Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

So far, I've used a user group policy object utilizing Internet Explorer maintenance to set a proxy for the user in IE. We have now deployed the Enterprise Client (EC) starter group policy to our domain and this policy affects this behavior.

The EC group policy uses the policy Make proxy settings per-machine (rather than per-user). This policy describes itself as:

This policy is intended to ensure that proxy settings apply uniformly to the same computer and do not vary from user to user.

Great! This seems to be an improvement over my previous setup.

If you enable this policy, users cannot set user-specific proxy settings. They must use the zones created for all users of the computer.

What zones and where do I configure the proxy settings for them?

I assumed the policy would simply take the user settings and apply them, but that's not what's happening. Now no proxy server is set at all. So my previous settings obviously no longer have any effect.

So far, I've only come up with solutions that involved direct manipulation of the Windows registry. Which is fine, I guess, but the way the proxy is configured for users makes it appear as if there could be a higher level approach.

share|improve this question
    
I believe you're looking for the loop back group policy support.microsoft.com/kb/231287 –  Nixphoe Nov 10 '12 at 14:44
    
@Nixphoe: I guess that would be an option. However, it would also be acceptable to simply deploy the user policy. But that user policy does not prevent the user from changing their proxy settings. So the problem is not about applying the policy to the right targets, but about where to configure the proxy settings when applying per-computer. –  Oliver Salzburg Nov 10 '12 at 14:50
add comment

3 Answers

I think what that means is the Internet Explorer zones, and how the proxy bypass settings apply to the local intranet zone. This article explains it in more detail than should be gone into here, but essentially every website is classified into a zone so that the various security settings can be adjusted. By default the proxy bypass list is automatically included in the Local Intranet zone.

EDIT: To answer your question directly - Drawing from the information above, you cannot and do not need to configure proxy settings per-zone. However, your users might choose to exclude a URI from being proxyed, hence adding it to the Local Intranet zone.

For the proxy configuration, I seem to remember having quite a bit of success with the IE Maintenance feature in Group Policy, which incidentally has now been superseded in 2012 by GPP. Unfortunately because of that I can't share my own how-to because I haven't got the relevant server edition in my test environment. Below are a couple of solutions (of which you may already be aware), it's up to you to decide which is most suitable to your organisation:

Unfortunately, I don't think there is a way to set proxy on a computer level using Group Policy. However, as you say in your own answer restricting changes to that section of the control panel is the usual practise to stop changed to proxy. Perhaps, better still, you could use an auto-configuration script.

share|improve this answer
    
IE Maintenance is what I am using right now. –  Oliver Salzburg Nov 11 '12 at 11:55
    
But are you setting it at the computer lever rather than user level? The article I linked to explains how to enforce the policy at a computer level. –  john Nov 11 '12 at 16:43
    
No I didn't make use of the loopback functionality because I assumed that there is a difference between loopback and actually applying on the computer level. It didn't seem like that's what's implied in the description of the policy. I assumed there would be an equivalent policy for the user proxy settings, but for the computer. I also didn't get too far into the article because it said it applies to Server 2003. –  Oliver Salzburg Nov 11 '12 at 16:58
    
My apologies, without looking I mistakenly recalled that the IEM was available at a computer level. I have updated my answer and highlighted the zone info. –  john Nov 11 '12 at 20:07
add comment
up vote 0 down vote accepted

I have now spent several hours trying several combinations of group policies and the way they are applied. And what I ended up with is:

I have no clue what the point of that policy in question is. I see no benefit at all from using it. Let's have a look at that description again:

  1. Applies proxy settings to all users of the same computer.

    Okay, great, I want that. But I can achieve the same by applying a user policy on a site level instead of a OU level.

  2. If you enable this policy, users cannot set user-specific proxy settings. They must use the zones created for all users of the computer.

    What zones? It is still not clear what zones they are talking about. Internet Explorer security zones? If so, how are those related to proxy settings. Are they talking about AD sites? That makes no real sense either. Even though I can use the AD sites to apply my policies differently, that's a pretty far stretch assuming that that is what's being hinted at here.

  3. If you disable this policy or do not configure it, users of the same computer can establish their own proxy settings.

    I don't want users to adjust their proxy settings, so I want that. But I can also simply apply the policy Disable changing proxy settings.

  4. This policy is intended to ensure that proxy settings apply uniformly to the same computer and do not vary from user to user.

    Yes, awesome! And I never really fully got the feeling that this settings works as I would expect. However, applying my existing (user-based) proxy policies (optionally at a site level), combined with disabling the ability for the user to change them was fully sufficient.

share|improve this answer
add comment

To set a global proxy via group policy:

Click Start – All programs – Administrative Tools – Group Policy Management.
Create or Edit Group Policy Objects.
Expand User configuration – Policies – Windows Settings – Internet Explorer Maintenance – Connection.
In right Pane Proxy Settings.

To prevent users from changing their proxy settings:

Click Start – All programs – Administrative Tools – Group Policy Management.
Create or Edit Group Policy Objects.
Expand Computer Configuration – Administrative Templates – Windows Components - Internet Explorer – Internet Control Panel
In right Pane Disable the Connections page (Enabled)

Info from: social.technet.microsoft.com

share|improve this answer
1  
Question states he already uses the user group policy. He wants to know how to apply it based on a group of computers. –  Nixphoe Nov 10 '12 at 14:46
    
This is what I'm having deployed right now. It does not result in the desired state. –  Oliver Salzburg Nov 10 '12 at 14:48
    
I see, you'll need to use Site GPO then. Please see this link for more info: experts-exchange.com/OS/Miscellaneous/Q_21444743.html <- access this link via google (just google the link) –  FINESEC Nov 10 '12 at 15:31
    
@FINESEC: Interesting idea. But that would still apply the user policy and only set the proxy for the user. So the policy from the Microsoft starter objects would still negate that. –  Oliver Salzburg Nov 11 '12 at 12:35
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.