2

We are using GPO to apply Site to Zone assignements for our users so that we can add some specific addresses into their Internet Explorer's Intranet and Trusted zones.

Using the Site to Zone GPO setting I have setup..

*.domain.com 1

The "domain.com" is our internal domain so I want anywebsite.domain.com to be treated as an intranet site to allow for SSO authentication to some of these websites that support it.

However this does not seem to work, adding *.domain in the local intranet zone prompts for a password when trying to hit websites that make use of SSO.

When I add the complete address of the internal site that prompts for a password "mywebsite.domain.com" to the local intranet zone then SSO works and the user is not prompted for a password.

I am trying to set this up so we don't always have to add websites into this GPO setting and wait for it to apply on client computers etc.. instead use *.domain.com to cover any subdomain.

Why can't we use wild cards in the site to zone assignment for local intranet or is my syntax incorrect?

To recap, a setting like this does not allow SSO:

*.domain.com 1

This works:

mywebsite.domain.com 1
support.domain.com 1

The number "1" is the zone assignment, in this case "Local Intranet Zone" in Internet Explorer.

Thanks.

  • Does it work if you use domain.com not *.domain.com? – Greg Askew May 07 '15 at 15:54
  • I have not tried, I figured it may need the wildcard to cover all sub-domains; will try this. –  May 07 '15 at 16:20
  • that did not work as well, changing *.domain.com to domain.com has no effect –  May 07 '15 at 16:49
  • Is the problem that the site is not showing in the Intranet zone, or that SSO is not working for that site when it is in the Intranet zone? – Greg Askew May 07 '15 at 16:50
  • did you add http:// or https:// in front of *.domain.com? Did IE recognize host.domain.com as intranet (in status bar)? – strongline May 07 '15 at 16:50

1 Answers1

2

Easy thing. Just say http://*.DOMAIN.COM 1

*.domain.com isnt enough

Cosmic542
  • 49
  • 2
  • this worked, added a record for http://*.domain.com, https://*.domain.com, and *.domain.com as local intranet zone (1), tested via IE and SSO works; now I can take out the mymanysubdomains.domain.com out of the GPO :) Thanks!! –  May 07 '15 at 19:13