Windows 7 No Internet Access Through Proxy

[nathanbowes]

We have started to deploy Windows 7 using Microsoft Deployment Toolkit (MDT) and Deployment Services (we have always used Ghost in the past). Unfortunately we have found (after deploying 60 machines!) that the Internet does not work on a MDT deployed workstation on Internet Explorer 8 or 9 (DVD installed and Ghosted workstations work fine?!).

 

We are however able to connect to the Internet using Firefox and Chrome, download Windows updates and device drives from the Internet, ping the county councils proxy and connect to the Netsweeper admin console from the affected machines using IE.

 

Internet proxy settings are set by Group Policy and work fine for XP and Windows 7 workstations that we have installed from DVD or imaged using Ghost.

 

We have tried deploying a workstation to a workgroup rather the domain (thus no GPOs applied) and after manually entering the proxy information IE still doesn’t work (but Firefox etc. do..)

 

Microsoft are now involved and although we still have no resolution we have discovered using Microsoft Network Monitor 3.4 that it appears to be an issue related to NTLM authentication as when the proxy asks the second time for NTLM authentication the workstation fails to send another request and simply displays the ‘Internet Explorer cannot display the webpage’ page. It appears that IE only sends the domain and workstation name to the proxy and then fails to respond when requested for the username. On a working workstation IE will send an additional request with domain, workstation name and username and from there the proxy will authenticate and send the page requested.

 

The question is, has anyone else experienced this issue, either related to MDT or separately? If the answer is yes have you managed to resolve it and what was the resolution?

 

Any help with this is much appreciated as our Windows 7 deployment is now very much at risk.

 

Many thanks

 

Nath

[ZeroHour]

When you imaged I presume you had not set any gp/proxy settings on the client?

I have seen weird things happen with proxy settings when the client had settings applied prior and they dont stack well.

[ricki]

Hi

 

We had this when we created a windows 7 image from a image from which came with the machine which had a restore partition. It would join the domain but would not apply user gpos. We had to wipe the machine including all the partitions and install again from our windows 7 install disk and then create an image and this worked with no problems.

 

Richard

[nathanbowes]

When you imaged I presume you had not set any gp/proxy settings on the client?

I have seen weird things happen with proxy settings when the client had settings applied prior and they dont stack well.

 

We have deployed with numerous scenarios, one being to workgroup rather than domain to rule out rogue GPO settings. There are no settings on the client as we are deploying the wim file from a Windows 7 DVD iso to the clients. An intial part of the MDT deployment is to partition and format the client before it then copies the wim, expands the files and installs Windows 7.

[nathanbowes]

Hi

 

We had this when we created a windows 7 image from a image from which came with the machine which had a restore partition. It would join the domain but would not apply user gpos. We had to wipe the machine including all the partitions and install again from our windows 7 install disk and then create an image and this worked with no problems.

 

Richard

 

Thank you but we always create our own images from scratch anyway to help avoid the bloatware installed on newely purchased machines.

[plexer]

What's the upstream proxy as the problem is with the auth on that and the broken ntlm in ie8.

 

Ben

[nathanbowes]

What's the upstream proxy as the problem is with the auth on that and the broken ntlm in ie8.

 

Ben

 

The county council use Netsweeper which I believe uses squid proxy. It does appear to be ntlm negotiation between the proxy and IE but I'm at a loss as to why there is an issue when we are deploying using the same Windows 7 wim file through MDT that works fine when we install a workstation from the DVD. It suggests that the MDT deployment process is somehow affecting ntlm.

[nathanbowes]

For reference if anyone else gets a similar issue this was resolved by a reply to a post made on the Microsoft MDT forums (Internet Explorer NTLM to Squid Proxy Fails after MDT 2012 Deployment) by Stephan Schwarz. It was a simple case of adding ApplyGPOPack=NO in the customsettings.ini with MDT. Everything now works as it should :-) Edited August 13, 2012 by nathanbowes