Strangely, when you edit certain sections within IE Maintenance policy, the GP editor calls the live dialogs on your local machine. This typically occurs in areas within IE Maintenance where you can import settings, such as the Security zones section and Connection Settings section. If you edit these areas, you are actually editing the configuration of IE on the machine where you're doing the editing. This can be somewhat disconcerting! After importing the settings into the policy, you'll need to go back--outside of the GP editor, and change them back to the settings you need.

Put simply, when you set IE Maintenance Policy in preference mode, you aren't really enforcing the policy, but rather, setting it once, and then leaving it up to the user whether or not they wish to change that policy. For example, if you set a proxy server address within IE using preference mode, you are setting the proxy address the first time the user processes that policy but then letting them change it without the policy being reinforced at the next processing interval. Its like saying, "I'd like to you have this policy setting, but you're free to change it if you'd like."

This is a known issue in IE Maintenance policy where it sometimes does not correctly read that the policy has changed, and therefore, does not properly apply the policy. The workaround for this is to enable the following administrative template policy for all computers that you wish to enforce IE maintenance policy against: Computer Configuration\Administrative Templates\System\Group Policy\IE Maintenance Policy Processing\Process even if the Group Policy Objects have not changed.

Absolutely, by default, the file brndlog.txt is created in the logged on user's profile, under Application Data\Microsoft\Internet Explorer. This file stores information about IE Maintenance processing. This folder also stores the cached IE maintenance policy settings that are downloaded from SYSVOL at GP processing time.