cogrady84

Just whilst your here, is it possible to add an argument to the proxy.pac on smoothwall to bypass proxy and go direct if you are a specific host/ip? Thanks

Oh wow... I think i've sussed it. Bottom post on this thread: https://social.technet.microsoft.com/Forums/office/en-US/535e5bdd-dda2-41e1-b4e2-ea5656ecc2f7/wpad-location-in-windows-81?forum=ieitprocurrentver Upon monitoring this key, if connecting to a subnet with option 252 specified an additional string is applied to the key called "WpadDetectedUrl" with the proxy.pac location value. It appears this string is not removed upon connection to a different subnet without option 252 specified. Deleting the entire key before reconnecting stops the proxy challenge. WOW... this has taken me weeks and weeks to figure out, can't believe it. Is this by design or a bug? What a nightmare!! Thank you random internet stranger!

So i've completely wiped the laptop and rebuilt it, put it in it's own ou and blocked inheritance. So no GPOs applied at all. Just tried this again and flipped between multiple subnets without option 252 deployed and it works fine, I then connect to the subnet with option 252 and it picks up proxy.pac as expected and begins auth challenge, then as soon as I move back to another subnet without option 252 it still remembers the proxy and continues to challenge.... Is anyone able to replicate this? Doesn't appear to be IE as this is happening as the connection comes up without IE launched, tracing through wireshark I see the DNS queries for smoothwall.domain.internal. This is something to do with the winhttp autoproxy discovery service, seperate to IE.

Doing some more testing this morning. wpad discovery is blocked via dns, so it's not picking it up from a dns query. It is not a cached proxy.pac file, as I have actively made changes to the file on smoothwall to add exception sites to the list and upon reconnecting the laptop to the subnet which shouldn't be trying to use a proxy, it picks up the changes and allows direct access to the exception domains. Something is actively hijacking the wpad and telling it to use smoothwall, even though wpad discovery is blocked and the dhcp scope it's connecting to doesn't stipulate option 252. Any ideas?

To be honest, I think I already ended up doing the location thing with a couple of the BYOD devices because it was the only solution I could think of at the time. No, all segmented with seperate subnets. I've exhausted google looking for methods to clear out all the different caches, registry entries, temp files that would possibly be causing this and the only thing that fixes it is wiping the OS and starting again without ever connecting to that SSID (tried with one of my dept laptops). But I can't do this with these other BYOD devices.

I absolutely agree that it is very wIErd. problem being that they are using things like Office365 which also respect IE config, so as soon as they launch an office application, or onedrive or something, it prompts for auth also and it will NOT go away, just keeps popping up like an excited jack russell terrier. When you say reset IE, do you mean just internet options, advanced, reset IE settings? If so, then yes, just tried that, didn't change anything

Yeah if I turn off automatically detect settings it works. But presumably this would break the laptops in question in other sites that rely on that box being ticked. This was smoothwall support official response to just untick the box. but i'm not keen on doing that. I want to understand what is going on

Just IE, chrome just works. yes it picked up a proxy.pac initially after connecting to the corporate wifi, and then after getting it on the byod wifi and clearing cache, removing registry entries etc it still seems to have the pac file in memory somewhere and I cannot get rid of it without basically blowing away the entire operating system, which is obviously not ideal.

After some further investigation, I set a static IP to rule out DHCP, which made no difference, I also tried it wired instead of wireless and still the proxy persists. Wireshark shows the following: DNS Standard query A wpad.domain.internal DNS Standard query A smoothwall.domain.internal DNS Standard query response No such name A wpad.domain.internal DNS Standard query response A smoothwall.domain.internal A 192.168.0.1 So it queries DNS for wpad, and there is no record for it, so responds as such. Then inexplicably queries for smoothwall, which the DC returns the record for. This is where i'm stuck, I can't for the life of me figure out what is telling this BYOD device to query for the smoothwall. DHCP has been eliminated. Immediately after these DNS queries, all further packets are sent to the smoothwall, which begins deploying proxy.pac and challenging for credentials. I've sanitised names/IP's in this post This all happens as the connection is coming up, before IE is even launched. But Chrome respects my configuration to not use a proxy, IE doesn't. In relation to the last part of your post. This is only happening on BYOD devices, that were incorrectly connected to the corporate wifi instead of the byod wifi, and then subsequently removed and put on the guest wifi. So there is little point in me configuring a network location for BYOD because normally this shouldn't happen, it was just a mistake. However i'm now scratching my head as to why this is behaving in such a way, and I want to eliminate it, because it doesn't make sense.

I'm looking for some help shedding light on a weird problem i'm having with wpad/dhcp/ie11/byod. I recently setup a VPN which required WPAD/Proxy.pac/DHCP option 252 setting up to allow vpn clients to detect whether they were on site or not and what proxy settings to apply. This all works great, if the laptop is on site it picks up the smoothwall and offsite it just automatically detects whatever settings it needs on the wifi. I only specified this DHCP option on one scope, which is linked to a particular wifi SSID. Now, I recently had some users with BYOD devices, which were connected to this SSID by mistake, picked up the proxy and started demanding authentication, despite them not being on our domain. This was resolved and they were moved over to a different SSID where dhcp isn't deploying option 252. The weird thing is, since then, when IE is launched it still tries to go through the proxy. I've checked DHCP and the option is definately not being deployed. I've cleared the browser cache, cleared all linked registry entries and i've been running wireshark and watching as the connection comes up and DNS queries are immediately sent to my DC's looking for smoothwall.local, even though the option isn't specified. Does anyone have any idea why a BYOD device, which is not on the domain, no policies applied and connected to a DHCP scope without option 252 deployed, would be sending out dns queries for WPAD/smoothwall.local? Unchecking automatically detect settings in IE fixes the problem, so its something to do with the proxy discovery service. But this only applies to IE, doesn't happen with chrome.... Thanks!

I just put the following into a startup script and applied it to all my clients: sc.exe config lanmanworkstation depend= bowser/mrxsmb20/nsi sc.exe config mrxsmb10 start= disabled Also deployed the March patch to all clients/servers.

What command can I run on the client after deploying this to verify SMB1 is now disabled?

Apologies for not getting back to this thread sooner, I noticed some asking for the SQL import: \source filepath\filename.sql I use MySQL workbench to create users, so not totally sure about the command line sequence, although here's a grab of my users/schema privileges:

When migrating from redemption codes to managed distribution, I was able to unassign the apps from devices which reclaimed the codes for reuse. When reclaimed I then submitted a request to Apple to convert all of my codes to managed distribution. Not sure about other vendors, but using AC/PM, you can definately reclaim used codes.

Are you running the activity monitor, or checked the device logs in Server/Logs when attempting to apply the profile?

I'm using WGM with 10.11, as I had stability problems with Profile Manager. Could you elaborate on which parts are incompatible? The application is no longer signed, so Pacifist is required to get around the version checks (https://www.macupdate.com/app/mac/6812/pacifist)

I'm going to chime in and suggest Profile Manager for OTA app deployment. Sounds like you already have a Mac setup with Configurator, so adding profile manager to the equation should be fairly trivial - - - Updated - - - You would need to reclaim the license prior to wiping the device, remove the app using Configurator

I'm 99% sure the client won't have been developed with a cloud connector of any kind, as they are reliant on RDP to get a full blown desktop to the end user, complete with client install and backend database. So I think i'll rule out SaaS for now and go for full blown sql pricing.

Would the software client need to be developed to be able to connect to a cloud sql service? I get the feeling it might not be currently

Is the front-end application cloud-designed? The company offer a hosted solution in their own cloud infrastructure which I believe is accessed via RDP, so it will be designed to support that presumably. How many users will the database be required to support? 3 users of the database directly and upto 50 users of a website that hooks into the database, hosted on the VM also. Database size and estimated growth? According to the recommended specification of the software, 10Gb is required for the software/database, more for additional databases. Required hours of availability - i.e. 24/7 or core business hours only? 24/7 Requirements for fault tolerance & disaster recovery? The SLA currently provides a 4 hour turnaround during a DR scenario, uptime is essential. Do you already have a license agreement that includes SQL Server? Yes, we have a Software Assurance agreement with Microsoft covering SQL Internet connectivity/bandwidth from user locations? This will vary between 10Mb-100Mb Security & compliance requirements? Not sure about this, will have to ask them and get back to you.

Spoken to my finance team and they have looked at HCSS and they were concerned they are relatively new and reluctant to go with them due to that. So still considering the Azure option...

Any ideas on pricing?

Hi Guys, Never used Azure before, but my finance team are looking for a cloud solution to work across multiple sites. It would be a single windows server with an SQL database requiring remote access for multiple users and possibly a web server to host a form also. Is this possible, what kind of pricing would I be looking at? I am not confident we could securely host a service like this onsite and provide secure remote access. The company selling the software offer a hosted solution which is around £5000 p/a so looking at any potential cheaper solutions! Would I need other services in Azure like virtual networks or remote desktop services etc? Thanks!

@FN-GM Here is a screenshot of my connection process:

No, they are creating the database. You will need to find a server with some spare resources and install MySQL server on it (MySQL :: Download MySQL Community Server), remembering the root username/password defined. Then install MySQL Workbench on your admin computer and define a connection to the mysql server, default port is 3306. (MySQL :: Download MySQL Workbench). When connected, you will have management capabilities of the SQL instance, go to users and privileges and setup a new user and goto the Scheme Priveleges tab and add entry, set the schema matching pattern to the same string as the username, then grant all priveleges apart from "grant option". MySQL Shell is needed for students to gain access (MySQL :: Download MySQL Shell) install this on a student workstation and use the commands in my previous post to gain access and perform SQL ops.