GPO

I recently had to investigate an issue with group policy where a GPO was not being applied when a user logged on, even though it was linked to the root OU (see below):

Root OU ---- Computer OU
      |----- User OU

Loopback processing was enabled on the Computer OU in merge mode.

To add a domain to an IE zone using GPO for all users on a computer without locking the settings, you can do the following:

Open the GPO that you are adding the setting to. The GPO needs to apply Machine Settings to the machines in question