How to configure Proxy Settings for IE10 and IE11 as IEM is not available

  • [アーティクル]

Hi everybody!, in this blog we are covering most if not all of the available options you have today  to manage your Proxy configuration settings using Group Policies. We hope this blog be helpful for your Internet Explorer 11 migration!.

As you know, the IE Maintenance used to configure proxy and other IE Settings was first deprecated in IE10 in favor of Administrative Templates and Group Policy Preferences. Any machine with IE10 and higher will NOT be able to use the IEM policies. IEM is still available for IE9 and lower.

NOTE: Please read the article [Replacements for Internet Explorer Maintenance] for more detailed information about the changes and other policies!

We are presenting different case scenarios to provided clarity on the options you have today, once you upgrade to IE11!

Case 1: Considering that we are using a Windows Server 2008R2 DC to which we installed IE10 or higher we will notice that IEM is not available in GPO.

Windows Server 2008R2 DC with IE9 or lower

Windows Server 2008R2 DC with IE10 and higher - Noticed, IE Maintenance is gone!

Case 2: Considering that we are using a Windows Server 2008R2 DC to which we installed IE10 or higher and trying to use GPP User Interface, but notice that you can see only to Internet Explorer 8 but IE10 is missing.

Goal: How to configure proxy settings for IE10 and higher.

We have 2 ways we can achieve the desired outcome:

1) Using GPP [Group Policy Preferences] User Interface

In order to reach what do we require, we need one of the following machines added in the Domain:

After installing the Group Policy Management Feature, ensure the following updates are installed:

A) Considering you have chosen any of the above machines, just open the Group Policy Management Console (required Administrator rights to edit policies)

From START/RUN window, Type GPMC.MSC to open the console.

B) Then you need to choose the group policy item in which you create settings and go to the following path:

User Configuration / Preferences / Control Panel Settings / Internet Settings / New /  choose Internet Explorer 10 (Right-Click or Double-click to open the settings)

Note: You need to select the option of Internet Explorer 10 in Group Policy Preference (GPP) to apply the settings for Internet Explorer 11 as the same settings apply to Internet Explorer 11.

REF: How to configure Group Policy Preference settings for Internet Explorer 11 in Windows 8.1 or Windows Server 2012 R2 - https://support.microsoft.com/en-us/kb/2898604

NEXT: From the properties, click on the Connections Tab / LAN Settings 

C) Reaching the LAN Settings, we notice that is similar to the Internet Control Panel.

We have the same options to create a proxy configuration:

    • Automatically detect settings
    • Use automatic configuration script
    • Proxy Server

D) The first thing we notice is that we have red underline settings:

Settings which are underlined in red are not configured at the target machine, while settings underlined in green are configured at the target machine.
In order to change the underlining, use the following function keys:

F5 – Enable all settings on the current tab
F6 – Enable the currently selected setting
F7 – Disable the currently selected setting
F8 – Disable all settings on the current tab

Article reference: https://blogs.technet.com/b/grouppolicy/archive/2008/10/13/red-green-gp-preferences-doesn-t-work-even-though-the-policy-applied-and-after-gpupdate-force.aspx

E) Configuring each setting in particular.

I would encourage pressing a F8 to disable all before configuring anything as the recommended scenario is to configure only the settings you want to apply.

Automatically detect settings, with the option checked:

Use an Automatic Configuration Script (AutoConfigURL) example [Remember to use F6 to enable this entry!]

Static Proxy Server configuration example [Remember to use F6 to enable this entry!]

2) The alternative way of configuring the Proxy Setting is deploying the registries keys directly.

Key path / location for the registry keys: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings

  • Automatically detect settings

Registry key: “AutoDetect”
Value Type: REG_DWORD
Value Data:
0 = Disable
1 = Enable

The key AutoDetect is only visible before you start IE10 (or IE11) on the machine, as IE will interpret it immediately and then delete the key right after. By that, the option will have its preference nature.

  • Use automatic configuration script

Registry Key: “AutoConfigURL”
Value Type: REG_SZ
Value Data: “https://<servername|host>/my_proxy.pac”

  • Proxy Server

To configure this,  you may need up to 3 registry keys:

“ProxyEnable” checkbox for “Use a proxy server for your LAN (these settings will not apply to dial-up or VPN connection) ”
Value Type: REG_DWORD
Value Data:
0 = Disable
1 = Enable

“ProxyServer”
Value Type: REG_SZ
Value Data: “ProxyServerName:Port”

“ProxyOverride”
Value Type: REG_SZ
Value Data: “list_of_exclusion”

Value Data: “list_of_exclusion;<local>”
<local> value represents the check: “Bypass proxy server for local addresses”
The value is added automatically when enabling the check box in the GPP User Interface (UI).
When deploying through the registry key is required.

You have different ways you can deploy the registry keys. The only important aspect is to deploy correctly the registry keys provided above.
But in this article I will present how it can be done via GPP Registry Item:

Location of the policy: User Configuration / Preferences / Windows Settings / Registry / Right Click + New + Registry Item

REGISTRY AND SETTING CONFIGURATIONS
“Automatically detect settings”Action: ReplaceHive: HKEY_CURRENT_USERKey Path: Software\Microsoft\Windows\CurrentVersion\Internet SettingsValue Name:  “AutoDetect”Value Type: “REG_DWORD”Value Data: “0” or “1”0 = Disable1 = Enable
 “Use automatic configuration script”Action: ReplaceHive:  HKEY_CURRENT_USERKey Path: Software\Microsoft\Windows\CurrentVersion\Internet SettingsValue Name:  “AutoConfigURL”Value Type: “REG_SZ”Value Data: “https://<servername>/my_proxy.pac”
 “Use a proxy server for your LAN (These settings will not apply to dial-up for VPN connections)”Action : ReplaceHive: HKEY_CURRENT_USERKey Path: Software\Microsoft\Windows\CurrentVersion\Internet SettingsValue Name:  “ProxyEnable”Value Type: “REG_DWORD”Value Data: “0” or “1”0 = Disable1 = Enable
 Proxy Server : “ ProxyServerName:Port”Action: ReplaceHive:  HKEY_CURRENT_USERKey Path: Software\Microsoft\Windows\CurrentVersion\Internet SettingsValue Name: “ProxyServer”Value Type: REG_SZValue Data: “ProxyServerName:Port"
 “ProxyOverride”Action: ReplaceHive: HKEY_CURRENT_USERKey Path: Software\Microsoft\Windows\CurrentVersion\Internet SettingsValue Name: "ProxyOverride"Value Type: “REG_SZ”Value Data:  "192.168.1.*;*.domain.com;<local>"
 “Bypass proxy Server for local addresses”The option is represented by the entry “<local”> added in ProxyOverride setting value data.

 

RELATED ARTICLES:

This blog has been provided to you by Adrian Guta and Heiko Mayer.

Comments

  • Anonymous
    December 21, 2015
    It doesn't work. It looks perfectly on a screen shots but in real live is doesn't work at all.

  • Anonymous
    January 04, 2016
    @Slawke     what is not working for you? Could you share more details on which option are you using?

  • Anonymous
    March 30, 2016
    Thank you. I have been strugling with this issue for weeks. Registry settings by gpo worked just fine for me.

    • Anonymous
      April 04, 2016
      Excellent!

  • Anonymous
    April 07, 2016
    Works just fine!!Thanks for a solution that worked , why do Microsoft break / change things that work fine!Why remove Internet Explorer Maintenance and then make the replacement not useable on a server 2008 / win7 domain?The registry solution works really well

  • Anonymous
    May 16, 2016
    How can you revert back to blank Use automatic configuration script?

  • Anonymous
    May 25, 2016
    I did one by one and it works perfect. Thank you for great article.How can i accomplish that don't allow users to change proxy settings via GPO registry?

    • Anonymous
      May 26, 2016
      These settings are stored in the registry. You can delete the connection key and these will revert back to default.Software\Microsoft\Windows\CurrentVersion\Internet Settings\ConnectionsThis however, may not be what you want as it will clean up the settings and you should used at your own risk!

  • Anonymous
    June 02, 2016
    We have been using 2) The alternative way of configuring the Proxy Setting is deploying the registries keys directly. And it has been working great for us, but now that we are migrating over to Windows 10, we have come across issues with MS Edge using this method. We are now in the process of using the first method, fingers crossed.

  • Anonymous
    June 20, 2016
    Should this be applied to an ou with the machine in or the user in?

    • Anonymous
      June 21, 2016
      @parisvShould use User

  • Anonymous
    July 02, 2016
    Thanks man! Using GPP [Group Policy Preferences] User Interface in other server (2012 OS), works for me! Appreciate this a lot.

  • Anonymous
    July 12, 2016
    Methode1 doesn't work for me.Server MS server 2008 R2Clients MS Win7/IE11RSAT on 8.1/IE11 (set the proxy policy from)will try Methode2Thanks

    • Anonymous
      September 29, 2016
      AxelRMSFT,I am having trouble with this, the only policy I get to stick is the "prevent changes to proxy" server. I have all policy set, but they do not carry down to the machine. When I do a rsop.msc, I can see the policy. When I do a "gpupdate /force" the policy will apply after a restart of the machine the policy will be gone, except for the "prevent changes to proxy server"
    • Anonymous
      October 02, 2016
      For anyone having issues, look at this. I've seen this ad previous job, but so far, not here.Source: https://community.spiceworks.com/topic/342202-ie-10-group-policy-help-needed-i-think-i-ve-found-a-bugThis is the order:Check "Use a proxy setting for...".Press F5.Check "Bypass proxy for local.."Click the "Advanced.." ButtonFill in your exceptions.Check the "Use the same proxy for all protocols" button.Click "OK".Fill in the IP and Port of your proxy server.Click "OK"In this order eveything is filled in. Only problem is that you never can go back to the Advanced.. screen. If you do so the proxy's IP en Port will be cleared again.So the only way to add something to your exceptions is to make a ne w rule for IE10 in same order as written above.

  • Anonymous
    September 29, 2016
    The comment has been removed

  • Anonymous
    November 21, 2016
    Registry keys "Use automatic configuration script" working for me with Windows10 clients.Thanks for the info!

  • Anonymous
    March 02, 2017
    From one IT pro to another. Thank you!

  • Anonymous
    May 23, 2017
    Hi,Thanks for above info...I want to configure proxy config via GP for boht ie9 and ie10+...Made a single policy and applied both ie9 and ie10 configuration on same single policy but the settings are getting applied for ie9 and below but not for ie10+...Do i need to create seperate 2 policiea for ie9 and ie10?Please suggest...

    • Anonymous
      May 24, 2017
      @Pranay ShirkeWhat method did you use to deploy your proxy configuration?If you use GPP Registry, this should apply to all the IE clients in that OU or where ever you linked the GPO to.