Internet Proxy Settings & GPO 1

[RoadRunner12]

Well, this is my first post on this forum so let's start as we mean to go on!

I work at a small company with 200 users which are on a mixed network of Windows 2000/XP workstations and 2003 servers and am having great trouble getting one particular GPO to work.

The GPO (that is linked to every user OU in the company) sets up branding, proxy configuration and other settings for Internet Explorer. The branding works fine (as do the other settings in the GPO) but the proxy settings, for some reason, will not apply. I have tried everything I can think of to get this to work but it doesn’t seem to matter what GPOs are in place, something is preventing the proxy settings in Internet Explorer from being applied. When the proxy settings are applied manually on the workstations they are disappearing at what seems like random intervals and on random workstations throughout the domain.

I have tried linking the GPO in question to a test OU that contains 1 test user and even blocking policy inheritance on this OU in case the settings were being overwritten by another GPO but to no avail. I also removed all the policies from this OU and set up a clean GPO with just the proxy configuration settings in it but still had no joy. It doesn’t even seem to make a difference whether or not the GPO is enforced.

The really strange thing is that, according to RSoP, the winning GPO is the correct one and the proxy settings are being processed (RSoP even shows the proxy settings from the policy on its results page,) they’re just not appearing on the workstations. I have tried forcing a policy refresh when logged in as the test user using the gpupdate /force command but this also made no difference. I also checked the security settings on the GPO in question and the Authenticated Users group has all the rights it should need for GPO processing.

Any help with this issue would be most appreciated. Thanks in advance.

RR.

 

[bofhrevenge2]

Is the policy with the Proxy settings in set to No Overide?
I had a similar problem and that solved it.

 

[bofhrevenge2]

My appoligies i see you said that you "enforced" the policy i assume you mean No Overide.

Are you using any sort of user profiles e.g. roaming or mandatory?

 

[RoadRunner12]

I'm doing it through GPMC and right clicking on the policy and selecting "enforced." Not sure what you mean by "no override."

I'm not using any roaming profiles at the moment as all the users only ever use the same machine.

 

[ashpp]

Have you tried using "Make proxy settings per-machine"? Which is in the Computer -> Admin Templates -> Windows Components -> IE

 

[bofhrevenge2]

It probably does the same thing, usually if you right click a policy in Active Directory Users and Computers there is a No Overide option. It might be worth a look to double check they do the same thing.

 

[RoadRunner12]

Had a check on Microsoft and the "enabled" option is just a new name for the "no override" setting.

Tried making "make proxy settings per machine" but with no luck also.

 

[RoadRunner12]

Still having trouble with this. Any more ideas anyone? I'm trying to prevent having to spend a fortune on Microsoft's tech support.

 

[bofhrevenge2]

One idea as a test might be to set the proxy setting in the Users Configuration area of the computer policy.
Then enable Group Policy Loopback in the Computer Config area, this forces the user policy for the computer to overwrte the user policy of the user.

You can find this at Comp Config - Admin Templates - System - Group Policy

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/gp/34.asp

 

[Stevehewitt]

Take a look at the event logs. Also, try making a small change to an OU which you think is working OK. Make sure that this is a generic GP change (Redirection, Autorun etc) and see if that applies. This way you can see if it's the entire OU / workstations or just the one policy.
I've had it before just like this and it ended up being a dodgey winlogon.exe which is known to MS.
Contacted MS, gave me a .zip and a password - installed and worked a charm!

Of course, all the previous GPO's applied but new one's just didn't work...!

Good Luck,

Steve.

 

[RoadRunner12]

bofh: will try that now and let you know, thanks.

Steve: from what I can see it's just the one setting in this GPO that's not applying. I tried changing one setting (IE branding) in the GPO in question and forcing a refresh and it applied instantly so the GPO is functioning. All other GPOs in the domain are working perfectly.

It doesn't seem to matter which OU the policy is linked to either. I have even created the GPO from scratch and applied it to a separate OU containing only the machine I'm working on and a test user account but something is still preventing (only) the proxy settings from taking effect.

 

[RoadRunner12]

Tried GPO loopback setting but still with no luck.

 

[bofhrevenge2]

I'm stumped. Just out of curiosity do you recognise the proxy adrdess that is added is it the address of a previous proxy server or ISP setting.

 

[Stevehewitt]

Tricky one!!!

Have you had a nose in the event logs?

 

[RoadRunner12]

The problem is that the proxy address isn't getting added at all. In fact, when the correct one is added manually, it is getting removed altogether(presumably when the GPO refreshes) either when the user is in the middle of browsing or on a reboot. It's just seems very strange that every GPO simulation or RSoP tells me that the correct setting should be being applied.

As far as I can see there's nothing in the event log that pertains to GPOs.

This is really confusing me now as I have been dealing with networks using AD and GPOs for some time and have never seen anything like it. I tried the exact same scenario at home on my network and it worked first time.

 

[bofhrevenge2]

What it it being replaced with?
Just blank settings?

 

[RoadRunner12]

Yep. The use proxy tick box is getting unchecked and the proxy server and port boxes are being blanked out. It's almost like there's another GPO thats been set up to reset the proxy and is overriding the GPO I set up. I just can't seem to find it and I have now searched through every GPO in the domain.

 

[Stevehewitt]

Have you tried using the GP RSoP mmc? See if that throws anything up.

Steve.

 

[RoadRunner12]

If you look at my earlier posts you'll see that I've already tried this several times. RSoP tells me that the GPO in question is the winning GPO and the proxy settings should be getting applied.

I was doing some research on this the other day and I found out that if you have an ISA server (which we do) you can push the settings down through DHCP using Automatic Proxy Detection. It sounds a bit convoluted but I think, for the time being, this might be the only solution.