GPO partially applying

Nikumba · 2 Apr 2014 at 12:04

We are trying to set the proxy server via GPO's however for some reason the GPO is only getting partially applied.

The Exceptions box is being populated with the right information, but it is not putting in the DNS name for the proxy server.

If I look at the settings of the GPO it shows the exceptions but not the proxy server.

Any suggestions?

Thanks

Kimbie

BattFink · 2 Apr 2014 at 12:35

Have you run a RSOP on one of the affected machines?

Is there another policy providing conflicting policy information (from memory there's a few places that you apply proxy settings)

Is ISA in use (e.g. is there any autoconfiguration in place)?

sk82jack · 2 Apr 2014 at 12:42

What's the versions of windows being used - server and client?

On a client that receives the GPO you can open up a management console mmc.exe and add in the Resultant Set of Policy snap-in. If you then generate the RSoP report you can see what settings exactly are being applied.

There is also the command line based tool gpresult which may help too.

OmegaHarvest · 2 Apr 2014 at 12:43

This has always given me grief when trying to set the proxy settings for IE. What version of IE are you using and what server version are your DCs? I know Microsoft have recently changed it so that you can push settings out via GP preferences for different versions of IE. Loads of people complained about the change.

In the end, for my clients that don't have a transparent proxy, I set the proxy via publishing a proxy.pac file on an internal web server and setting the WPAD option in DHCP. Was much less hassle that way.

Also, I'd recommend gpresult over RSOP as I believe gpresult shows GP preferences and RSOP does not. I may be wrong on that, maybe someone can verify. Just do gpresult /h c:\gpresult.html (or wherever you want the outputted report stored.

Spammeh · 2 Apr 2014 at 22:21

Worth checking whether you've left a / on the end of one of your proxy exceptions. i.e. www.google.co.uk/

This has been known to buggar up the proxy part of GPOs plenty of times in the past

Caged · 2 Apr 2014 at 23:32

Point clients to your proxy autoconfiguration details via DHCP, no GPOs required, and no weird issues with non-domained clients or existing clients leaving the network.

And in the long term move to a transparent proxy.

Nikumba · 3 Apr 2014 at 06:47

Windows 2008R2 Domain with Windows 7 Ent

gpresult /r does show the policy has been detected and applied.

Looking at the policies that have been applied only the one I have created deals with the proxy.

We have looked at using a PAC file, but looking at the best way to implement it as not all users/systems will need a proxy.

No odd chars in the exceptions list.

Kimbie

OmegaHarvest · 3 Apr 2014 at 07:49

Nikumba said:
Windows 2008R2 Domain with Windows 7 Ent

gpresult /r does show the policy has been detected and applied.

Looking at the policies that have been applied only the one I have created deals with the proxy.

We have looked at using a PAC file, but looking at the best way to implement it as not all users/systems will need a proxy.

No odd chars in the exceptions list.

Kimbie

Which version of IE are you using and how are you setting the proxy settings? Is it via group policy prefernces and is your version of IE appearing in the list of browsers? IIRC 2008R2 only natively supports up to IE8 in gp prefernces.

Nikumba · 3 Apr 2014 at 09:02

IE10 and 11

Set via Group Policy Mangement on my Windows 7 machine

User Config > Control Panel Settings > Internet Settings then a policy created for IE10

Kimbie

anything I don't mind · 3 Apr 2014 at 10:35

I would use

user config -> policies -> windows settings -> Internet explorer maintenance -> connection -> proxy settings.

gpo can be annoying to apply like that sometimes. One applied wait a bit and do a restart/gupdate and see if it works.

Nikumba · 3 Apr 2014 at 13:05

anything I don't mind said:
I would use

user config -> policies -> windows settings -> Internet explorer maintenance -> connection -> proxy settings.

gpo can be annoying to apply like that sometimes. One applied wait a bit and do a restart/gupdate and see if it works.

For IE10 that option have been depreciated now

anything I don't mind · 3 Apr 2014 at 14:16

ok good to know. We still on ie9 at our sites due to software compatibility.

Nikumba · 4 Apr 2014 at 06:52

Well got it working, the blame goes to Microsoft shonky GPO's

We had specified the proxy server in the advanced options, but turns out you need to specify it in the first proxy address box not the advanced, changed it and it worked

Bloody GPO's

Kimbie