GPO not working for IE9 proxy settings

[Duke5A]

Some background: Domain controllers are a mix of 2008 R2 and 2008, clients are Windows 7 Enterprise x32 /w SP1 and IE9. I'm having an incredible issue right now with proxy settings applying intermittently on student workstations. The proxy GPO was set using User Configuration>Windows Settings>Internet Explorer Maintenance>Connection/Proxy Settings. What will happen is out of a cart of 30 or so netbooks, 2/3rds of the students will fail to pull proxy settings. Looking at one of the afflicted machines shows the check box in IE not checked, and the proxy address field blank. If you run RSOP it shows that all the policies have successfully applied without error (no filtering, etc), and if you drill down back through User Configuration>Windows Settings>Internet Explorer Maintenance>Connection/Proxy Settings it's clearly there. IE is simply ignoring it, and with the randomness I don't know what to make of it. Has anyone else come across this issue?

[mthomas08]

I had this issue, 1st thing I spent ages trying to work out - Check each server has the same GPO settings.
In 2008R2 you can change the one you are viewing in Group Policy Management by right clicking on the FQDN.

I checked each one to find they wasnt syncronising with each other and like you it was being set randomly. I changed the way they syncronised - once I remember how I will post it.

[Duke5A]

Thanks for the reply, you got me thinking about replication as we have three domain controllers in our network. I verified the policy is successfully replicated across all three DCs by not only checking the settings in GPMC on each DC, I also checked the modified dates in the policy folder in each DCs sysvol share. Without a doubt it's the same. Next I looked at the student machines and noticed with gpresult that the ones with issues were applying their policies from DC02, while the ones that are working were pulling from DC01. RSOP on each student machine verifies that the correct proxy configuration is present in each machine, regardless of what DC it was pulled from. But I still have yet to find one instance where it is working when it was pulled from DC02, and one instance where it is not working where it was pulled from DC01. It's there, it's just not processing it. So following Google led me to a policy in the computer configuration that may help:

Computer Configuration>Administrative Templates>System>Group Policy>Internet Explorer Maintenance policy processing

Here you can set IE maintenance policies (which are the only policies that fail to apply) to run over slow links, and force them to process again even if the policy hasn't changed. I just set these options so now I need to see if they helped.

Fun times... I'll keep you posted.

[psydii]

How odd. It might be interesting to test latency between your client and dc2. There are hotfixes available from MS to address unexpected high latency in high bandwidth environments, though I've never seen them mentioned in the context of GPO processing issues.

Meanwhile are either of these helpful?

Internet Explorer Group Policy Preferences do not apply to Internet Explorer 9 in a Windows Server 2008 R2 domain environment
Internet Explorer Maintenance policies are not applied in preference mode