This message was deleted.

Is the IE ESC configured? Check if

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IEHarden"=dword:00000000

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap]
"IEHarden"=dword:00000000

not set to 1.

Yes, I know that key, I already checked that. I should also mention, that this also happens on my Windows 10 Multi user environment on Azure, and afaik this ESC mode only exists on Windows Server, but it also happens on my Win 10 Citrix environment. I double checked that on the affected Windows Server 2019 environment, that's where the screenshot is from, and the key is set to 1! So where did I go wrong? These images are build my MDT and published via MCS. I must do something obvious wrong in parts of my managed environments, because it doesn't happen in all of the, The screenshots are from the same server.

are these settings enabled in more than 1 gpo? that could be the issue

Do you mean the Site to Zone Assignment List Policy?

Yep