Proxy settings not being applied - GPO - XP

[Guest Guest]

Windows XP clients with server 2008 r2 using client side extensions

 

For some reason the proxy settings in our GPOs aren't applying. If I delete the users ntuser.dat file it cures most people but not all. If however I run gpupdate while the user is logged on it cures all of them.

 

I have tried applying the proxy settings to the computers rather than per user but this has had no effect.

 

All other GPO settings seem to apply fine.

 

Any ideas?

Edited May 23, 2011 by Guest

[Michael]

If all your workstations/servers require proxy settings to connect to the internet, then it makes sense to apply the change on the Default Domain Policy. It's one of the few policies I enable at this level.

 

You could also review how often GPOs are applied. By default it's 90 minutes and you can easily reduce this -

 

User Config > Admin Templates > System > Group Policy - Group Policy refresh interval for users - Enabled

[burgemaster]

Have you updated to IE8 using the "IE 8 customization installation tool" ?

Did you maybe put the proxy details in there?

[zippo]

A long shot but check KB 888254 - might not be relevent if your are patched and up to date.

 

Have you done any GPO debugging using RSoP or other console snapins? Might help narrow your search a bit.

[MikeAtTrs]

Hi all, we use Windows 2003 SP2 domain and basic Active Directory. We have recently had to change some proxy settings - trouble is, they don't seem to be applying. In the past, we have changed them by hand, because they haven't really altered through Group Policy and we haven't had time to track down the reason - I've had some time this summer break, to look deeper. I've Googled the subject, but most of the suggestions I have already tried, except I came across one article that states that the "Internet Explorer Maintenance" setting does not behave in the usual way. Apparently, one has to right-click on the "Connection" setting under the "Internet Explorer Maintenance" in the Policy and select "Reset Browser Settings". Then you right-click again to select "Preference Mode".

 

Here are some Googled suggestions =

-----------------------------------------------------------

http://forums.whirlpool.net.au/archive/1661332

"GPO's only set a setting, they dont remove old settings by default or when they are removed.

 

In your new GPO, make sure to remove and apply the removed proxy setting."

----------------------------------------------------------

...also this =

http://www.edugeek.net/forums/windows/12813-group-policy-proxy-server-your-local-lan.html

"Re: Group Policy - Proxy Server for your local LAN

 

PC's with Windows XP Service Pack 2 applied will not apply Internet Explorer Maintenance settings if Folder Redirection settings are also applied. See Microsoft Knowledge Base article # 888254 for more information. This is article is somewhat confusing in that it states (as of the January 28, 2005 revision):

 

After you enable the Folder Redirection policy in Windows XP Service Pack 2, the Internet Explorer Maintenance policy may not apply

 

"You cannot set the Folder Redirection policy setting on a Microsoft Windows XP-based computer that also uses Group Policy settings to customize Microsoft Internet Explorer."

 

In fact, the Folder Redirection settings are applied correctly, but the Internet Explorer Maintenance settings are ignored."

----------------------------------------------------------

...also this =

group policy proxy settings

"That behavior is intended, by default Group Policies are only applied

if you change them since MS assumes that you do not give the user the

permission to change the settings, and it makes the logon process

faster if you do not have to reapply GPOs.

 

If you want to change that behavior to apply at every logon you can

configure the following GPO-Setting:

 

Computer Settings/Administrative Templates/System/Group Policy/Internet

Explorer Maintenance Policy Processing

 

There you are able to configure if the GPOs are applied via slow link,

if they are applied even if they haven't changed, and if they are

reapplied during background refreshes."

----------------------------------------------------------

..also = Group Policy Proxy settings not being applied after IE8 installed - Stream Reader

 

"I'm assuming you're talking about settings being applied through the "Internet Explorer Maintenance policy" client-side extension (CSE), and not "Administrative Template" registry settings.

 

I've done several mass updates of IE8 at Customer sites where IE CSE settings were being applied and haven't seen the problem you're describing. I'd say that you've got a peculiar quirk there that's causing the behavior (possibly on just a subset of your machines, too).

 

Quirks aside, you could use the "Internet Explorer Maintenance policy processing" setting in the "Group Policy" node of the "System" node of "Administrative Templates" in "Computer Configuration" to enable "Process even if the Group Policy objects have not changed". This will give you the effect of "gpupdate /force" on these clients w/ respect to IE CSE settings. This isn't the most efficient thing in the world to do (because clients will keep re-applying the IE CSE policies even if the server version hasn't changed) but, presumably, after your roll-out is complete and everything is working you could investigate turning this back off."

----------------------------------------------------------

...end of quotes

 

I'm not sure what I have to do then as it's not totally clear whether I have to allow the 'Reset' policy to apply over a day or so, to clear all settings from clients. Then apply the preference mode for another couple of days, not sure what for, finally filling in the new proxy settings and then apply those - there doesn't seem to be a full explanation out there. Has anyone else experienced this...? I need to leave the proxy settings available for the teachers to untick the proxy box when they need to connect to their home internet. I have also read elsewhere that using the 'wpad.dat'/'pac' file scenario might be a better way to solve my situation. Because it seems there is a lack of information out there regarding the "Internet Explorer Maintenance" user policy - perhaps even M$ don't understand it themselves........ Any pointers would be most appreciated. Thanks.

 

Windows server 2003 SP2, using Group Policy, Exchange 2010, internal WSUS

1000 XP SP3 clients in total. Office 2007

300 staff (including teachers, who need settings changed between home and school).

Folder Redirection for 'App Data', 'My Docs' etc.

[Earthling]

If all your workstations/servers require proxy settings to connect to the internet, then it makes sense to apply the change on the Default Domain Policy. It's one of the few policies I enable at this level.

 

[/i]

 

This is how I've applied Proxy Settings for the last five years, using our Smoothwall as the proxy. However, now, the Head wants The Staff to be able to access YouTube which is blocked by the upstream proxy to which the Smoothwall connects. So....easy, I thought, add a proxy setting into the Staff Policy to use the unfiltered Grid proxy, and not the Smoothwall. So did that, but the Staff Policy steadfastly refuses to change the proxy setting from the one spec'd in the Default Domain Policy. Staff Policy is linked and enforced, but still won't play ball.

 

Any ideas? Anyone?

[burgemaster]

Have you run a RSOP for a staff member?

as the default domain policy is probably also enforced I guess that would be enforced before the later enforced staff policy?

[Michael]

This is how I've applied Proxy Settings for the last five years, using our Smoothwall as the proxy. However, now, the Head wants The Staff to be able to access YouTube which is blocked by the upstream proxy to which the Smoothwall connects. So....easy, I thought, add a proxy setting into the Staff Policy to use the unfiltered Grid proxy, and not the Smoothwall. So did that, but the Staff Policy steadfastly refuses to change the proxy setting from the one spec'd in the Default Domain Policy. Staff Policy is linked and enforced, but still won't play ball.

 

Any ideas? Anyone?

 

You shouldn't really need to enforce GPOs. I set proxy settings on the Default Domain Policy as it applies identically to all types of user in school. I don't have different filtering levels. I would probably recommend you take it off the Default Domain Policy, and set the required changes on the Curric GPO and Staff GPO separately. It should work perfectly then.

[CyberNerd]

Ideally you shouldn't need GPO settings at all !

by default IE,chrome,firefox will automatically detect the proxy settings without needing to specify anything in a group policy.

 

configure wpad:

Automatic Discovery for Firewall and Web Proxy Clients

 

As well as having hte advantage of running on multiple browsers/operating systems it also means staff don't need to change the settigns when they get home.

[Michael]

Ideally you shouldn't need GPO settings at all !

by default IE,chrome,firefox will automatically detect the proxy settings without needing to specify anything in a group policy.

 

That's true, but it's still recommended to specify them and you may wish to include exceptions too.

[CyberNerd]

That's true, but it's still recommended to specify them and you may wish to include exceptions too.

 

you can add exceptions in the pac file.

 

who recommends setting them in GPO? Wpad is a recognised windows/apple/linux config

[Michael]

It's generally a recommended setting to enable and configure, which is why Microsoft allows a network admin to do so via GPO.

[CyberNerd]

It's generally a recommended setting to enable and configure, which is why Microsoft allows a network admin to do so via GPO.

 

Well I disagree. WPAD IS a ms setting that they allow a network admin to control - and it has significantly more advantages than GPO settings.

 

For example, you can't configure home users through GPO, you can't configure iphone mac, linux clients through GPO. you can't configure multiple proxies through GPO for different sites.

In fact there is nothing that can't be done through pac files and WPAD settings that can be done through GPO settings, so I see no reason to use it whatsoever, let alone why it would be 'recommended' by anyone.

[MikeAtTrs]

Hello "all who have contributed" to the age old problem of Proxy settings with Group Policy. I'm with CyberNerd. Have given up with GPO. We are implementing wpad.dat, which seems the logical way to go - thanks again to all.

[Michael]

For example, you can't configure home users through GPO, you can't configure iphone mac, linux clients through GPO. you can't configure multiple proxies through GPO for different sites.

 

Well yes Group Policy is a Microsoft invention and so it only applies to Microsoft Windows. I've used GPO proxy settings for years and it works just fine. If the GPO doesn't apply, then there must be a problem somewhere. If I was using a multi-platform environment then yes, a PAC file would be the way to go. The original question was XP clients and 2008 R2, which is all Microsoft.

[plexer]

I have this problem but it seems to be an IE8 issue for me.

 

XP SP3 clients everything was fine last year but I've rolled out IE8 over the summer and now when students log in they don't get proxy settings, do a gpupdate /force solves it

 

Ben

[MikeAtTrs]

P.S. As I said in my previous post 18th August, thanks to all for info on the subject 'proxy settings not applying' - I would like to pass on our latest findings. After giving up with policies, we went down the 'wpad.dat' route , both in DHCP & DNS, it was still giving us grief :-( - so, more investigating and hair loss, discovered that previous proxy entries in policies we had tried different settings and they create install.ins files within the user part of the policies folder in sysvol. Although the setting is disabled and not visible, at a later time and another setting is created somewhere else - those install.ins files still remain and they seem to lurk around and cause us this problem. There is probably an explanation buried deep in some Microsoft documentation and has yet to be deciphered, but we in the real world however, need something more realistic....so, search on the 'policies' folder within 'sysvol' for '*.ins' files and then find out the policy names using the long ID number, this will tell you which policy you are expecting it to work from, then delete the other '.ins' files so they don't get in the way…now our proxy policy updates as expected. We might experiment with the wpad.dat file in dhcp again, but at a quieter moment in the school holidays, I think ;-)

Hope this might help….

 

;-)

[plexer]

Thanks for that Mike.

 

My issue with proxies not applying appears to have been down to using an old outdated mandatory profile.

 

I've switched students to their own roaming profile and policies appear to be applying correctly.

 

Ben

[ricki]

HI

 

Have you the correct adm for the version of I am guessing internet explorer? If you have not download it and install it in the gpo and try that. We started having problems when wsus upgraded from ie7 to ie8.

 

Also have you a corrupt policy. Try creating a new gpo with the essential setting from the old one and swap over. This fixed ours.

 

Richard

[plexer]

I tried with a new GPO and a test user and that didn't solve it only when they had a profile they could write to did it work.

 

Ben

[gtg93]

I realise this is an old thread, but thought it was a relevant place to post...

 

Is it possible to setup WPAD without TMG? As TMG has now been discontinued and I'm having similar issues to the OP - everything I can find on the web is relating to TMG.

 

Thanks