Group Policy and IE Proxy?

[adamf]

More of a how would I do this question................... We need to provide less restrictive internet access for our sixth formers in a certain part of the building and tighten it back up when they are in the library. We've got another ISA server which will have a different set of rules and NAT'd to an IP address which is excluded from our curriculum filtering policy (provided by the LGfL) - that bit is sorted.

 

It's the group policy settings thats got me stumped. Setting the proxy server is under Internet Explorer Maintanence which is under User Configuration so if I set it there then it will apply to them no matter where they logon - not what I want.

 

How can I set the proxy server so it only applies to a certain set of machines when they logon

[mb2k01]

Create a new OU and place the 6th form pc's in there.

Then create a new group policy with the new IE proxy settings and link it to that OU.

[Quackers]

You could enable "Loop Back Policy Mode" which in the OU for your Library Computers you set this under Computer Configuration, Administrative Templates, System. Group Policy, "User Group Policy Loopback Processing Mode" and set it to Replace.

 

What that does it now makes the User Configuration part of the the library policy apply to those machines instead of the normal policys set in the User's OU. So you can lock them down with different settings and of course a different proxy setting. But this would apply to everyone who logs into the library.

[hudzen76]

Think you can do this using the Security Filtering at the bottom of the group policy management console - add the PCs to a group, then set an alternative proxy GP so it only applies to your student group and those PCs. Tried a similar thing with a policy I only wanted to apply to some laptops a while back and seem to remember it worked... just check the Group Policy Inheritance is set OK so the policy applies later than your default proxy policy.

[adamf]

I'm now testing setting the IE proxy using Loopback processing and i'm running into some problems. This is how I've got it setup.....

 

All desktop computer accounts are in one OU.

 

A GPO with the Loopback setting enabled set to Merge and linked to the OU where the computer accounts are

 

A GPO with the IE Proxy settings also linked to the OU where the computer objects are. This has security filtering on it - A global group with the users who I want this setting to apply to.

 

When I log on using a user that is a member of this group they are not getting the alternative IE proxy.

 

Any ideas what i'm doing wrong?

 

Cheers

 

 

Adam.

[penfold]

Have you restarted the machine forthe changes to take effect?

 

Have you tried a gpupdate /force to see if the changes are picked up on the client.

[adamf]

Tried both of those, several times!

 

Oddly, when I did a gpupdate /force i wasn't prompted to restart, but did anyway.

[penfold]

Try running rsop on the client and see what policies it's pulling down? It might give you an idea where the problem is coming from.

[adamf]

Sorted!

 

I was enforcing the proxy higher up in the domain!

 

Cheers

 

 

Adam.