No Frank, you got it wrong. The settings are ok and they are the same for all
users (that's why we are using HKLM and security_hkml_only) until a new user
with local admin rights logon for the first tame and settings in HKLM for
zones 2 and 3 get reset to defaults (from TemplatePolicies values). It seems
that when a local profile get creates, an internet profile get created too
and since we are using Security_HKLM_ONly ant the user have admin rights the
settings for IE get reset in HKLM insted in HKU. We do not want the IE
settings in HKLM to get change ever.

"Frank Saunders, MS-MVP OE/WM" wrote:

> If I understand, you change the settings and they work until you reboot,
> when they revert to what they were. Something is preventing your change
> from actually writing to the Registry.
>
> Did you try it in Safe Mode?
>
> "dekac99" <dekac99@discussions.microsoft.com> wrote in message
> news:73C4FE4E-C8DC-4116-8590-BA113B884D72@microsoft.com...
> > The issue is that the settings get changed, not that they cannot be
> > changed.
> > We do not want the original custom HKLM registry settings on a client PC
> > to
> > change when an admin logon to the Client PC for the first time. Any ideas?
> > Thanks.
> >
> > "Frank Saunders, MS-MVP OE/WM" wrote:
> >
> >> "dekac99" <dekac99@discussions.microsoft.com> wrote in message
> >> news:90A8A558-DBB4-455E-A40E-0160BA0AFB42@microsoft.com...
> >> > OS: Vista Enterprise/Business
> >> > The IE7 Zone Security Settings are set by editing registry values in
> >> > HKLM\Software\Microsoft\Windows\CurrentVersion\Int ernet
> >> > Settings\Zones\,
> >> > and
> >> > Security_HKLM_only is set to 1. When a user, who has local admin
> >> > rights,
> >> > logs
> >> > on for the first time the HKLM\..\Zones\ values for the security zone 2
> >> > (Trusted Site) and 3 (Internet) get reset to values defined under
> >> > HKLM\...\TemplatePolicies. This changes only happen for the first logon
> >> > and
> >> > when Security_HKLM_only=1. Is there any way to stop this changes from
> >> > happening?
> >>
> >> It might be a security program blocking the Registry change it needs to
> >> make. A few, but not all, of the programs now doing this are:
> >> Ad-aware's Ad-Watch
> >> IBM Access Connections
> >> McAfee VirusScan and/or Antispyware
> >> Norton AV
> >> Spyware Blaster
> >> Spybot> Tools> IE Tweaks
> >> Spybot- Teatimer
> >> Spysweeper
> >> Spyware Doctor
> >> Windows Defender
> >> Zone Alarm (free) 6.5 Reported to be fixed in later versions.
> >>
> >> In the case of Zone Alarm 6.5 or Norton 2007 it actually has to be
> >> uninstalled. Make sure the Windows Firewall is turned on until you
> >> reinstall Zone Alarm.
> >>
> >> Boot into Safe Mode with Networking and try the change.
>