cheaptonersucks Posted October 5, 2016 Posted October 5, 2016 Hi Everyone, This is my first post, but won't be my last as I have "inherited" a network that has been tinkered with by several "managed" IT service providers over the years. The school ordered a new 100 MB lease line and I changed the default gateway in DHCP for the new router so the machines can see the new gateway. The problem is that the proxy settings in IE are being pushed from somewhere and I can't find where they are being pushed from. I looked in the Group Policy management console and there are not only huge amounts of GPO's, but more confusingly there are several peviously created group policies named "proxy settings"!! I have run a gpresult and the only policies that are apparently being applied, are the default domain policy and the student desktop policy. I checked the default domain policy and nothing appears to be set for current proxy settings, as nothing appears to be set in the Internet options area of the default domain policy. I have checked all the other Proxy settings policies, and I can't see any GPOs that include the currently applied proxy settings? I ran group policy modelling against one of the student AD accounts, which also stated that the only policies that are applying are the default domain policy and the student desktop policy. I am new to group policy and have no experience in this area, so am hoping someone can help me to resolve this annoying issue. I am able to uncheck the proxy settings when a student is logged in, but I can't possibly do this for every student and member of staff in the school. I am not sure how the current proxy settings were set by the previous managed IT provider, as when I uncheck the proxy settings whilst logged in as a student and run a gpupdate /force then reboot the machine, the proxy settings are still unchecked?? So the policy that originally set the current proxy settings doesn't appear to work now.. I need to resolve this asap, as the students can't access the Internet with the proxy settings set,as there is now a transparent filtering that doesn't require proxy settings in IE. The server OS is 2012R2 and the machines are running 7 enterprise. Can anyone offer a speedy resolution please? Thanks
rrrrr Posted October 5, 2016 Posted October 5, 2016 Have you looked at rsop to see where the setting is coming from? Double check any logon scripts too 1
cheaptonersucks Posted October 5, 2016 Author Posted October 5, 2016 Thanks for replying to my post so promptly. As I am new to GP and this area in general, where do I run rsop please? Do I run rsop on any of the machines on the network? Does is matter which AD account is logged in when I run rsop? Where do I find or check if there are any logon scripts please? Thanks.
rrrrr Posted October 5, 2016 Posted October 5, 2016 Login to an affected pc. May have to login as admin as user probably wont have privs. Start > run > mmc Add resultant set of policy snapin Right click and generate data Follow wizard and in user window select an affected user account, follow through and once generated find the proxy settings. In the rsop data, there should we login scripts too. Also, check user account in ad for logon script 1
cheaptonersucks Posted October 5, 2016 Author Posted October 5, 2016 Thanks for the instructions. I will run the rsop on one of the domain machines. Sorry to ask more questions, but where do I check if there are any logon scripts linked to one of the affected AD accounts please? I did run the group policy modelling wizard on one the the affected AD accounts, but the only policies that showed up were the default domain policy and a student desktop policy. The odd thing is that when I unchecked the proxy settings and then logged in with my admin account, then ran a gpupdate, the proxy settings weren't checked again. That makes me wonder if the policy is no longer applying. None of the current policies in group policy have any reference to the current proxy settings...
cheaptonersucks Posted October 6, 2016 Author Posted October 6, 2016 Hi, I ran RSoP on one of the domain machines and two polices named Proxy & IE Settings exist. Although as neither of these GPOs appear to set proxy settings according under "setting" in RSoP, I am still unsure where to find the current Proxy settings that are being pushed from somewhere, as this is causing a major issue, because staff and students can't access the web, until the proxy settings are unchecked. There are several GPOs name Proxy & IE and none of them appear to contain any reference to the current proxy settings. One of the policies contain some very old proxy settings, but not the current ones. I also checked the staff and student accounts in AD, and none of them have a logon script linked to them. Is there anyway that I can create a new GPO that unchecks/disables the current proxy settings for all users please? If so, what do I need to do to create the policy please? Really need to sort this asap. Thanks
round2it Posted October 6, 2016 Posted October 6, 2016 what server are you running 2012r2 or 2008r2 i only ask as i can not change proxy settings on my 2008box for Ie11 etc i have to use my 2012 box to make changes, although the gpo exists in 2008 i cant change the settings i want. hope that comes across correctly its well documented the server 2008r2 is due for an upgrade soon 1
LeMarchand Posted October 6, 2016 Posted October 6, 2016 You could create a new policy with no proxy but you may find that the old, incorrect, policies are still applying. (Depends where they are). If you run the Group Policy Modeling wizard from the server it should show (under "Details") which Computer and User policies are being applied. IIRC there are a few places/ways to set the proxy so you need to narrow it down a bit. Then you can look under the settings (Show All) for the policies that are applying and see if you can spot something that might be causing the problem. It sounds like you've done this for Default Domain, but possibly not for Student Desktop? 1
ianniow Posted October 6, 2016 Posted October 6, 2016 Just a thought but have you looked down in preferences and registry settings. The preference settings don't show when you use rsop.msc, you have to run GPRESULT /H gpreport.html (which will be saved in the directory you run it from. 1
cheaptonersucks Posted October 6, 2016 Author Posted October 6, 2016 Thanks, the server is running 2012R2. Its driving me mad trying to find these proxy settings! Too many group policy objects created by so many different people and companies over the years, without anyone cleaning up the GPOs. What a mess. Just need a GPO that will wipe out or uncheck the current proxy settings. Surely that's possible?
cheaptonersucks Posted October 6, 2016 Author Posted October 6, 2016 Thanks LeMarchand for the suggestions. I have already run the Group Policy Modelling Wizard on one of the student accounts, which showed that only two GPOs are applying. The GPOs being applied for students are the default domain policy and the student desktop policy. I have checked both of those policies and I cant see the currently pushed proxy settings anywhere. I also checked if any logon scripts are being applied for staff or students but there are none visible in AD. I am looking through all settings in the GPOs, but shouldn't they be set under Internet options option? Must be a tool in 2016 that can find exactly where these proxy settings are being pushed from e.g. Hell.
cheaptonersucks Posted October 6, 2016 Author Posted October 6, 2016 Thanks rrrrr, its affecting IE11 and Chrome (I can get the version info for Chrome tomorrow). Just need to fix this asap, as its a big issue.
LeMarchand Posted October 6, 2016 Posted October 6, 2016 I am looking through all settings in the GPOs, but shouldn't they be set under Internet options option? You could also change the proxy using a registry merge, so not necessarily! IIRC there used to be a few points where you could set the proxy. Will try to take a look tomorrow to refresh my memory. Never got around to setting a transparent proxy, but if that was the way the old proxy was set could it still be being picked up? #Don'tReallyKnowWhatI'mTalkingAboutOnTransparentProxies. If really desperate, could you create a new "No proxy" policy and enforce it to see if that helps? 1
rrrrr Posted October 6, 2016 Posted October 6, 2016 If you manually change the proxy settings on a computer, then gpupdate and restart do they return or stay removed? 1
rrrrr Posted October 6, 2016 Posted October 6, 2016 Also have you checked workstation as well as user gpos? Proxy settings can be set at user or computer level 1
cheaptonersucks Posted October 6, 2016 Author Posted October 6, 2016 Thanks ianniow,I will check the preferences and registry settings and run GPRESULT /H tomorrow.
cheaptonersucks Posted October 6, 2016 Author Posted October 6, 2016 If I manually remove the proxy settings by unchecking them, then run a gpupdate /force the settings proxy settings remain unchecked. That implies that however the proxy settings were applied doesn't work anymore! Is that correct?
cheaptonersucks Posted October 6, 2016 Author Posted October 6, 2016 I have looked at the workstation GPOs but will look again. I assume that when I am drilling through the GPO settings, I would clearly see the current proxy settings. Guides online state that the proxy settings should be set for the user under Internet options which sound logical to me. Is that where I should be seeing the proxy settings? I am drilling into all the options in the Proxy GPOs. No proxy settings appear to be set at all in the default domain policy?? Which according to the Group Policy modelling wizard that I ran is all that is being applied apart from the student desktop policy. Which is the same result as the gpresult output that I ran.
rrrrr Posted October 6, 2016 Posted October 6, 2016 By the sounds of it, they were probably in an old gpo that no longer applies. Did you add the new proxy settings to a gpo and apply? What was the result of this? If the new settings were not taking effect did you do diagnostics to see why? Rsop, gpresult, event viewer etc? Worst case it is possible to do these settings by centrally rolling out registry changes, which i could advise you on but its better to do these by gpo, so exhaust that route first 1
cheaptonersucks Posted October 6, 2016 Author Posted October 6, 2016 There are no proxy settings now as the new setup is using a transparent proxy. So I need to remove the proxy settings from IE on all the machines, so that they can access the new Internet connection.
cheaptonersucks Posted October 6, 2016 Author Posted October 6, 2016 Is there a script that would remove any current proxy settings completely from all machines?
XiJ Posted October 6, 2016 Posted October 6, 2016 Apologies if this has been suggested already - only skim read some of the thread... I've had a situation where old IE maintenance settings were still being pushed out. Since I'd upgraded to IE11 I could no longer access them. So I had to remove them. This helped. http://bobbitco.com/2015/10/14/how-to-remove-old-folder-redirection-and-internet-explorer-maintenance-policies-from-gpos/ 1
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now