how to trace where .pac file and or wpad is coming from

David L 1 Reputation point
2023-12-19T18:00:53.8966667+00:00

I am trying to figure out why some of our legacy workstations are retrieving a certain pac file and routing traffic through a proxy.

When a user logs in, in internet settings its showing a URL to a pac file. Its also set to automatic.

However i cannot find any GPO showing this URL, there is one set, but it has a different .pac file at the end of the url than the one that is showing on the clients.

I checked DNS, and there is a wpad entry, but it doesnt seem to work ! and the webserver its pointing to doesnt have a wpad.dat file in the root.

I checked DHCP and no record is setup for WPAD

But somewhere the clients are receiving this url and pac file, is there a way to trace where its coming from ?

Windows 10
Windows 10
A Microsoft operating system that runs on personal computers and tablets.
11,079 questions
Internet Information Services
Windows Server
Windows Server
A family of Microsoft server operating systems that support enterprise-level management, data storage, applications, and communications.
12,524 questions
Windows DHCP
Windows DHCP
Windows: A family of Microsoft operating systems that run across personal computers, tablets, laptops, phones, internet of things devices, self-contained mixed reality headsets, large collaboration screens, and other devices.DHCP: Dynamic Host Configuration Protocol (DHCP). A communications protocol that lets network administrators manage centrally and automate the assignment of Internet Protocol (IP) addresses in an organization's network.
1,034 questions
0 comments

1 answer

Sort by: Most helpful
Most helpful Newest Oldest
  1. Hania Lian 10,531 Reputation points Microsoft Vendor
    2024-01-16T01:51:59.5933333+00:00

    Hello, Thank you for posting in Q&A forum. As you are not able to see .pac file related information in GPO or in DHCP Server configuration, there's a high possibility that it's set by a script or a third-party application. It's wise to capture the network trace by wireshark or network monitor and reproduce the net connection. In the trace file we will have further information and insights for tracking the proxy configuration. Best Regards, Hania Lian

    If the Answer is helpful, please click "Accept Answer" and upvote it.

    0 comments