script to set proxy server

[itgeek]

Hi

 

We have laptops that are used in school and at home. I would like a method to set the proxy server when in school and automatic when at home. What would the best method to do this.

 

Thanks in advance

[snagrat]

We use 2 batch files that enables/disables the proxy registry key and then starts IE.

 

Then we just put 2 shortcuts on the desktop - Internet @ Home and Internet @ School.

 

Pretty straight forward for the teachers.

[jamesfed]

Take a look at WPAD - Web Proxy Autodiscovery Protocol - Wikipedia, the free encyclopedia

 

The basic idea is when your users connect to a network (be it inside or outside the school) the browser reaches out and looks for a wpad file - if it finds it the proxy settings from that file are used, if it doesn't find it then it makes a straight out connection to the internet (i.e. when at home).

 

Easy enough to setup so long as you can spin up an internal web server and have control over your DHCP/DNS and best of all - totally transparent to your users!

[Arthur]

What would the best method to do this.

James is right. WPAD is definitely the way to go.

[free780]

Wpad is quite insecure. You have to hav a dns entry called wpad. A malicious hosts file could point the laptop to another proxy.

[mac_shinobi]

Does WPad use a pac file or could you not create a pac file to suit and use gpo or gpp to assign the pac file path to IE ??

[Arthur]

A malicious hosts file could point the laptop to another proxy.

Hosts file - as in C:\Windows\System32\drivers\etc\hosts?

 

Standard users wouldn't be able to make any changes to that.

[smidsy]

We have wpad set up here and it works flawlessly for staff and students. It uses the Proxy.pac file hosted on our smoothwall server but have had a version hosted on a web server pointing to an external proxy when we experiencing internet issues.

[free780]

Ive seen cases of malware being able to write to the windows folders. Even through a standard user account.

[Arthur]

I've seen cases of malware being able to write to the windows folders. Even through a standard user account.

If the computer is infected with malware, then the hosts file is the least of your problems. The malware could do literally anything!

[bslater]

Hi I use a simple VBScript in the startup folder. Asks the user if they are in school, if so loads proxy settings, otherwise removes proxy settings.

Paste into notepad, alter 000.000.000.000:8080 to your Proxy settings and port, save as .vbs

It's almost teacher proof.

 

Option Explicit

Dim valUserIn

Dim objShell, RegLocate, RegLocate1

Set objShell = WScript.CreateObject("WScript.Shell")

On Error Resume Next

valUserIn = MsgBox("Use the SCHOOL settings?",4,"Cloaked Select")

If valUserIn=vbYes Then

RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer"

objShell.RegWrite RegLocate,"http://000.000.000.000:8080","REG_SZ"

RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable"

objShell.RegWrite RegLocate,"1","REG_DWORD"

MsgBox "SCHOOL setting is Enabled"

else

RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer"

objShell.RegWrite RegLocate,"0.0.0.0:80","REG_SZ"

RegLocate = "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable"

objShell.RegWrite RegLocate,"0","REG_DWORD"

MsgBox "HOME setting is Enabled"

End If

WScript.Quit

[LeMarchand]

I looked at WPAD but never got it working. Cheated by writing a .pac file and copying it to a local directory with a startup script and set the appropriate GPO to point IE at it. The .pac file enumerated various sites to bypass the proxy and then checked the machine's IP address/range and only applied the proxy if the machine was at school - so no user intervention required.

[Synkrox]

I used proxyswitcher lite, then its just a right click in the system tray - but a WPAD kinda setup is better. Or transparent gateway even better!

Chris

[localzuk]

Wpad is quite insecure. You have to hav a dns entry called wpad. A malicious hosts file could point the laptop to another proxy.

 

No you don't. You can define your WPAD location via a DHCP entry (Option 252). Then it can be at any IP address and path that you want. Ours is hosted by our Ruckus wireless controller, for example.

[sparkeh]

Might be worth reading up on wpad security

https://en.wikipedia.org/wiki/Web_Proxy_Autodiscovery_Protocol#Security

WPAD Man in the Middle - NETRESEC Blog

[Manny-Tech]

I personally use a PAC file. Specify our local network, if you're not on it then straight out to the Internet. You just need to store the PAC file somewhere on the user's laptop (We have a C:\Support folder) and then use a GPO to set the path.