Outside people's proxy settings

[Jawloms]

We sometimes get people in from the LA (in this case Suffolk) who wish to have their laptop connected to the Wi-Fi for internet access. The LA tie down the settings of the device and I can't even get in to the proxy settings, never mind see them albeit greyed out and unchangeable. They are always surprised and say they are fine at other schools. Can't just be me surely? The only thing I can assume is that other schools they visit are on the LAs broadband offering so the proxy they need specified back at base will also work in some schools? Is there anything else I can do?

 

Stuart

[mavhc]

(Get-ItemProperty -Path 'Registry::HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings')

[pete]

Guest WiFi with transparent filtering and instructions on how to create a shortcut that calls Chrome or Edge with the --no-proxy-server switch.

 

If they need applications other than a web browser to access the Internet, they should ask the LA IT support team to configure the issued equipment so proxy settings can be adjusted before their next visit.

[Koldov]

Do they only go to schools with LA provided broadband?

 

Our school doesn't use a proxy, 'luckily' our LA music service lady doesn't have her laptop that well secured and she can just untick the proxy box.

 

Depends on how 'locked down' it is, IIRC many, many years ago we used to have an proxy but we had 2 .vbs files on the desktop one for 'school' and one for 'home' to add or remove it.

Edited November 30, 2022 by Koldov

[slugshead]

Separate VLAN for guest access with Ruckus guest passes

 

Or eduroam (More hassle than anything else in an under 18 place!)

[Sharkman]

I've got a script I use to change my proxy - one for turning it off, one for LA broadband and then some other scripts for different ones.

 

EnableProxy()
Function EnableProxy()
Set WSHShell = CreateObject("WScript.Shell")
WSHShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable", 0 ,"REG_DWORD"
WSHShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer", "proxyexample:8080", "REG_SZ"
WSHShell.RegWrite "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyOverride", " ", "REG_SZ"
End Function

Wscript.Sleep 500

dim answer
answer=MsgBox("Proxy settings changed",0,"Set Proxy Status")
WScript.quit

 

Bang that into a NotePad and set filetype to vbs and away you go. If they allow you to run it... not sure how locked down these machines are. You can stick your own proxy details in there if needs be

Edited November 30, 2022 by Sharkman
Bad formatting

[Roberto]

We sometimes get people in from the LA (in this case Suffolk) who wish to have their laptop connected to the Wi-Fi for internet access. The LA tie down the settings of the device and I can't even get in to the proxy settings, never mind see them albeit greyed out and unchangeable. They are always surprised and say they are fine at other schools. Can't just be me surely? The only thing I can assume is that other schools they visit are on the LAs broadband offering so the proxy they need specified back at base will also work in some schools? Is there anything else I can do?

 

Stuart

 

Sounds like a fault (or at least an assumption that isn't always correct) in their laptop deployment, and I'd be very wary about poking around in other organisations' settings in your position. I'd push it back to the LA to fix properly, if only to avoid the "Jawloms at school X did something and my laptop hasn't been right since" conversation. The hacks I'm seeing people posting are very clever technically but I don't think you have authorisation from the LA to change their laptop settings, do you?

[mavhc]

Just to read them, set a dns setting for that proxy, and map it to your own. These days 99% of people just connect via their phone

[Michael]

How would they use their notebooks when WfH? Can't say I've ever seen a living room with a proxy server within it...

 

There must be a mechanism whereby they can turn it off and operate without or transparently.

[chaplic]

Hello fellow suffolkian,

 

mad solution...

 

I guess you could create a local DNS zone that's the same as the councils proxy name, listening on the same ports and have a proxy behind it, chaining to whatever you use. Clients would have to accept your intercept certificate unless you let traffic through your proxy withouth mitm interception

 

Maybe ​The LAs proxy config will prefer proxy settings given from DHCP or WPAD so if you set this up it'll use them..

 

I think that's overkill though a guest unproxied wifi with DNS based filtering would be a reasonable accomodation in this day and age.

[Jawloms]

Hi all,

 

Thanks for the many responses. Next time I get one in, I'll try and run something to find the current proxy settings of the device and work from there using one of the above, but you're probably right in me not adjusting their settings for risk of repercussions no matter how unrelated! I'm sure we've all had "I can't print since you replaced my keyboard" type scenarios!

[MatthewL]

Seperate VLAN which is transparent and let them connect, dont worry about their proxy settings, I suspect when their VPN connects unless their proxy is internet facing it will take care of it.

 

I would be supplying a WiFi only and any config issues on the device is for their IT to sort.

[Sonic007]

We have had this exact same situation with people coming in from the LA.

 

They say they connect elswhere fine but I see they have a mandatory proxy set and cant do anything to change that.

 

I now keep a spare laptop or two that I hand out for guest use when we have visitors as re-configuring their laptop is something I just don't have time to do.

[FN-GM]

We have had this exact same situation with people coming in from the LA.

 

They say they connect elswhere fine but I see they have a mandatory proxy set and cant do anything to change that.

 

I now keep a spare laptop or two that I hand out for guest use when we have visitors as re-configuring their laptop is something I just don't have time to do.

 

Are they meant to connect to a VPN first. It would route the traffic via their proxy and work fine.

 

Maybe there is an automatic VPN that is being blocked at the school. It will explain why the cheers report it working elsewhere.

[sigma]

Hi all,

 

Thanks for the many responses. Next time I get one in, I'll try and run something to find the current proxy settings of the device and work from there using one of the above, but you're probably right in me not adjusting their settings for risk of repercussions no matter how unrelated! I'm sure we've all had "I can't print since you replaced my keyboard" type scenarios!

 

I do some hours at another school in Suffolk who do have County Broadband (and others previously) and always get told the same thing. My prefered solution is for them use the "visitor laptop", and that seems to be OK for them as they can't hotspot to their phone as there's no mobile signal at that school.