
• Therefore, any UI rendering issue is controlled entirely by Microsoft’s OS and GPMC behavior

Behavior Differences by Server Type

The visibility of the Trusted Sites UI may vary depending on how Windows Server 2025 was deployed:

1. Clean Installation (Server 2025)

• Legacy Internet Explorer components fully removed
• Trusted Sites UI appears blank
• GPO still applies correctly

2. In-place Upgrade (2019 → 2022 → 2025)

• Some legacy components may persist
• Trusted Sites may still display
• Behavior is inconsistent and not guaranteed

3. Direct Upgrade (2019 → 2025)

• Mixed results depending on update path and features
• Partial or inconsistent UI rendering

Workarounds

Option 1 – Use Supported ADMX Policy (Recommended)

Migrate Trusted Sites configuration to the modern ADMX-based policy:

Computer Configuration  
→ Administrative Templates  
→ Windows Components  
→ Internet Explorer  
→ Internet Control Panel  
→ Security Page  
→ Site to Zone Assignment List

Benefits:

• Fully supported in all modern Windows versions
• Consistent behavior across environments
• Independent of legacy Internet Explorer components

Option 2 – Use Older Management Host

Manage these GPO settings from:

• Windows Server 2019
• Windows Server 2022
• Windows 10/11 with RSAT

These platforms still support the legacy UI and allow proper visibility/editing.

Verification Steps

To confirm that the policy is working correctly:

1. Run:

   gpresult /h report.html
   

2. Open the report and verify:

   • Trusted Sites entries are listed under applied GPOs

3. Check registry on client:

   HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap
   

Conclusion

• The issue is cosmetic/UI-related only
• GPOs are functioning correctly
• The behavior is due to Microsoft deprecating Internet Explorer components in Windows Server 2025
• GPOADmin is not involved in this limitation