Set Proxy Server Settings for Windows Users Using GPO

7.8K

Our organization uses a direct web proxy to enforce web access policies by restricting user access to specific sites, blocking unsafe ports, filtering and analyzing traffic, and caching web content.

A direct proxy server requires each user to explicitly define on the connection parameters of a computer that is used to establish communication with the proxy. While it is possible to manually configure each Windows computer to use a proxy server for an Internet connection, this method is only applicable for small sized-organizations. We decided to use Windows Group Policy to automate deployment of the organization’s proxy server settings to users’ computers.

Note that this method configures the Windows WinINet/user proxy settings. It does not config every proxy-aware app/Windows service.

Our organization’s existing infrastructure

• Our network is based on Windows machines that are joined to a plain Active Directory domain consisting of several AD sites (regional branch offices). To reduce the load on WAN channels between offices, each site has its own proxy server instance.
• There are about 300 client workstations (desktops and laptops) with Windows 11 (and, rarely, Windows 10 LTSC) in the enterprise network. All domain member servers and domain controllers (DCs) run Windows Server 2022 or 2019 (previous versions of Windows are not used).
• Users can access the internet using different browsers, including Google Chrome, Microsoft Edge, Opera, and Mozilla Firefox.
• Proxy servers filter user web content, restrict access to external services using access control lists (ACLs), and log user browsing history. Kerberos is used to authenticate users on the proxy, which requires correct time synchronization within the AD domain.

Our basic requirements for deploying proxy server settings

• Proxy server settings should be deployed and managed centrally via Group Policy Object (GPO).
• Individual proxy server settings should be configured for users in each branch office located on this site.
• Users should not be able to change the proxy settings on their computer.
• The IP addresses or names of some intranet web portals should be added to the proxy exceptions.

How to Deploy Proxy Settings to Windows Clients via GPO

Configure WinINet Proxy Settings with Group Policy Preferences

We will use Group Policy Preferences (GPP) to configure proxy settings on users’ computers running Windows 10 and 11 via GPO.

By default, all proxy configurations are done on a per-user basis. This means that the proxy policy should be applied via the User Configuration section to the organizational unit (OU) containing the user accounts.

The Group Policy Management Console (gpmc.msc) is used to manage GPOs in an AD domain.

1. Open the GPMC snap-in
2. I want to apply a proxy policy to users in OU California > Users. Right-click on the Active Directory OU  and select Create a GPO in this domain and link it here;
   

   

3. My new GPO name is CA_Proxy. Right-click it, and select Edit;
   

   

4. Proxy settings can be configured in User Configuration > Preferences > Control Panel Settings > Internet Settings. Right-click and select New > Internet Explorer 10. Note that this method is legacy but still functional in Windows 10/11.
   

   

5. This will open the Internet Options window. Go to the Connections tab and press the LAN Settings button;
   

   

6. Tick the checkbox “Use a proxy server for your LAN” and specify the Address and Port of your proxy server (for example, 192.168.1.11, port 3128).
7. The following function keys must be used to enable or disable specific proxy settings for a client:
   F6 — enable the selected option (the underline for an enabled GPO option changes color from red to green)
   F7 — remove the policy setting, so it is not applied. To explicitly disable a setting, clear its checkbox and press F6. The setting will then be shown with a green underline and will be enforced as disabled.
   F5 — enable all settings on the current tab
   F8 — disable all settings on the tab.
   Only green underlined options will be applied to targeted users (computers).
8. We will use the Bypass Proxy Server for Local Addresses option to add a list of local resources that can be accessed directly rather than through a proxy. Windows automatically recognizes all URLs without a domain suffix as local address (for example, http://theitbros). When accessing such an address, the browser will bypass the proxy. Note that URLs such as http://forum.theitbros.local or http://192.168.0.50 are not recognized by the Windows as local. Add manual exceptions for these local addresses to the list described below to bypass them.
   

   

9. To add a manual exception list of addresses to bypass the proxy, go to Advanced > Do not use proxy servers for addresses beginning with. We have added all DNS names and/or IP addresses to the list of addresses to be bypassed. Wildcards can be used in the exception addresses. The proxy exception list is a plain string of values separated by semicolons.
   192.*;*.theitbros.com
   

   

10. Press OK twice to save the GPO settings.

For better understanding, you should keep in mind that Windows proxy config consists of multiple independent layers:

1. WinINET (User proxy settings). This one is used by Edge, Chrome, Opera, Settings UI. It is stored in HKCU.
2. WinHTTP (System proxy). This one is used by Windows services, .NET, Windows Update. It is stored separately.
3. Browser-specific policies. Microsoft Edge or Firefox can override system settings.
4. PAC/WPAD. A PAC file can be used as an alternative to manually configuring proxy servers/maintaining multiple GPP Item-Level Targeting rules. Windows can be configured to use a PAC file through the AutoConfigURL setting, while WPAD provides automatic discovery of the PAC config. Note that browser-specific proxy policies and apps that do not use WinINET may require separate config.

How to Apply Proxy Settings via GPO Item-Level Targeting

Since we have a proxy server at each branch office, the GPO must set different proxy settings based on the user’s current Active Directory (AD) site or IP subnet. We’ll use Item-Level Targeting in GPP to apply different proxy settings to different subnets, sites, and security groups:

1. Let’s edit the previously created Internet Explorer policy with proxy settings in the GPMC console.
2. Navigate to the Common tab and enable the Item-Level Targeting option
3. Click Targeting
   

   

4. These are the conditions (rules) that determine when the proxy policy should be applied.
5. In our case, I want these settings to apply to all clients from specific LANs 192.168.1.0-192.168.20.255
6. Select New Item > IP address ranges. Specify range of IP addresses for branch LANs.
   

   

7. Save the settings.

Similarly, we created multiple GPP items, each containing different proxy settings for different IP subnets (or AD sites).

This approach allows us to create a single GPO that contains proxy settings and can be linked to the OU that contains user accounts across all office locations.

The result is that users’ proxy settings are applied according to the client’s current IP network when Group Policy Preferences are processed. If a user moves a laptop to another office, the proxy settings will be updated when Group Policy is processed again. For users who frequently move between offices/networks, a PAC file is a better method because proxy selection can be based on the client’s current network.

Configure a PAC File for Centralized Proxy Config

In case your organization has many branch offices/frequently changes proxy servers and network subnets, you can use a Proxy Auto-Configuration (PAC) file instead of maintaining multiple Group Policy Preference items with IP-based Item-Level Targeting.

A PAC file contains JavaScript logic that determines whether a connection should use a proxy or connect directly. You can config Windows to use a PAC file through the AutoConfigURL WinINET setting.

In order to create a PAC File, use our script below:

function FindProxyForURL(url, host) {
var ip = myIpAddress();

if (isInNet(ip, "192.168.1.0", "255.255.255.0"))
return "PROXY proxy-ca.example.com:3128";

if (isInNet(ip, "192.168.2.0", "255.255.255.0"))
return "PROXY proxy-ny.example.com:3128";

if (isPlainHostName(host))
return "DIRECT";

return "PROXY proxy-default.example.com:3128";
}

In our example above, clients from the 192.168.1.0/24 subnet use the California proxy, while clients from 192.168.2.0/24 use the New York proxy. Requests to plain hostnames are sent directly, while other traffic uses the default proxy.

Don’t forget to replace the example subnets and proxy hostnames with the values used in your environment.

Host the PAC File

You should host the PAC file on an internal web server that is reachable by all required clients. For example:

https://proxy.example.com/proxy.pac

You need to ensure that clients can retrieve the PAC file before they establish a connection that depends on the proxy config. HTTPS is preferable when your internal PKI and web infrastructure support it.

Deploy the PAC URL with Group Policy Preferences

You can deploy the PAC URL to domain users through Group Policy Preferences. Follow the steps below:

1. Open Group Policy Management (gpmc.msc).
2. Edit the GPO that applies to the required users.
3. Go to User Configuration → Preferences → Windows Settings → Registry.
4. Here you need to create a new registry item and configure it:
   Hive: HKEY_CURRENT_USER
   Key Path: Software\Microsoft\Windows\CurrentVersion\Internet Settings
   Value name: AutoConfigURL
   Value type: REG_SZ
   Value data: https://proxy.example.com/proxy.pac
5. At last, apply the GPO and sign out and sign in again, or refresh Group Policy.

Now verify the PAC config with the following command:

Get-ItemProperty `
-Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" |
Select-Object AutoConfigURL

Here is the output you need:

AutoConfigURL
-------------
https://proxy.example.com/proxy.pac

You should also verify that the client can retrieve the PAC file from the configured URL.

Important. AutoConfigURL configures the Windows/WinINET automatic proxy configuration. Not every application uses WinINET, and browsers or applications with their own proxy configuration may require separate policies. For example, Firefox can use its own proxy configuration instead of the Windows system proxy settings.

Prevent Users from Changing Proxy Settings in Windows

By default, this proxy policy did not prevent users from manually changing the proxy server connection parameters in Windows settings.

We implemented a policy that locks down the proxy settings configuration to prevent users from making unauthorized changes in Windows.

There is a built-in option in the administrative GPO templates. This parameter is present in both the user and computer GPO sections:

• Computer Configuration > Policies > Administrative Templates > Windows Components – Internet Explorer
• User Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer > Internet Control Panel > Disable changing proxy settings. Note that this policy only locks the legacy WinINET proxy config interface (Internet Options/Settings UI). However, it does not control all modern proxy config paths on Windows 10/11.

  Even in case this policy is enabled, proxy settings can still be influenced by:
  – Microsoft Edge policies (browser-specific proxy config)
  – WinHTTP proxy settings (system-level proxy used by services and updates)

  Direct registry modifications under:
  – HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings
  – PAC/WPAD config if enabled in the environment

To enforce proxy config consistently across Windows 10/11 environments, you should also control:

• WinHTTP proxy settings where required by applications or Windows services
• Microsoft Edge proxy settings through the Microsoft Edge administrative templates
• Registry-based enforcement using Group Policy Preferences, where required

We enabled this option in our GPO to lock down the proxy settings on client machines.

Configure Microsoft Edge Proxy Settings with Group Policy

You can config Microsoft Edge separately from the Windows system proxy settings using Microsoft Edge administrative policies. You can deploy these policies in an AD environment through Group Policy using the Microsoft Edge ADMX templates.

Install Microsoft Edge Administrative Templates

Before configuring Microsoft Edge policies, you need to download the Microsoft Edge administrative templates and make the ADMX/ADML files available through the domain Group Policy Central Store. After the templates are installed, you should open Group Policy Management (gpmc.msc) and edit the GPO that applies to the required users.

Configure the Edge Proxy Policy

Microsoft Edge provides the Proxy settings administrative policy for centrally configuring browser proxy behavior. You should prefer this policy over the older ProxyMode, ProxyServer, and ProxyPacUrl policies (which are deprecated).  If Microsoft Edge is configured to use the Windows system proxy, a separate Edge proxy policy may not be necessary. You should use the Edge policy when you need to enforce browser-specific proxy behavior independently of the Windows WinINet config.

To configure the Edge proxy settings, follow the steps below:

1. Open Group Policy Management (gpmc.msc).
2. Edit the GPO that applies to the required users.
3. Go to User Configuration → Policies → Administrative Templates → Microsoft Edge → Proxy server and open the Proxy settings policy. The Proxy settings policy is a JSON-based policy. It contains the proxy config fields such as ProxyMode, ProxyServer, ProxyPacUrl, ProxyPacMandatory, and ProxyBypassList. Enable the policy.
4. Config the proxy settings according to your organization’s requirements.
5. Use a Fixed Proxy Server

If all users targeted by this GPO should use the same proxy server, you need to config the proxy settings with a fixed proxy:

Proxy mode: fixed_servers
Proxy server: proxy-ca.example.com:3128

Don’t forget to replace proxy-ca.example.com:3128 with the hostname and port of your organization’s proxy server.

Using a PAC File

In case your organization uses a Proxy Auto-Configuration (PAC) file, you need to config the Edge proxy settings to use the PAC file:

Proxy mode: pac_script
PAC URL: https://proxy.example.com/proxy.pac

Don’t forget to replace the example URL with the URL of your organization’s PAC file.

A PAC-based config can be useful when users work from different offices/networks because the PAC file can determine which proxy should be used based on the client’s current network and the requested destination.

If the proxy config must be mandatory, you should config the corresponding PAC mandatory option according to your organization’s requirements.

For example, a PAC-based Edge proxy config can be defined as:

{
"ProxyMode": "pac_script",
"ProxyPacUrl": "https://proxy.example.com/proxy.pac",
"ProxyPacMandatory": true,
"ProxyBypassList": "intranet.example.com;*.corp.local;192.168.*"
}

The ProxyBypassList value should contain hostnames, domain names, IP addresses, or wildcard patterns that should bypass the proxy. You should not include the http:// or https:// protocol prefix. Multiple entries are separated by semicolons.

Important: Avoid Conflicting Proxy Policies

Do not config conflicting proxy settings through multiple Edge policies/through both Edge administrative policies and Windows WinINet settings unless this behavior is intentional. For example, you should avoid simultaneously deploying:

• a fixed proxy through the Edge Proxy settings policy;
• a different proxy through Windows WinINet settings;
• a PAC file through AutoConfigURL.

You need to choose which config method should be authoritative for Microsoft Edge and apply it consistently.

To verify that Microsoft Edge received the configured administrative policies, follow these steps:

1. Open Microsoft Edge.
2. Enter the following address:
   

   edge://policy

3. Click Reload policies.
4. Now check if the expected proxy policies are listed and that their values match the GPO config.

This is useful for troubleshooting because edge://policy shows the administrative policies that Microsoft Edge has actually received, rather than only showing the Windows system proxy configuration.

Important. You should avoid configuring conflicting proxy settings through multiple policy layers. Windows WinINET settings, Microsoft Edge administrative policies, PAC configuration, and WinHTTP settings are separate configuration mechanisms. For Microsoft Edge, browser-specific policies can determine the effective proxy behavior.

You need to choose which config method is authoritative for Edge and avoid deploying conflicting settings through GPP and Edge ADMX unless this behavior is intentional.

Applying GPO Proxy Settings Per-Computer Rather Than Per-User

All the proxy policies discussed above are per-user. Sometimes, it’s necessary to apply proxy settings to all users of a computer. This can be done using the GPO option Make proxy settings per-machine (rather than per user) under Computer Configuration > Administrative Templates > Windows Components > Internet Explorer.

This option allows us to apply per-computer proxy settings without enabling the GPO loopback processing mode. Enabling this option instructs the operating system to apply user-level proxy settings system-wide, effectively treating them as machine-wide configurations.

Updating Proxy Settings in the Registry Using GPO

While implementing a policy with proxy settings, we found that proxy settings can be assigned to a user directly through the registry. This has proven effective in scenarios where certain users or servers require customized proxy settings.

To create a registry parameter with proxy settings, go to the User Configuration > Preferences > Registry. Create the following registry parameters in the registry hive HKEY_CURRENT_USER in SOFTWARE\ Microsoft\ Windows\ CurrentVersion\Internet Settings key:

• ProxyEnable (REG_DWORD) = 00000001
• ProxyServer (REG_SZ) = proxy01.contoso.com:3128
• ProxyOverride (REG_SZ) =<local>;192.*;*.theitbros.com
• AutoDetect (REG_DWORD) = 00000000

We configured such GPP item to apply proxy settings only to specific user groups by using GPP Item-level targeting.

Note. Learn about how to add, edit, and remove registry keys with GPO.

Testing the GPO Proxy Settings on Windows Clients

After setting up the GPO with the proxy server parameters, we tested how it was applied to the Windows clients.

As it turns out, the proxy server settings for Windows 10 and 11 have been moved to the Settings app. To open the proxy settings on a computer, the user should navigate to Settings > Network and Internet > Proxy. To quickly navigate to this section, it is convenient to use command: ms-settings:network-proxy

Before we implemented the policy prohibiting changes to proxy settings, users could see that the Use a proxy server option was enabled. This means that the GPO proxy settings have been applied. If the user clicks Edit, they can view and modify the proxy server settings configured in the GPO.

After enabling the GPO option Prevent changing proxy settings, the proxy settings fields became grayed out and unavailable for editing. In this case, the following message appeared in the Settings app:

Some of these settings are hidden or managed by your system organization.

Users can check their current proxy settings by querying the registry values manually using Regedit.exe or the PowerShell command:

Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings" | Select-Object ProxyServer, ProxyEnable, ProxyOverride, AutoConfigURL

The configured Windows proxy settings were successfully used by the Chromium-based browsers tested in our environment, including Microsoft Edge, Chrome, and Opera. However, browser-specific administrative policies can override or change the effective proxy config. Firefox can use its own proxy config instead of the Windows system proxy. In our environment, we initially had to enable Use system proxy settings manually; later, we configured this behavior centrally using Firefox ADMX templates.

After applying proxy parameters to some branch office clients, opening any website resulted in an error similar to the following:

Firefox is configured to use a proxy server that is refusing connections.
Error code: 403 Forbidden
Check the proxy settings to make sure that they are correct.
Contact your network administrator to make sure the proxy server is working.

The issue was that the clients’ IP subnet was associated with the incorrect proxy configuration item in the GPP Item-Level Targeting settings. We had to take an inventory of the IP subnets within the organization and align the proxy GPO with them.

Now you should check if the proxy GPO is listed under Applied Group Policy Objects for the current user (or computer, if using per-machine settings):

gpresult /h report.html

How to Apply WinHTTP Proxy Settings via GPO

Above, we looked at how to apply proxy settings to users. However, this will not change the WinHTTP proxy settings (also known as a system proxy). This means that some applications (including .NET Core apps) and system services (such as the Windows Update service) will access Internet directly without going through a proxy. This issue was not relevant to our case since our workstations receive updates from an internal WSUS server. However, this could be a significant problem in other networks.

Check the current WinHTTP proxy settings on a client device with the command:

netsh.exe winhttp show proxy

Current WinHTTP proxy settings: Direct access (no proxy server)

This result indicates that the WinHTTP proxy is not configured.

There is no separate Group Policy option that allows you to configure the WinHTTP proxy. You can apply WinHTTP proxy settings through GPO by updating a special registry parameter.

First, manually configure the WinHTTP proxy setting on the reference computer. Import the current user proxy settings to WinHTTP using the command:

netsh winhttp import proxy source=ie

These settings will be saved in the WinHttpSettings REG_BINARY parameter under the registry key HKEY_LOCAL_MACHINE\ SOFTWARE\ Microsoft\ Windows\ CurrentVersion\ Internet Settings\ Connections.

This registry item must be imported into our proxy GPO. Open your GPO and go to Computer Configuration > Preferences > Windows Settings > Registry > New > Registry Wizard.

Select Local computer and specify the full path to the WinHttpSettings parameter.

Now click Finish, update the policy on client computer, and check if WinHTTP proxy settings are applied successfully.

So, we have configured and deployed a Group Policy within our Active Directory domain that enables flexible management of proxy server connection settings on client machines running Windows 11. Large companies use more advanced tools such as Secure Web Gateways/UTMs/NGFWs to filter Internet traffic, which may include proxy capabilities.