1

I am trying to figure out how to stop some of our users bypassing a proxy server that is being deployed with group policy.

First, I use a pac file to configure the proxy settings for PC's. The settings are being deployed with group policy fine, that part works well.

My issue is some users are using this command to reset the settings to default:

RunDll32.exe InetCpl.cpl,ResetIEtoDefaults

The settings are then reset to defaults (no proxy) until the next time the group policy is applied. I have tried multiple things to fix this but nothing I have tried so far stops this working.

Currently the policy does not allow the user to reset the settings (from both computer config and user config), I have tried setting the proxy settings to be per machine rather than per user (with the appropriate registry entries for the proxy) and a few other things. I have also removed the InetCpl.cpl files but that breaks other things.

I cannot force people to use the proxy from our gateway, I need clients to use the pac file that is being set (there are certain destinations that the proxy does not get used for based on the IP they resolve to) as well as quite a few rules in the file.

2 Answers 2

0

You have some smart users. Or at least one smart users and the rest are good at following instructions. Have you tried blocking RunDll32.exe from being executed in user space via group policy?

I had similar problems at my last job where I serviced schools. My solution was to set a white list for proxy-less traffic (only a few sites needed it). If you didn't go through the proxy, you were blocked from just about everything. IIRC, no regular users had any issues because I had the pac file offered through both DHCP and DNS.

0

I think you are fighting a losing battle here. If users have admin access to their laptops there is little you can do to stop them monkeying with the proxy settings.

Also the question for why your users are disabling the proxy is important. Is it because some site the access isn't working with the proxy? In my experience Engaging and solving the issue together Will be a better situation than fighting them. But if fighting them is the only option then you need to fight at the network layer.

If The proxy's only function is to save you a bit of bandwidth then maybe you get away with not blocking traffic that doesn't go through the proxy but if the proxy is considered a security control relying on group policy to force traffic through it isn't a viable option. Malware, users phones macs, chrome etc will ignore your rules and all the time and money invested in the proxy is wasted

You said toucans force them to use the proxy as As there for IPs that you don't want proxies. To solve this have your firewall allow outbound web traffic to these IPs and block all other web traffic not from the proxy .

Personally I've always preferred transparent proxies rather than having to configure the proxy on every client.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .