Configure Proxy Settings using Group Policy PreferencesMustBeGeek

Spread the love

A proxy server is a dedicated server that acts as the intermediate between server that provides service and its requesting client. With proxy server configured, client doesn’t have to communicate directly through the internet, thus increasing the security. Also, proxy server can help reduce internet bandwidth usage with its caching ability. For these reasons, proxy server typically deployed in enterprise network as a standard feature. Windows machine can be configured to use explicit proxy, and administrator can also configure proxy settings using Group Policy preferences to maintain the configuration consistency within the domain.

How to Configure Proxy Settings using Group Policy Preferences

With the proxy server in use, every time client is requesting any web content from the internet, it will actually make the request to the proxy server. The proxy server then will download the requested content from the internet and return give it to the client.

In this scenario, the network topology is as shown below. Domain Controller is installed in Windows Server 2012 R2 and Group Policy will push the necessary proxy server address for the client to be able to surf the internet securely and efficiently using Internet Explorer or other browser.

Step by step to configure proxy settings using Group Policy preferences:

1. Find the setting

On Group Policy Management console, open any existing policy or create a new one then navigate to one of the destination below:

User Configuration > Preferences > Windows Settings > Registry = To apply the setting at the user level, this setting will follow the user on any computer it is logged in to
Computer Configuration > Preferences > Windows Settings > Registry = To apply the setting at the computer level, this setting will be applied at the computer for any users logged in to the computer

In this example we are using the first option which is to apply the setting at the user level.

Then, on any blank space on the right pane, right click and select New > Registry Item

2. Enabling the proxy setting

In this step we will create the registry to enable the proxy setting. Fill in the fields as follows:

Action: Update
Hive: HKEY_CURRENT_USER (if setting will be applied at the user level) or HKEY_LOCAL_MACHINE (if setting will be applied at the computer level)
Key path: Software\Microsoft\Windows\CurrentVersion\Internet Settings
Value name: ProxyEnable
Value type: REG_DWORD
Value data: 00000001
Base: Hexadecimal

Click OK to save the settings. The later result of this registry on client’s Internet Explorer setting will look like this:

3. Specify the proxy server address

Repeat the step number 1, but this time create a registry with these values below to define the proxy server IP address:

Action: Update
Hive: HKEY_CURRENT_USER (if setting will be applied at the user level) or HKEY_LOCAL_MACHINE (if setting will be applied at the computer level)
Key path: Software\Microsoft\Windows\CurrentVersion\Internet Settings
Value name: ProxyServer
Value type: REG_SZ
Value data: [Proxy server IP]:[Proxy server port]

Replace the [Proxy server IP] with the proxy server IP address and [Proxy server port] with its serving port number. In this example the proxy server IP address is 192.168.10.10 and its serving on port 80, therefore the value data is 192.168.10.10:80. Adjust this value data according to your environment.

The later result of this registry on client will look like this:

4. Configuring exceptions (optional)

This step is optional only if there are site exception list that we don’t want to access through the proxy server, such as intranet sites. The values that should be configured are:

Action: Update
Hive: HKEY_CURRENT_USER (if setting will be applied at the user level) or HKEY_LOCAL_MACHINE (if setting will be applied at the computer level)
Key path: Software\Microsoft\Windows\CurrentVersion\Internet Settings
Value name: ProxyOverride
Value type: REG_SZ
Value data: [Exception site list]

Replace the [Exception site list] with the name of every sites that needs to be accessed directly, separated with semicolon. The usage of wildcard mask is permitted here. Optionally, add <local> at the end of the list to make sure the “Bypass proxy server for local addresses” option is ticked in the result. In this example, the list of sites that must be bypassed are *.mustbegeek.com and any IP address in the 192.168.* subnet, therefore the configuration will look as follows:

The later result on client’s Internet Explorer setting and in the Advanced menu will look like in these figures below:

Note: the “Bypass proxy server for local addresses” option will not be ticked if <local> is not added at the end of the list on registry.

Configuration tips

Once configured, the settings will be reflected to the client when policy refreshed. Policy refreshed can be triggered manually using command gpupdate /force.

One good thing about setting the proxy via Group Policy preferences is the clients are still allowed to manually modify the settings when needed. This is useful if clients are frequently connecting to the internet from outside the domain where the configured proxy setting may not be relevant, or when a site needs to be quickly added to the exception list. The settings will be reverted back to values configured in the GPO when client is reconnected to the domain.

That’s why this setting is so flexible, and administrator can always choose to configure proxy settings using Group Policy preferences.