We are currently using the following Group Policy to control the Internet Explorer security zones:

User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page

Then setting the Site to Zone Assignment List with the various values using the following chart:

   Value    Setting
   ------------------------------
   0        My Computer
   1        Local Intranet Zone
   2        Trusted sites Zone
   3        Internet Zone
   4        Restricted Sites Zone

This works well; however, users are then unable to edit (or especially add) to their zone settings. Is there a way to lock in our custom zone settings while still giving users the ability to add their own sites to the security zones?

Yes, I do realize the slight security risk in opening this up.