Windows failed to apply the Internet Explorer Zonemapping settings - the data was invald (event ID: 1085)

Question

Hi All,
I have a large domain and a long list of websites that are trusted using the following group policy setting:
Administrative Templates > Windows Components > Internet Explorer> Internet Control Panel > Security Page >
Site to Zone Assignment List
On all (XP/vista/win7) workstations across the domain I'm getting the following error:
Log Name:  System
Source:  Microsoft-Windows-GroupPolicy
Event ID: 1085
Task Category: None
Level: Warning
Keywords:   Description: Windows failed to apply the Internet Explorer Zonemapping settings. Internet Explorer Zonemapping settings might have its own log file.
There's nothing either side of this error in the log that shines any more light on the issue.
I know which group policy object its applying these settings but cant find which of the entries in the site to zone assignment list is causing this issue. I looked in the
Group Policy/Operational log but all I see is the following entry which says "completed" but is logged as an error:
After some research I'm guessing that the issue is an incorrect wild-card. This is what my trusted sites list looks like (with names removed of course):
http://servername.*  
*.internaldomain.com.au  
*.domain.com.au  
*.domain.*  
*.externaldomain.com  
*.domain.inernaldomain.com.au  
*.domain.*  
*.domain/name.*  
*.domain.inernaldomain.au*  
*.domain.com
Is there something obviously incorrect here?
Does anyone know where I could find an article that clearly outlines the acceptable wildcard syntax for the
"Security page\ site to zone assignment list" group policy?  Ive read every forum post, website and blog I could find on the internet but nothing is clear and I wasn't able to find an MS document that steps it out. I've also changed the
existing list a number of times based on blog posts etc but had no luck.
**Please Note**
I dont want to change to a different method or have an intellectual debate re why I would have these sites/wildacrd/policy set. I'm really looking to see what entry is invalid and where the documentation is for this policy setting so i can make sure they are
always correct in the future. 
thanks in advance for your time and assistance
Simone
PS: I've already read the following posts a number of times:
I get no data but have identified the GP that is causing the issue:
A test case for troubleshooting group policy application – Event ID 1085 and 7016 - http://blogs.technet.com/b/askds/archive/2008/08/21/a-test-case-for-troubleshooting-group-policy-application-event-id-1085-and-7016.aspx 
I dont have any 2 letter domain names:
Problems Adding Top-Level Domains to Zone Sites List - http://support.microsoft.com/kb/259493
I tried formatting the list per this article:
[Solved] The Group Policy client-side extension Internet Explorer Zonemapping failed to execute  - http://daily-it.blogspot.com.au/2008/09/solved-group-policy-client-side.html
Has no domain wildcard format info:
Behavior of Site to Zone Assignment List  - http://blogcastrepository.com/blogs/mattbro/archive/2006/09/07/2183.aspx
Great article, no wildcard data:
Internet Explorer Policy Settings  - http://technet.microsoft.com/en-us/library/bb457144.aspx
Internet zonemapping problem: http://social.technet.microsoft.com/Forums/en-US/winserverGP/thread/a8756a27-b562-42ad-8782-87d284e6bcfb/
Spiceworks Event 1085 (Warning) - http://community.spiceworks.com/windows_event/show/1582-microsoft-windows-grouppolicy-1085
Event ID 1085 — Application of Group Policy - http://technet.microsoft.com/en-us/library/cc727303%28v=ws.10%29.aspx
Application of group policy - http://technet.microsoft.com/en-us/library/cc727312%28v=ws.10%29.aspx
Evt ID 1085 GP client-side extension IE ZoneMapping failed to exec  - http://www.winvistatips.com/evt-id-1085-gp-client-side-extension-ie-zonemapping-failed-exec-t706399.html
Event 1085 - Internet Explorer Zonemapping - http://www.minasi.com/forum/topic.asp?TOPIC_ID=29206
EventID.net - http://www.eventid.net/display.asp?eventid=1085&eventno=1412&source=Userenv&phase=1
Event ID 1085 - Internet Explorer Zonemapping failed to execute - http://www.experts-exchange.com/OS/Microsoft_Operating_Systems/Server/2003_Server/Q_24897522.html
UPDATE:
I disabled the original policy and created a new one with only one trusted site address in it. Then I logged into a clean test machine did some testing.What I found after a few hours of testing was; regardless of the site that I have listed in group policy
The HKCU\Software\Policies\Microsoft\Current version\Internet Settings\Zone Map Key registry entry is
always updated with that entry on the workstation. So the workstation's registry always updates the key with
*.sitename.com per the site that I have set in GP
If I run GPUPDATE /FORCE over and over again, on the same machine, under the same user account, using the same DC I get:
Failure, Failure, Failure, Success, Success, Success, Failure etc
I wasn't able to determine any pattern to the failures, I tried stopping some of the processes on that machine but didn't find anything that would make it fail/succeed reliably.
There is no AV or firewalls installed on my test machine
Anyone have any more ideas?  I think I might install filemon and try to capture some more data unless there's a better tool?

Answer 1

Yes, and that's straight from my Microsoft TAM. As long as you include an asterisk inside those site-to-zone mappings, you'll continue to see them. The key is whether or not they're working. In my environment, I've seen complete success using the
http://*.domain.com, or
https://*.domain.com, no matter if the site is http://www.domain.com or
http://milk.does.a.body.good.domain.com. Despite the success, we continue to see the errors. It's much the same as Group Policy Preferences where you can apply a setting once, or repeatedly. If you apply
something repeatedly and it's already set, lookout for some complaints in the application log. It really is annoying. There's potential to play with the logging levels, but I'll admit that my experience ranks as "novice" in this specific section of group policy.
This link might get the creative juices flowing:
http://blogs.technet.com/b/askds/archive/2008/07/18/enabling-group-policy-preferences-debug-logging-using-the-rsat.aspx
I see you've already read a number of articles including "a test case for troubleshooting those event IDs"... I sympathize with your efforts. I despise warnings and errors that I can't solve or don't want to see, but I've researched a number of them to death
and found that many are simply "normal". Uggg... I hope this helps, but please take my advice, as with anyone else's out here, with caution. I've seen some crazy recommendations. I saw a recommendation to install SQL on a DHCP server to get failover clustering
up and running. I hope the guy asking for help didn't listen to that one! : ) - josh