How to configure Proxy Settings for IE10 and IE11 as IEM is not available


Hi everybody!, in this blog we are covering most if not all of the available options you have today  to manage your Proxy configuration settings using Group Policies. We hope this blog be helpful for your Internet Explorer 11 migration!.

As you know, the IE Maintenance used to configure proxy and other IE Settings was first deprecated in IE10 in favor of Administrative Templates and Group Policy Preferences. Any machine with IE10 and higher will NOT be able to use the IEM policies. IEM is still available for IE9 and lower.

NOTE: Please read the article [http://technet.microsoft.com/en-us/library/jj890998.aspx] for more detailed information about the changes and other policies!

We are presenting different case scenarios to provided clarity on the options you have today, once you upgrade to IE11!

Case 1: Considering that we are using a Windows Server 2008R2 DC to which we installed IE10 or higher we will notice that IEM is not available in GPO.

Windows Server 2008R2 DC with IE9 or lower

Windows Server 2008R2 DC with IE10 and higher – Noticed, IE Maintenance is gone!

Case 2: Considering that we are using a Windows Server 2008R2 DC to which we installed IE10 or higher and trying to use GPP User Interface, but notice that you can see only to Internet Explorer 8 but IE10 is missing.

Goal: How to configure proxy settings for IE10 and higher.

We have 2 ways we can achieve the desired outcome:

1) Using GPP [Group Policy Preferences] User Interface

In order to reach what do we require, we need one of the following machines added in the Domain:

After installing the Group Policy Management Feature, ensure the following updates are installed:

A) Considering you have chosen any of the above machines, just open the Group Policy Management Console (required Administrator rights to edit policies)

From START/RUN window, Type GPMC.MSC to open the console.

B) Then you need to choose the group policy item in which you create settings and go to the following path:

User Configuration / Preferences / Control Panel Settings / Internet Settings / New /  choose Internet Explorer 10 (Right-Click or Double-click to open the settings)

Note: You need to select the option of Internet Explorer 10 in Group Policy Preference (GPP) to apply the settings for Internet Explorer 11 as the same settings apply to Internet Explorer 11.

REF: How to configure Group Policy Preference settings for Internet Explorer 11 in Windows 8.1 or Windows Server 2012 R2 – https://support.microsoft.com/en-us/kb/2898604

NEXT: From the properties, click on the Connections Tab / LAN Settings 

C) Reaching the LAN Settings, we notice that is similar to the Internet Control Panel.

We have the same options to create a proxy configuration:

    • Automatically detect settings
    • Use automatic configuration script
    • Proxy Server

D) The first thing we notice is that we have red underline settings:

Settings which are underlined in red are not configured at the target machine, while settings underlined in green are configured at the target machine.
In order to change the underlining, use the following function keys:

F5 – Enable all settings on the current tab
F6 – Enable the currently selected setting
F7 – Disable the currently selected setting
F8 – Disable all settings on the current tab

Article reference: http://blogs.technet.com/b/grouppolicy/archive/2008/10/13/red-green-gp-preferences-doesn-t-work-even-though-the-policy-applied-and-after-gpupdate-force.aspx

E) Configuring each setting in particular.

I would encourage pressing a F8 to disable all before configuring anything as the recommended scenario is to configure only the settings you want to apply.

Automatically detect settings, with the option checked:

Use an Automatic Configuration Script (AutoConfigURL) example [Remember to use F6 to enable this entry!]

Static Proxy Server configuration example [Remember to use F6 to enable this entry!]

2) The alternative way of configuring the Proxy Setting is deploying the registries keys directly.

Key path / location for the registry keys: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings

  • Automatically detect settings

Registry key: “AutoDetect”
Value Type: REG_DWORD
Value Data:
0 = Disable
1 = Enable

The key AutoDetect is only visible before you start IE10 (or IE11) on the machine, as IE will interpret it immediately and then delete the key right after. By that, the option will have its preference nature.

  • Use automatic configuration script

Registry Key: “AutoConfigURL
Value Type: REG_SZ
Value Data: “http://<servername|host>/my_proxy.pac”

  • Proxy Server

To configure this,  you may need up to 3 registry keys:

ProxyEnable” checkbox for “Use a proxy server for your LAN (these settings will not apply to dial-up or VPN connection)
Value Type: REG_DWORD
Value Data:
0 = Disable
1 = Enable

ProxyServer
Value Type: REG_SZ
Value Data: “ProxyServerName:Port”

ProxyOverride
Value Type: REG_SZ
Value Data: “list_of_exclusion”

Value Data: “list_of_exclusion;<local>”
<local> value represents the check: “Bypass proxy server for local addresses”
The value is added automatically when enabling the check box in the GPP User Interface (UI).
When deploying through the registry key is required.

You have different ways you can deploy the registry keys. The only important aspect is to deploy correctly the registry keys provided above.
But in this article I will present how it can be done via GPP Registry Item:

Location of the policy: User Configuration / Preferences / Windows Settings / Registry / Right Click + New + Registry Item

REGISTRY AND SETTING CONFIGURATIONS
“Automatically detect settings”

Action: Replace

Hive: HKEY_CURRENT_USER

Key Path: Software\Microsoft\Windows\CurrentVersion\Internet Settings

Value Name:  “AutoDetect

Value Type: “REG_DWORD”

Value Data: “0” or “1”

0 = Disable

1 = Enable

 “Use automatic configuration script”

Action: Replace

Hive:  HKEY_CURRENT_USER

Key Path: Software\Microsoft\Windows\CurrentVersion\Internet Settings

Value Name:  “AutoConfigURL

Value Type: “REG_SZ”

Value Data: “http://<servername>/my_proxy.pac

 “Use a proxy server for your LAN (These settings will not apply to dial-up for VPN connections)”

Action : Replace

Hive: HKEY_CURRENT_USER

Key Path: Software\Microsoft\Windows\CurrentVersion\Internet Settings

Value Name:  “ProxyEnable

Value Type: “REG_DWORD”

Value Data: “0” or “1”

0 = Disable

1 = Enable

 Proxy Server : “ ProxyServerName:Port”

Action: Replace

Hive:  HKEY_CURRENT_USER

Key Path: Software\Microsoft\Windows\CurrentVersion\Internet Settings

Value Name: “ProxyServer

Value Type: REG_SZ

Value Data: “ProxyServerName:Port”

 “ProxyOverride”

Action: Replace

Hive: HKEY_CURRENT_USER

Key Path: Software\Microsoft\Windows\CurrentVersion\Internet Settings

Value Name: “ProxyOverride

Value Type: “REG_SZ”

Value Data:  “192.168.1.*;*.domain.com;<local>”

 “Bypass proxy Server for local addresses”

The option is represented by the entry “<local”> added in ProxyOverride setting value data.

 

RELATED ARTICLES:

This blog has been provided to you by Adrian Guta and Heiko Mayer.

 

Comments (21)

  1. Slawke says:

    It doesn't work. It looks perfectly on a screen shots but in real live is doesn't work at all.

  2. AxelRMSFT says:

    @Slawke    

    what is not working for you?

    Could you share more details on which option are you using?

  3. Carlos says:

    Thank you. I have been strugling with this issue for weeks.
    Registry settings by gpo worked just fine for me.

  4. Dale says:

    Works just fine!!

    Thanks for a solution that worked , why do Microsoft break / change things that work fine!

    Why remove Internet Explorer Maintenance and then make the replacement not useable on a server 2008 / win7 domain?

    The registry solution works really well

  5. Bob says:

    How can you revert back to blank Use automatic configuration script?

  6. Hasan says:

    I did one by one and it works perfect. Thank you for great article.

    How can i accomplish that don’t allow users to change proxy settings via GPO registry?

    1. AxelRMSFT says:

      These settings are stored in the registry. You can delete the connection key and these will revert back to default.
      Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections
      This however, may not be what you want as it will clean up the settings and you should used at your own risk!

  7. Marc says:

    We have been using 2) The alternative way of configuring the Proxy Setting is deploying the registries keys directly. And it has been working great for us, but now that we are migrating over to Windows 10, we have come across issues with MS Edge using this method. We are now in the process of using the first method, fingers crossed.

  8. parisv says:

    Should this be applied to an ou with the machine in or the user in?

    1. AxelRMSFT says:

      @parisv
      Should use User

  9. Trex says:

    Thanks man! Using GPP [Group Policy Preferences] User Interface in other server (2012 OS), works for me! Appreciate this a lot.

  10. Nick says:

    Methode1 doesn’t work for me.
    Server MS server 2008 R2
    Clients MS Win7/IE11
    RSAT on 8.1/IE11 (set the proxy policy from)
    will try Methode2
    Thanks

    1. CL Geek says:

      AxelRMSFT,

      I am having trouble with this, the only policy I get to stick is the “prevent changes to proxy” server. I have all policy set, but they do not carry down to the machine. When I do a rsop.msc, I can see the policy. When I do a “gpupdate /force” the policy will apply after a restart of the machine the policy will be gone, except for the “prevent changes to proxy server”

    2. farmersLSD says:

      For anyone having issues, look at this. I’ve seen this ad previous job, but so far, not here.

      Source: https://community.spiceworks.com/topic/342202-ie-10-group-policy-help-needed-i-think-i-ve-found-a-bug

      This is the order:

      Check “Use a proxy setting for…”.
      Press F5.
      Check “Bypass proxy for local..”
      Click the “Advanced..” Button
      Fill in your exceptions.
      Check the “Use the same proxy for all protocols” button.
      Click “OK”.
      Fill in the IP and Port of your proxy server.
      Click “OK”
      In this order eveything is filled in. Only problem is that you never can go back to the Advanced.. screen. If you do so the proxy’s IP en Port will be cleared again.

      So the only way to add something to your exceptions is to make a ne w rule for IE10 in same order as written above.

      1. Adrian says:

        This should have been solved with: https://support.microsoft.com/en-us/help/2928422/internet-explorer-10-proxy-setting-in-a-group-policy-object-is-corrupted
        That is why in the article is mentioned to have the latest updates

  11. Antrinh says:

    Question
    Sign in to vote
    6
    Sign in to vote

    If you are importing your current connection settings and you have the box unticked it should be unticked on the other side (rather than not configuring it).

    However, if you are having problems with it the only option is to do a reg change as there is no GP setting for it.

    Unfortunately the value you pointed out is not the one you are after, that only grays out the box itself therefore disallowing changes. It does not clear the tick if one exists though.

    Here’s the key you are after:

    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings

    Look for byte number 8 (starts at 0 so count 9).

    Here’s the values it can have:

    Byte number 8 can take different values as per your settings.
    The value is :
    09 when only ‘Automatically detect settings’ is enabled
    03 when only ‘Use a proxy server for your LAN’ is enabled
    0B when both are enabled
    05 when only ‘Use automatic configuration script’ is enabled
    0D when ‘Automatically detect settings’ and ‘Use automatic configuration script’ are enabled
    07 when ‘Use a proxy server for your LAN’ and ‘Use automatic configuration script’ are enabled
    0F when all the three are enabled.
    01 when none of them are enabled.
    The next three bytes are zeros (Bytes 9 to B)

  12. InesKa says:

    Registry keys “Use automatic configuration script” working for me with Windows10 clients.
    Thanks for the info!

  13. Isaac says:

    From one IT pro to another. Thank you!

  14. Pranay Shirke says:

    Hi,
    Thanks for above info…
    I want to configure proxy config via GP for boht ie9 and ie10+…
    Made a single policy and applied both ie9 and ie10 configuration on same single policy but the settings are getting applied for ie9 and below but not for ie10+…
    Do i need to create seperate 2 policiea for ie9 and ie10?
    Please suggest…

    1. AxelRMSFT says:

      @Pranay Shirke
      What method did you use to deploy your proxy configuration?
      If you use GPP Registry, this should apply to all the IE clients in that OU or where ever you linked the GPO to.

Skip to main content