There are two types of Internet Explorer Group Policy settings: the standard Windows registry settings and a collection of registry settings and files used to configure Internet Explorer. The standard settings are located in the Group Policy Object Editor under Administrative Templates\Windows Components\Internet Explorer, and the configuration settings are located in User Configuration\Windows Settings\Internet Explorer Maintenance.

The Internet Explorer Maintenance settings can be set in two modes: policy mode or preference mode. Policy mode is enforced and automatically resets any settings users might change (if they have the appropriate permissions) when Group Policy is applied.

Note: Like all registry-based Group Policy settings, Internet Explorer Maintenance policy mode settings reapply only when the GPO changes. Unlike most registry-based Group Policy settings, configuring an Internet Explorer Maintenance setting does not prevent the user from changing that setting.

Preference mode sets initial default values that the user can change, subject to other Group Policy settings that affect the user. The preference settings are only applied again when the administrator makes changes to the preference settings. To allow users to change these preferences, they must be able to access Internet Options on the Tools menu. You allow users access by configuring settings in the Group Policy Object Editor under Computer (or User) Configuration\Administrative Templates\Windows Components\Internet Explorer.

You cannot use policy and preference modes together in a single GPO. If you need both modes, you must use two separate GPOs. The included scenarios are configured using policy mode, so you might need to create an additional GPO using preference mode for your environment.