Not Applying Proxy GPO on Laptops not connected to network

[Jamie_a]

We apply a proxy via a gpo when our computers are on site but apparantly the gpo is still applied offsite so users cant get on the net from home, can we stop the gpo being applied when not connected to the school network.

[plexer]

It's not that the policy is still being applied when not connected it's that it's is still applied if that makes sense.

 

There is nothing to apply new policies once they are not connected.

 

You could allow users access to the proxy settings.

 

Use a vbscript to change the proxy setting.

 

Use an alternative browser for home use i.e firefox.

 

Ben

[witch]

There is a nifty little thing called 'proxy pal' which is a free download.

It puts an icon on the toolbar (well, you have to go to customise and add it).

The teachers use this to toggle the proxy on and off depending if they are at home or school

It works a treat for us in both schools I work for

The only ones it doesnt work for are those whose home connection use a proxy as well

Hope this helps

[Oops_my_bad]

If you have a webserver on site (maybe an IIS or apache box) you can configure a proxy.pac file to configure the laptops proxy settings.

 

Offsite the setting remains but because it can't find the .pac file it "failsover" automatically to your normal connection - I think even teachers can just about handle that

 

Have a look at this thread.

[Michael]

I had the same problem, so I created a logoff script

 

@ECHO OFF
regedit /S \\servername\netlogon\DisableProxy.reg

 

Name this file "DisableProxy.bat" for example and place as a logoff script for your users in AD.

 

Create a reg file (in this case called DisableProxy.reg) and place in the NETLOGON share.

 

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]
"ProxyEnable"=dword:00000000

 

Now this will work providing that the following policy is NOT enabled:

 

User Config > Admin Templates > Win Components > Internet Explorer

 

Disable changing proxy settings - Set to not configured or disabled

 

And of course make sure that proxy settings have been specified in AD within - User Config > Win Settings > IE Maintenance > Connection > Proxy Settings

 

What will then happen is when a user logs on, the policy applies the proxy settings as normal, but when a user logs off or shutdown their PC, proxy settings are turned off, so when they go home (for example), they connect instantly to their DSL at home. When they come back to school and logon, the policy re-applies proxy settings.

 

The great about this solution is it requires no human intervention and is completely automatic

[chrbb]

I found an autoit script on here somewhere that I just put on the users desktop, one for home - one for school.

[Newton]

At one point I required a similar solution, the best one I found was to a use

DHCP option to tell the client PC to look for a proxy config script for the proxy information.

 

I only designed the above and never actually tried or can remember the DCHP option to set, but google should resolve that.

 

The best thing was when on site the DHCP did all the settings and when at home the users router did all the config. not need for log on or off scripts.

[tom_newton]

To respond to the guy with half my name

 

It's DHCP option 252... works ok with IE, there's a few security issues (rogue dhcp server could redirect browsers for example) but they are not that serious.

 

Look up "WPAD".

[R.M.B]

We no longer have this problem...

 

All our laptops have a PAC file defined as the source of their proxy settings.

 

In the pac file, I have specified that it test the ip range of its own address - if it is in the range that we use in school - we use the school proxy

 

Otherwise it is set to direct.

 

This works for the laptop I am currently using, and for all the staff laptops we maintain.

 

I am still waiting for someone to turn up wanting a third option - a proxy at home, another school or whatever....

 

Sine the laptops are in an OU in school, I have set it up so that the pac file can be updated when they connect to school - not yet needed, but just in case!