Automatic P(r)oxy Script Issues

[abillybob]

Hi you wonderful people,

 

So we've been having this problem for way over a week and we've tried everything we can think of to sort it. It's quite a strange one.

 

We have an automatic proxy under http://wpad/wpad.dat that gives all the users around school the proxy details to connect to the internet. This has worked fine for year but for some strange reason it's just stopped working. What we can't understand is that the issue only effect IE if Chrome is opened it will connect to the internet fine.. but Chrome gets it's settings from IE, so it's quite confusing as to why it's not working properly. Though it gets even weirder... it's only effecting some users/computers others are working fine yet they all have the same GPO's applied so no differences.

 

We have been racking our brains about this for ages, we've tried manually inputting the address into a GPO and applying that so the computers know exactly where to go, that didn't work. We can also download the wpad.dat file by going to the address and the computers in question will ping the wdap address so it can see the settings.

 

Anything else to try? It's stressing the NM out quite a lot here but I don't know what else to possibly suggest?

 

Thanks

Edited April 20, 2016 by abillybob
Spelling Mistake... Apple Mac

[localzuk]

My first thought is that one of your DNS servers is blocking the wpad dns record (as it is blocked by default).

 

Can you run these commands on each of the DNS servers to see if wpad is listed?

 

dnscmd /info /enableglobalqueryblocklist

 

If it is enabled, then run this one:

dnscmd /info /globalqueryblocklist

 

Also, do you have the DHCP record in place too, for wpad.dat resolution?

[abillybob]

My first thought is that one of your DNS servers is blocking the wpad dns record (as it is blocked by default).

 

Can you run these commands on each of the DNS servers to see if wpad is listed?

 

dnscmd /info /enableglobalqueryblocklist

 

If it is enabled, then run this one:

dnscmd /info /globalqueryblocklist

 

Also, do you have the DHCP record in place too, for wpad.dat resolution?

 

I ran the first command and it gave me this result? Is that expected?

 

If so I'll do the other things you asked Thank for your help by the way!

 

[ATTACH=CONFIG]36337[/ATTACH]

 

Our other DNS server gives this result...

 

Edited April 20, 2016 by abillybob
Attached wrong file :(

[Steve21]

How are you deploying it? Via DNS/DHCP etc?

 

Do you have IE set to Auto Detect Settings?

 

Nothing changed on the server hosting the wpad file? Same MIME types etc deployed?

 

Proxy bypass for the wpad server all deployed?

 

Steve

[abillybob]

How are you deploying it? Via DNS/DHCP etc?

 

Do you have IE set to Auto Detect Settings?

 

Nothing changed on the server hosting the wpad file? Same MIME types etc deployed?

 

Proxy bypass for the wpad server all deployed?

 

Steve

 

I think we're deploying it via DNS. We have an entry in DNS called wpad. We have IE proxy settings ticked as automatically detect. Yes the bypass has been deployed fine and as far as I'm aware nothing has changed since the problem occurred.

[localzuk]

I ran the first command and it gave me this result? Is that expected?

 

If so I'll do the other things you asked Thank for your help by the way!

 

[ATTACH=CONFIG]36337[/ATTACH]

 

Our other DNS server gives this result...

 

[ATTACH=CONFIG]36338[/ATTACH]

 

OK, the first one confirms that the blocklist is enabled. The latter command of the 2 should then be run on each DNS server just to make sure "wpad" isn't in the list.

[abillybob]

@localzuk the other server gave a different result. Does this mean it's not enabled because it's 0?

 

I've tried the latter command on both and it just says:

String: isatap

 

on both servers

Edited April 20, 2016 by abillybob

[Steve21]

If you view the temporary internet files folder on one that's broken and one that works, have you checked what both have in regards to the WPAD file?

 

The other thing you might want to do is set the WpadOverride registry key, by default Windows 7 only checks for WPAD settings once and if it fails it doesn't bother again. (It might be that Chrome overrides this thus your comment). By setting it it makes it always recheck and not rely on the "last known"

 

 

Steve

[localzuk]

OK, so its enabled on one and disabled on the other. You don't have to worry about the one its disabled on (although that's a small security risk).

 

The one that fed back with it being Dword: 1, what does the second command I listed return?

[abillybob]

OK, so its enabled on one and disabled on the other. You don't have to worry about the one its disabled on (although that's a small security risk).

 

The one that fed back with it being Dword: 1, what does the second command I listed return?

 

Ah ok that makes sense. I have done the command on the DWORD 1 server and it just says:

String: isatap

[localzuk]

In that case, WPAD isn't being blocked by the blocklist.

 

One thing you could try is to install and run Fiddler2 on one of the afflicted machines (https://www.telerik.com/download/fiddler/fiddler2).

 

Then open IE and try and access a site, to see what actually happens. It'll give you a nice readout of the http requests, to see if IE is actually requesting the wpad.dat file or not, or if its asking for it and getting an error.

[abillybob]

If you view the temporary internet files folder on one that's broken and one that works, have you checked what both have in regards to the WPAD file?

 

The other thing you might want to do is set the WpadOverride registry key, by default Windows 7 only checks for WPAD settings once and if it fails it doesn't bother again. (It might be that Chrome overrides this thus your comment). By setting it it makes it always recheck and not rely on the "last known"

 

 

Steve

 

Oh ok thank you. I'll give that a go in regards to the registry edit as I didn't know it only checked once

 

I'm not sure about the temporary internet files and I'm not in a position yet to check but definitely will when I can!

[sparkeh]

If you view the temporary internet files folder on one that's broken and one that works, have you checked what both have in regards to the WPAD file?

Also delete the cached wpad file on the affected machines to force it to download a fresh copy.

[abillybob]

Thanks everybody for all your help. Will give it a go later and will report back once I know the outcome

[abillybob]

Tried and tested all of your suggestions but it hasn't fixed the problem ... any other suggestions?

[Steve21]

What was inside the WPAD files on the computers?

 

Steve

[abillybob]

The normal script. Everything looks normal... :/

[localzuk]

What did Fiddler2 log as happening when you opened IE and tried to access a website?

[abillybob]

What did Fiddler2 log as happening when you opened IE and tried to access a website?

 

This is the only thing I haven't tried as of yet. Going to give it a go with the Network Manager when he gets back, I'll report back here once we've done that.