Freshly installed server 2008 R2 with Remote Desktop Services (terminal services). This server is part of a domain controlled by SBS 2003. IE ESC is OFF for both users and administrators. Domain users, when they log on to the RDS server their internet options > security > Internet zone is marked as High and "Enable Protected Mode" is checked and all is greyed out. I modified the gpo settings for IE and set the internet zone level to "Medium". That had no effect. I removed all the IE settings in the gpo which had no affect. So I created a new OU and a new user assigned to that OU. There are zero gpo's applied. When the user logs on to the RDS the IE internet options > security > internet zone is the same as the domain users. If the users go the to Advanced tab and do the Reset, their internet options > security > internet zone is enabled and they can modify the settings. WHY?????? What am i missing????? I dont like that users have to reset the IE to default settings. I want complete control over their settings.

I found the answer in this thread.