Software microsoft windows currentversion internet settings proxyserver

1. Setting proxy with GPO
2. Windows 10 proxy settings
3. Computer proxy settings
4. Proxy settings for WinHTTP API
5. Setting proxy using system environment variables
6. Prevent user from changing browser settings
7. Powershell and proxy settings

As of June 2022 Internet Explorer browser reached end of support in Windows OS, and users are advised to use Microsoft Edge in IE compatibility mode. Especially if they have legacy apps running only on IE. Many of the settings we will explain here, related to proxy, are based on usage of Internet Explorer. Despite it, we will address all aspects of configuring proxy settings even it will become “deprecated”.

I took a big byte with this one because I wanted to cover all aspects of working with proxy settings, but it wared me out to check all details. I didn’t want to copywrite things but i wanted really to check what is going on with ceratin settings and how they work. In short, I didn’t wont to give false or deprecated info, but exact and tested information. I don’t know if I succeeded. Please comment and correct me if I am wrong somewhere.

If you read part I , you realize there are two dll-s you can use for Internet access and proxying , with different capabilities. As explained WinINET is user interactive based proxy engine and it has certain capabilities that modern browsers doesn’t have. For example ftp protocol. If you type ftp address in IE you will open ftp site but if you use Microsoft Edge, you will get prompt to open another app for browsing ftp site. In next video you can see that behavior with IE as ftp app.

There is lot of ways how to configure proxy settings on your PC or server. In this article we will explain how to set proxy with GPO, registry or netsh command. Also we will explain some specific situations and bypassing it.

Setting proxy with GPO

We will start with configuring proxy settings with GPO. We will create GPO and link it to OU.

Note

In previous versions of Internet Explorer (6, 7, and 9) to configure Internet Explorer settings you needed to use the following section in the Group Policy Editor console: User configuration > Policies > Windows Settings > Internet Explorer Maintenance. In Internet Explorer 10 (firstly appeared on Windows Server 2012 and Windows the Internet Explorer Maintenance (IEM) section was removed from GPO Editor.

Картинка с сайта: igorpuhalo.wordpress.com

After that we edit created GPO. Navigate to User Configuration > Preferences > Control Panel Settings > Internet Settings and create new Internet Explorer 10 policy (it works for IE 11 also). Navigate to Connections and go to LAN settings

Картинка с сайта: igorpuhalo.wordpress.com

Enter setting for your proxy server in picture. Check box Use a proxy server for your LAN, and then enter IP address and port. Check also Bypass proxy server for local addresses.

Картинка с сайта: igorpuhalo.wordpress.com

There is one thing that you probably noticed on picture. There are green and red lines under different settings presented. Green means that setting is on and will be applied, and red means it is disabled. To toggle this settings use function keys

• F6 – enable selected option
• F7 – disable selected option
• F5 – enable all options on selected tab
• F8 – disable all options on selected tab

Bypass proxy settings for local addresses

This is very misunderstood setting. It means if you type http://intranet in your browser it will not use proxy to access web site. Local addresses are all URLs that doesn’t have domain suffix.

Regarding bypass, if you type http://intranet.contoso.com or http://192.168.0.34 it is not local address, and browser will try to use proxy to access it. That’s why it is usual to list your local domain and local addresses in exceptions on advanced tab. Use wildcards presented on picture example.

Картинка с сайта: igorpuhalo.wordpress.com

After GPO is applied, settings are presented in IE. If you have different proxy for different branch office-s aka LAN subnets you can use Item level targeting to use different proxy settings for different subnets. (I will not go into that area, but sometimes it is necessary. For example when using wpad or pac scripts for configuring proxy you will see it is common part of script configuration. We will talk about that in separate posts)

Картинка с сайта: igorpuhalo.wordpress.com

Windows 10 introduced new modern settings Control Panel where you can set up different computer settings. But still, it is just presentation pane. If you enter manually proxy settings here, you will have new entries in registry user path we talk about in next chapter. If you use GPO, proxy settings will be presented here because it will be read from the same location in registry. You can see words in red “some settings are managed by your organization“, if GPO is applied. Just to explain Microsoft Edge is using these settings, despite it is using WinHTTP API for accessing Internet. It is that setting in browser “Use system proxy settings” you can see in Chrome, Mozilla and similar browsers.

Картинка с сайта: igorpuhalo.wordpress.com

Setting proxy -registry settings

What happens when GPO is applied? It change registry settings. If you browse to registry key on picture, you will see all the same settings you configured on GPO

Картинка с сайта: igorpuhalo.wordpress.com

It means that you can also set user proxy settings by editing/adding registry keys. For example you can run this PowerShell script and set proxy settings for user. If keys doesn’t exist, please use New-ItemProperty instead of Set-ItemProperty.

$reg = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings"
Set-ItemProperty -Path $reg -Name ProxyEnable -Value 1 
Set-ItemProperty -Path $reg -Name ProxyServer -Value "10.0.40.50:9090" 
Set-ItemProperty -Path $reg -Name ProxyOverride -Value '*.contoso.com;<local>'
Set-ItemProperty -Path $reg -Name AutoDetect -Value 0

It is possible to create same registry settings with GPO also. Navigate to GPP section in GPO and create same registry keys from script. Location of settings is User Configuration > Preferences > Registry. Add next values to HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings registry path

• ProxyEnable (REG_DWORD) = 00000001;
• ProxyServer (REG_SZ) = 10.0.40.50:9090;
• ProxyOverride (REG_SZ) = *.contoso.com;<localhost>

Computer proxy settings

All settings we talked about are user proxy settings. If you need to setup proxy to computer object and all users logging into that computer, you need to configure two additional GPO settings. First one is Make proxy settings per-machine (rather than per user). It is located at Computer Configuration > Administrative Templates > Windows Components > Internet Explorer. When you enable this policy all users using that computer will have same proxy settings. Second setting need to override any user GPO policies it has in place. You need to enable Configure user Group Policy loopback processing mode located at Computer Configuration > Policies > Administrative Templates > System > Group Policy.

Make proxy settings per machine policy can be turned on also by registry setting . You will need to add next key on location in script.

$reg = "HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"
New-ItemProperty -Path $reg -Name ProxySettingsPerUser  -Value 0

For non domain-joined computers you can also use Make proxy settings per-machine GP locally. What is interesting is that you need to setup proxy settings in that way that you run IE but Run as Administrator. After that go to internet options in IE and configure all settings needed. What happens is that from that moment on, any user of that PC can change proxy settings, but if she/he open that window again proxy settings you entered as administrator will remain.

I checked what is happening in registry settings and what I discovered that somehow all Internet settings for proxy are changed in registry with entered values, but I didn’t catch a process that is changing all the values in registry. In any case result of this setting is also that if you try to change proxy setting as normal user setting is not changed. Wathc the video

Proxy settings for WinHTTP API

As we already mentioned in part I there are two different API-s used for accessing Internet over proxy. One of them WinHTTP API need its own separate proxy settings . Settings we talked about in chapters before This service also has add-on WinHTTP WPAD service that is used for configuring proxy settings using wpad script.

For system-wide proxy settings that is using this API you can use netsh command. This setting will affect all applications including Windows services which use WinHTTP API with default proxy. For example Windows Update service will not work if you are behind proxy and didn’t set this up. Syntax of this command, that you run in command shell is:

netsh winhttp set proxy 10.90.112.50:9090 "*.contoso.com;<local>"
netsh winhttp show proxy

After you run this command you will see proxy settings with show proxy command and it will look like this.

Картинка с сайта: igorpuhalo.wordpress.com

<local>

this entry correspond to Bypass proxy server for local addresses setting

These settings will be saved in the WinHttpSettings parameter under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections.

Картинка с сайта: igorpuhalo.wordpress.com

You can set this proxy setting with GPO using registry wizard. Open new GPO nad navigate to Computer Configuration > Preferences > Windows Settings > Registry > New > Registry Wizard.

Select Local computer and specify the path to the WinHttpSettings parameter. Select setting and click finish. It will copy registry binary setting from your local PC to group policy entry.

Картинка с сайта: igorpuhalo.wordpress.com

Just to clarify that there is also two same settings under Connections Key with differnet names DefaultConnectionSettings and SavedLegacySettings among different registry keys. On this link you can find more about using this keys, and some help in quickly changing binary for turning on or off some common proxy setting values . For example If “Manual proxy” is checked – 9th byte value is “03“

Картинка с сайта: igorpuhalo.wordpress.com

Setting proxy using system environment variables

With new .NET Core cross platform language and general Windows love Linux attitude, you can now use environment variables for setting proxy. I first discovered this possibility when i tried to debug why certain web application is using proxy when it shouldn’t. For all apps that are using Linux like http_proxy, https_proxy entries you can now set it up. This change came with .NETcore 3.0. You can check when it all started on this link . If I am wrong please correct me. I didn’t had to much time to investigate

The environment variables used for DefaultProxy initialization on Windows and Unix-based platforms are:

• HTTP_PROXY: the proxy server used on HTTP requests.
• HTTPS_PROXY: the proxy server used on HTTPS requests.
• ALL_PROXY: the proxy server used on HTTP and/or HTTPS requests in case HTTP_PROXY and/or HTTPS_PROXY are not defined.
• NO_PROXY: a comma-separated list of hostnames that should be excluded from proxying.

New apps are using these environment variables first, and if they don’t exist user proxy settings are used. Please check this link for more details. What is interesting that PowerShell 7 is also using this feature.

If you see entries on the picture in your Windows installation check with you development team 🙂

Картинка с сайта: igorpuhalo.wordpress.com

Prevent user from changing browser settings

Even if GPO is applied to IE, netsh or any other proxy settings, users can change any of the proxy settings. Whatever change is, GPO will still overwrite user changed settings, because GPO’s are applied on regular bases in every domain.

You can prevent users from changing user proxy settings utilizing GPO “Prevent changing proxy settings”. This parameter is present in both the user and computer GPO sections under next locations

• Computer Configuration > Policies > Administrative Templates > Windows Components – Internet Explorer
• User Configuration > Policies > Administrative Templates > Windows Components Internet Explorer

Settings in the Computer Configuration section take precedence over user settings.

Картинка с сайта: igorpuhalo.wordpress.com

Картинка с сайта: igorpuhalo.wordpress.com

Powershell and proxy settings

When using PowerShell there is some recommendation what proxy settings should be used/configure. This is table about recommended proxy settings taken form this Microsoft link

To find out what proxy settings is using PowerShell you can use this command

[System.Net.WebProxy]::GetDefaultProxy()

Картинка с сайта: igorpuhalo.wordpress.com

For some more info please check this link

I next part I will cover configuring proxy settings using WPAD/PAC scripts. i hope it will not be long and daunting task like this one. See you