Medium IE Security through Group Policy for QuickBooks 2018 Desktop on Windows 2016 Server on AWS EC2

Regarding error message, "Internet Security Levels Are Set Too High," in QuickBooks Desktop 2018, running on Win Server 2018 on AWS EC2, how can IE be made compatible?

[ Intuit erased my 25-Nov-2017 post on their forum. Thanks to google cache, I am reposting my original question plus a summary of my resolution here ]

The advice on https://community.intuit.com/questions/1637443 does not help.

On my system, the IE feature for changing the security level to "Medium" is greyed out - disabled - not available for use.

I have TLS 1.2 checked under Advanced Security in the IE Options.  I have added https://*.intuit.com and https://*.quickbooks.com to the list of Trusted Sites. 

Unfortunately for its own help pages, QB wants to display content from intu-help-qb11://  and there is no obvious way to add that address to the list of trusted sites in IE because the prefix is not recognized as a valid protocol.

Please note that this error happens when connected over Remote Desktop regardless of whether the user is part of the Administrators group or not.

Solution

The solution involves using gpedit.msc, being willing to click away two dialog boxes every single time QB starts, and ignoring a misleading dialog within IE Options.  

This solution works on a Windows Server 2016 machine running in AWS EC2 on a t2.micro instance.  It may work on other types of networks where the security level has been locked down to High (as it should be, Intuit !! ).

When the IE security level feature is disabled for the Internet zone, i.e. you cannot change it the way that QB expects you to, what you do is run gpedit.msc and navigate to the path shown in the screenshot below. 

Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Security Page. 

There you can Enable the "Locked-Down Internet Zone Template" and set it to MEDIUM, and also enable the "Internet Zone Template" and also set it to MEDIUM. 

After changing these settings, Reboot.

Annoying: Dismiss 2 Dialogs on QB Startup

The first dialog to Cancel is pretty obvious.  It is the first dialog displaying the now-erroneous error message, where Intuit wants you to click the pretty blue [Make Changes] button, which you have of course tried many times and it had never worked.  That is why you are here reading this post!  So -- stop the madness -- and instead press [Cancel]. 

Sadly that leads to the 2nd dialog where you must confirm your decision...  at least you can press a blue button now, Yes!

IE Options "overridden by administrator policy"

When you have security options set by Group Policy (gpedit.msc), the Microsoft Internet Explorer Options dialog will NEVER accurately represent what has been done by group policy.  The dialog will remain disabled, and it will have a little message at the bottom to say that there is an admin override.  Microsoft will probably never change this.  Accept it and move on.

Credit: This excellent Q and A post is where I figured this out.

QuickBooks will Never Understand, unless..

Unless thousands of QuickBooks users tell Intuit that this is happening to them, they will never fix this.  (Look, same frustration was happening in year 2012. ) 

Go onto the the QuickBooks Help menu and use the feedback feature to report this issue as a Bug or a Suggestion.  Explain exactly how Windows is loaded (network or whatever) because they need to reproduce the problem to fix it properly.

My recommendation is that you stay clear of the QuickBooks phone support line if you have the above situation and understand what is written here.  I spent an hour on the phone with them.  The net result was that they had no idea how to tell whether QuickBooks was fully able to use IE, they just assume it is broken when the dialogs show up.  They just said, report it through the feedback system and do not expect action from an engineer anytime soon.  

And do not even think of using Intuit Live Chat because they will just make you wait on hold and then tell you to call the Technical Support number, where you will also wait...

QB has enough power over IE if ...

As far as I can tell, if you can see the home screen, can upgrade QuickBooks itself, and you can see QB help file entries, then IE security is low enough to keep QB happy.

Good luck.