Active Directory GPO which forbidds user to change proxy settings in IE?

Question

Today I installed an Astaro Web Gateway (Proxy appliance) in an Active Directory enviroment. I made a GPO to force the ad users to sent http traffic to the appliance and not to thier default gateway. The GPO just edits the Internet Explorer proxysettings.

As far as I remember, I found that GPO template in user..window coponent...internet explorer... Proxy settings.

The policy works preddy good, but there is one big unlikly thing, it does not prevent users from clearing that setting out manually.

Is there a way to deny the edit of that setting? Or maybe another GPO which does the job?

Solution 1

In your group policy object that you've already configured the proxy settings within (I'm assuming you're using the Internet Explorer policy extension under "User Configuration", "Windows Settings", and "Internet Explorer"), add the following setting:

• User Configuration
  • Administrative Templates
    • Windows Components
      • Internet Explorer
        • Disable changing proxy settings - Enable

This will prevent the user from being able to change the proxy setting.

As an "Administrator" you might prefer not to have this setting enforced. If that's the case, add a "BUILTIN\Administrators - Deny Apply Group Policy" permission to the permissions on the GPO. Then members of the various Administrator groups (Domain Admins, Enterprise Admins, etc) nested within BUILTIN\Administrators won't have this setting enforce. (Handy if you want to logon with your admin. account and see if something acts differently not going thru the proxy.)

You could expand this to making a group, placing users into that group, and denying the group the "Apply Group Policy" right if you wanted to have a special group to put people in who would be allowed to "bypass" the proxy setting and restriction about changing it.

Edit:

I saw your comment re: laptop computers.

Look into proxy auto-config scripts. You'll really like proxy auto-config scripts and how they work on your laptop computers.

http://en.wikipedia.org/wiki/Proxy_auto-config

I moved to proxy auto-config files for my school district Customer a couple of years ago as a result of administrators taking laptops off-site and trying to work on other networks that didn't need an HTTP proxy specified. It's worked like a charm, and is a nice cross-browser and cross-platform compatible solution.

Solution 2

Check User config/admin templates/windows components/internet explorer/disable changing proxy settings. Here are some screenshots.

Comments

[user649002]

Unfortunally another serious issue came up. There are a couple of employes which have laptops. Whit a fixed proxy setting they will be unable to use there bowser if they are not inside the LAN. is it possible to setup that policy only if they are connected to the company lan and erase the proxy setting if they logged on localy to another lan... perhabs even if they do a standby wakeup.. ?

[user649002]

...maybe via dhcp instead of GPO?

[Spence]

I dropped on an edit re: proxy auto-configuration scripts. Check them out-- they're good stuff.

[user649002]

works perfect! you were right, i like them!

[Spence]

Ah, ha! Glad I could help. Proxy autoconfiguration scripts are one of the most overlooked and underutilized tools out there and they do a very, very good job considering the nasty nature of problem they seek to solve in the first place.

[Admin]

Please start your own question, don't hijack someone elses