[enderandrew]

I almost never touch GPO. I don't know where pretty much anything is in GPO. I often deplay Windows Server for small businesses here and there. 99% of the time, defaults in GPO are good enough for me and the small businesses I support.

However, I have a client that I just moved to a Windows Server 2008 domain from 2003 (SBS). Now they can't process checks on their bank's website (which uses an unsigned activex control of all things!)

If I log in as DOMAIN-NAME\administrator the site works fine. If I try to set the security settings to low for trusted sites, it doesn't keep, presumably because GPO is overriding it. I also get a message in the Internet Options dialog that the Administrator has disabled some settings.

The users are local admins on their boxes, so again, this must be a domain GPO. (Not to mention that we didn't change any software locally on the PCs. We're just now connected to a new domain).

I know this is probably simple if you know GPO, but I'm not sure where to look. Any help would be appreciated!

Thanks!