Web Proxy Settings via GP, not working

Forums › Microsoft Windows › Web Proxy Settings via GP, not working

pomtom44

128 posts

Master Geek

#255899 5-Sep-2019 12:10

Hi all

At work we have a group policy which changes the registry for the user when they log on to set the web proxy. We are changing our proxy over to a new one, which no longer needs the proxy setting enabled.

Im trying to figure out how the setup actually works because it's not doing what Im expecting it to do

I went to our AD and made a new policy which updates the registry to disable the proxy, added it to a new OU and logged in with a user in that OU.

However the user still has the proxy enabled, and auto-detect selected.

Iv tried a few things, and somewhere along the way i managed to get it to change the hostname of the proxy to its IP (auto discover I assume) but I dont know what did it.

I went to change the user back to the old policy to try reset the proxy, but now its stuck on the changed address.

I can see the policy being applied on the user when I run a gpresult, but when I check the registry, it appears the changes from the policy are either not taking place, or are being changed somewhere else that I dont know about.

Im wanting to start again and try figure this out, but I have no idea where to go and how to achieve what I want.

anyone have any input that can help me?
Hope my rambling makes sense to someone.

evilonenz

/dev/urandom
287 posts

Ultimate Geek

ID Verified

Trusted

Lifetime subscriber

#2311071 5-Sep-2019 12:13

Have you checked you're not using a WPAD file, via option 252 in DHCP? GP changing IE settings can often be a nightmare, but updating the registry entry should work.

I would also recommend trawling other group policy objects, and ensuring there isn't a double up of proxy elements in different GPOs. Group Policy Modelling and 'gpresult.exe' are your friend here, too.

Smokeping

Referral Links:

Quic - Use code R536299EPGOCN at checkout for free setup
Contact Energy - Use code FRTQDXB for $100 credit

Mighty Ape

Shop now on Mighty Ape (affiliate link).

pomtom44

128 posts

Master Geek

#2311073 5-Sep-2019 12:16

evilonenz:

Have you checked you're not using a WPAD file, via option 252 in DHCP? GP changing IE settings can often be a nightmare, but updating the registry entry should work.

I would also recommend trawling other group policy objects, and ensuring there isn't a double up of proxy elements in different GPOs. Group Policy Modelling and 'gpresult.exe' are your friend here, too.

we are running in a RDS environment, so DHCP isn't an issue here.

Iv scanned the gpresult export and can only see my policy that has any relation to proxy.

evilonenz

/dev/urandom
287 posts

Ultimate Geek

ID Verified

Trusted

Lifetime subscriber

#2311076 5-Sep-2019 12:20

Default WinHttp action is auto-detect proxy settings by running WPAD, from DHCP and/or DNS, and download the configuration. I would definitely look through your DHCP and DNS settings.

netsh winhttp show proxy

will be a good command for you, too, if it shows nothing, it'll more than likely be configuring automatically via wpad somewhere.

Smokeping

Referral Links:

Quic - Use code R536299EPGOCN at checkout for free setup
Contact Energy - Use code FRTQDXB for $100 credit

pomtom44

128 posts

Master Geek

#2311078 5-Sep-2019 12:24

evilonenz:

Default WinHttp action is auto-detect proxy settings by running WPAD, from DHCP and/or DNS, and download the configuration. I would definitely look through your DHCP and DNS settings.

netsh winhttp show proxy will be a good command for you, too, if it shows nothing, it'll more than likely be configuring automatically via wpad somewhere.

I know its not DHCP as we dont have it running for our core network (where the servers are located)
And I can't find anything in DNS about WPAD

Also the command comes back with "Blocked by group policy" which is why im having a hard time troubleshooting the issue

(Side note: Domain admins such as myself, dont have the proxy enabled, as we are not part of the policy group in AD, which is why im having to test on a standard users profile)