cogrady84

Just whilst your here, is it possible to add an argument to the proxy.pac on smoothwall to bypass proxy and go direct if you are a specific host/ip? Thanks

Oh wow... I think i've sussed it. Bottom post on this thread: https://social.technet.microsoft.com/Forums/office/en-US/535e5bdd-dda2-41e1-b4e2-ea5656ecc2f7/wpad-location-in-windows-81?forum=ieitprocurrentver Upon monitoring this key, if connecting to a subnet with option 252 specified an additional string is applied to the key called "WpadDetectedUrl" with the proxy.pac location value. It appears this string is not removed upon connection to a different subnet without option 252 specified. Deleting the entire key before reconnecting stops the proxy challenge. WOW... this has taken me weeks and weeks to figure out, can't believe it. Is this by design or a bug? What a nightmare!! Thank you random internet stranger!

So i've completely wiped the laptop and rebuilt it, put it in it's own ou and blocked inheritance. So no GPOs applied at all. Just tried this again and flipped between multiple subnets without option 252 deployed and it works fine, I then connect to the subnet with option 252 and it picks up proxy.pac as expected and begins auth challenge, then as soon as I move back to another subnet without option 252 it still remembers the proxy and continues to challenge.... Is anyone able to replicate this? Doesn't appear to be IE as this is happening as the connection comes up without IE launched, tracing through wireshark I see the DNS queries for smoothwall.domain.internal. This is something to do with the winhttp autoproxy discovery service, seperate to IE.

Doing some more testing this morning. wpad discovery is blocked via dns, so it's not picking it up from a dns query. It is not a cached proxy.pac file, as I have actively made changes to the file on smoothwall to add exception sites to the list and upon reconnecting the laptop to the subnet which shouldn't be trying to use a proxy, it picks up the changes and allows direct access to the exception domains. Something is actively hijacking the wpad and telling it to use smoothwall, even though wpad discovery is blocked and the dhcp scope it's connecting to doesn't stipulate option 252. Any ideas?

To be honest, I think I already ended up doing the location thing with a couple of the BYOD devices because it was the only solution I could think of at the time. No, all segmented with seperate subnets. I've exhausted google looking for methods to clear out all the different caches, registry entries, temp files that would possibly be causing this and the only thing that fixes it is wiping the OS and starting again without ever connecting to that SSID (tried with one of my dept laptops). But I can't do this with these other BYOD devices.

I absolutely agree that it is very wIErd. problem being that they are using things like Office365 which also respect IE config, so as soon as they launch an office application, or onedrive or something, it prompts for auth also and it will NOT go away, just keeps popping up like an excited jack russell terrier. When you say reset IE, do you mean just internet options, advanced, reset IE settings? If so, then yes, just tried that, didn't change anything

Yeah if I turn off automatically detect settings it works. But presumably this would break the laptops in question in other sites that rely on that box being ticked. This was smoothwall support official response to just untick the box. but i'm not keen on doing that. I want to understand what is going on

Just IE, chrome just works. yes it picked up a proxy.pac initially after connecting to the corporate wifi, and then after getting it on the byod wifi and clearing cache, removing registry entries etc it still seems to have the pac file in memory somewhere and I cannot get rid of it without basically blowing away the entire operating system, which is obviously not ideal.

After some further investigation, I set a static IP to rule out DHCP, which made no difference, I also tried it wired instead of wireless and still the proxy persists. Wireshark shows the following: DNS Standard query A wpad.domain.internal DNS Standard query A smoothwall.domain.internal DNS Standard query response No such name A wpad.domain.internal DNS Standard query response A smoothwall.domain.internal A 192.168.0.1 So it queries DNS for wpad, and there is no record for it, so responds as such. Then inexplicably queries for smoothwall, which the DC returns the record for. This is where i'm stuck, I can't for the life of me figure out what is telling this BYOD device to query for the smoothwall. DHCP has been eliminated. Immediately after these DNS queries, all further packets are sent to the smoothwall, which begins deploying proxy.pac and challenging for credentials. I've sanitised names/IP's in this post This all happens as the connection is coming up, before IE is even launched. But Chrome respects my configuration to not use a proxy, IE doesn't. In relation to the last part of your post. This is only happening on BYOD devices, that were incorrectly connected to the corporate wifi instead of the byod wifi, and then subsequently removed and put on the guest wifi. So there is little point in me configuring a network location for BYOD because normally this shouldn't happen, it was just a mistake. However i'm now scratching my head as to why this is behaving in such a way, and I want to eliminate it, because it doesn't make sense.

I'm looking for some help shedding light on a weird problem i'm having with wpad/dhcp/ie11/byod. I recently setup a VPN which required WPAD/Proxy.pac/DHCP option 252 setting up to allow vpn clients to detect whether they were on site or not and what proxy settings to apply. This all works great, if the laptop is on site it picks up the smoothwall and offsite it just automatically detects whatever settings it needs on the wifi. I only specified this DHCP option on one scope, which is linked to a particular wifi SSID. Now, I recently had some users with BYOD devices, which were connected to this SSID by mistake, picked up the proxy and started demanding authentication, despite them not being on our domain. This was resolved and they were moved over to a different SSID where dhcp isn't deploying option 252. The weird thing is, since then, when IE is launched it still tries to go through the proxy. I've checked DHCP and the option is definately not being deployed. I've cleared the browser cache, cleared all linked registry entries and i've been running wireshark and watching as the connection comes up and DNS queries are immediately sent to my DC's looking for smoothwall.local, even though the option isn't specified. Does anyone have any idea why a BYOD device, which is not on the domain, no policies applied and connected to a DHCP scope without option 252 deployed, would be sending out dns queries for WPAD/smoothwall.local? Unchecking automatically detect settings in IE fixes the problem, so its something to do with the proxy discovery service. But this only applies to IE, doesn't happen with chrome.... Thanks!

I just put the following into a startup script and applied it to all my clients: sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi sc.exe config mrxsmb10 start= disabled Also deployed the March patch to all clients/servers.

What command can I run on the client after deploying this to verify SMB1 is now disabled?

Apologies for not getting back to this thread sooner, I noticed some asking for the SQL import: \source filepath\filename.sql I use MySQL workbench to create users, so not totally sure about the command line sequence, although here's a grab of my users/schema privileges:

When migrating from redemption codes to managed distribution, I was able to unassign the apps from devices which reclaimed the codes for reuse. When reclaimed I then submitted a request to Apple to convert all of my codes to managed distribution. Not sure about other vendors, but using AC/PM, you can definately reclaim used codes.

Are you running the activity monitor, or checked the device logs in Server/Logs when attempting to apply the profile?