Stephen- If you are using Admin. Templates IE zone policies then it wouldn't be a tattooing issue. I wonder if some loopback issues might be throwing things off. I presume you guys are using Loopback in a TS environment? Also, have you fired up userenv.log to see what it is saying for a given problem user? Darren From: gptalk-bounce@xxxxxxxxxxxxx [mailto:gptalk-bounce@xxxxxxxxxxxxx] On Behalf Of Stephen Barash Sent: Thursday, October 02, 2008 2:01 PM To: gptalk@xxxxxxxxxxxxx Subject: [gptalk] New to the list, vexing issue here... Hello folks, I've been trying to roll out Administrative Template IE7 Intranet security zone changes via group policy for a long time. Gpmodeling shows the changes for existing users. With gpresults, the changes are never picked up - gpupdate doesn't help. If I create a new user, the new user does pick up these changes. But no-go on the hundreds of existing users. This is a load balanced terminal server environment, with roaming profiles. I thought this may be a 'tatooing' issue, but tools like Clean Registry Policy Utility don't seem appropriate as user profiles are stored at a centralized location on a file server. Any suggestions? Especially for a way to propagate these changes en masse? Thanks! Stephen