Idiots guide / Proxies / ie10 +

[Tesla]

I know this has been brought up before. But i could do with a fresh start on the topic

 

What do you guys use now instead of internet explorer maintenance? Using Server 2008r2

 

I haven't really ever messed with group policy/adding templates etc (unless they are already there and its just a case of changing a few settings)

 

any help appreciated....any...

[localzuk]

We switched to using a WPAD.dat file, published using option 252 over DHCP. IE10 wasn't the reason though to be honest, it was done to simplify web access across the site, with the various different devices now connecting up.

[Vasriel]

We are still using a GPO that adds the proxy information to the registry

[Tesla]

cheer , will investigate

 

(This post did the update thing again *sigh*)

[Gaz]

An extreme method thats not often considered because it involves reinstalling IE, is to use the Internet Explorer Administration Kit and then put the proxy info into that and then deploy it.

Internet Explorer Administration Kit

[edutech4schools]

We are still using a GPO that adds the proxy information to the registry

 

We do the same

[Tesla]

@localzuk , are you able to elaborate on using proxy pacs at all?

[zag]

We're using the proxy registry "hack" as well.

[localzuk]

Basically, you create a proxy pac file which lists the proxy server to go to for sites, along with any exclusion rules or whatever else you want to include, like so (A very simple one to start with):

 

function FindProxyForURL(url, host){
var proxy_no = "DIRECT";

if (shExpMatch(url, "http://helpdesk/*")) { return proxy_no; }
if (shExpMatch(url, "http://helpdesk")) { return proxy_no; }
   
return "PROXY lincache.sch4290.somerset.gov.uk:8080";
}

 

Save that as "wpad.dat" and host it on a web server of some form. On that webserver, you need to make sure you have the right mime type set up:

 

For apache:

[color=#000000]AddType application/x-ns-proxy-autoconfig .pac
[/color][color=#000000]AddType application/x-ns-proxy-autoconfig .dat[/color]

For IIS (on Windows 2012 Server, adjust according to the version you run):

 

1. In IIS Manager, click on your Server, and open MIME Types.

2. Add a new one - Extension: .dat MIME Type: application/x-ns-proxy-autoconfig

3. Add a second one - Extension: .pac MIME Type: application/x-ns-proxy-autoconfig

 

In DNS, set up a record "wpad" which points at that server.

 

Put the wpad.dat file at the top level of the webserver, so it is accessible via http://wpad.domain/wpad.dat.

 

In DHCP server (Windows 2012 again, as that's what I've got in front of me):

 

1. Right click on IPv4 and click "Set Predefined Options".

2. Click Add

3. Name: WPAD, Data Type: String, Code: 252, Description: WPAD Auto Config String

4. Click OK

 

Now, to set up the server options:

 

1. Right click on Server Options

2. Scroll down to option 252, and tick the box

3. Enter http://wpad.domain/wpad.dat into the box. (.domain should be your domain name)

 

By default, clients should have "Automatically detect settings" ticked in Internet Options.

 

Internet Explorer and Chrome will use the DHCP option, Firefox will use the DNS option. Other devices might use one or the other - it varies.

 

Basically, with that in place, you should never have to fiddle with proxy settings on any clients, and will only need to edit that one file to make changes to the proxy rules.

 

[Michael]

The GPP is relatively easy to introduce, but you can also specify different proxy configurations for your users (if necessary). Of course the advantage is you can instantly change proxy settings, just as easily as a native GPO itself. You can also (if required) use the same technique to switch off proxy settings altogether (if you introduced a transparent proxy). There are lots of possibilities.

[free780]

Windows 8 VM, GPP. Make sure you press F5 to make the squiggly lines green. It works.

[Tesla]

@Michael

 

excuse me for asking, but what is the key path that gets set via those pictures in the help you gave... im setting up the new registry and it's blank..

[Michael]

@Michael

 

excuse me for asking, but what is the key path that gets set via those pictures in the help you gave... im setting up the new registry and it's blank..

 

It's:

 

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings

 

All entries are in here.

[Tesla]

thanks a lot, will hopefully be testing this afternoon... i have never really had to create gpos before and dont want to mess it up, especially registry!

[Gaz]

As "Automatically detect settings" Is ticked by default what registry key unticks that box?

[Michael]

As "Automatically detect settings" Is ticked by default what registry key unticks that box?

 

Not sure, but if it's enabled by default I suggest you leave it. It won't make any difference to you applying proxy settings via GPP for example.

[Gaz]

I thought that if that box was ticked and the proxy info was entered that the two settings would conflict. Naturally if it says "Automatically detect settings" and the proxy info is the common sense would say that it would detect and use the proxy info but we are talking about Microsoft here.

 

When I first setup Smoothwall on our network with the help of Smoothwall support I was told to make sure that the "Auto detect" was unticked.

Edited March 26, 2014 by Gaz

[localzuk]

The automatic detection will only conflict if it has something to detect in the first place. However, it can slow down initial browser opening, as it tries to detect but fails.

[Tesla]

my pc has it ticked, as do others in the network, never had a conflict with it.

[Michael]

I thought that if that box was ticked and the proxy info was entered that the two settings would conflict. Naturally if it says "Automatically detect settings" and the proxy info is the common sense would say that it would detect and use the proxy info but we are talking about Microsoft here.

 

When I first setup Smoothwall on our network with the help of Smoothwall support I was told to make sure that the "Auto detect" was unticked.

 

First thing I'd advise to check whether there is an existing GPO that can do this. I know you can via GPP, but it's generally unreliable - hence the need for a GPP regedit. If there is a GPO, it should be easy enough to Google what the registry entry it changes/updates.

[Gaz]

Its not an issue for me, I was just following the thread and wanted to ask a question. I looked at the reg settings out of interest and wondered how "Automatically detect settings" box was unticked, but it appears it doesn't make a difference from everyones reports. Edited March 26, 2014 by Gaz
Spelling

[Tesla]

tested it today.. it wokrs for windows 7, doesn't seem to work for xp, any ideas?? (yes we still have some xp but we simply haven't had the budget to replace all of them)

[Michael]

Check whether your XP workstations have the GPP client extensions update installed.

 

GPP's will then work for XP as they do for Vista or later out the box. If required, you can deploy this update using WSUS.

[eshaq786]

I've gone down the WPAD route. So much easier for everyone. Worth the time and effort to get up and running.

[Trapper]

Re the wpad/PAC route:

 

How do clients access this from offsite? For example I add a line that for home router IP ranges it forces direct connection so staff don't need to turn it off.

 

Does the client system "cache" a copy of the wpad/PAC file or does the we server it's hosted on need to be publicly accessible?