In our organization we would like all of our users to use a proxy server to access the internet. Reading online I was able to find suggestions using group policy to set this up. I figured it would be better to test it with a single user before deploying it to all the users.
So far I have created a new AD organizational unit under user accounts called "test group" and moved the test user into the container. Then clicking on this new container selected properties and then the group policy tab. When I looked into the group policy object links it showed as blank which makes sense because I just created the OU.
Under the group policy I added a new policy called "proxy server configuration" under this new policy I added the folowing entries
User Settings > Windows Settings > Internet Explorer Maintenance > Connection
I pointed it to the correct server and port number as well as bypass proxy server for local addresses
User Settings > Administrative Templates > Windows Components > Internet Explorer
I disabled the option to allow the user to edit their proxy server configuration so once it is set there is no way around it.
I saved all the changes that I made and exited out of the group policy. I figured this should be all set so that it will only affect the users that are in the "test group" organizational unit. However when I went and logged in as the user we were testing it on there was no settings affected with the proxy server.
I am kinda stumped as to why this is not working. Any suggestions?
This Question has been solved and asker verified All Experts Exchange premium technology solutions are available to subscription members.
Experts Exchange has been collecting answers to technology questions since 1996…3 million and counting! If you have a question, chances are we already have your answer.
If you can't find the exact answer you're looking for, ask our exclusive community of 50,000 experts. You’ll get a personalized answer from a trusted professional.
Thousands of free tech tips, tricks, how-to’s and tutorials are available in our peer reviewed articles section. See for yourself how smart our experts are, no login required.
Save solutions to your questions, answers you’ve discovered through searching plus helpful articles in your personal knowledgebase for easy future access.
Access the answers to your technology questions today.
30-day free trial. Register in 60 seconds.
Members of the expert community talk about why the experience at Experts Exchange is different than what you will find anywhere else.
Try it out and discover for yourself.
30-day free trial. Register in 60 seconds.
Join the community of experts here and help other tech pros by answering question in your area of expertise. You can earn FREE access to all Experts Exchange's premium features and resources.
The machine has been in the current OU basically since it was joined the domain. I created this group policy under a new OU I created within the user accounts called "test group" I then moved the user account I wanted to test this policy on into the "test group" OU. I know this sounds a little construed but hopefully it makes sense to you.
I will try the secedit /refreshpolicy machine_policy right now and see if that does anything.
As far as the event log goes it does not show any kind of errors regarding the propogation of the policies.
A little update here for you all. I just tried logging in with the persons user name on two seperate other machines one a windows xp machine and one a windows 2000 machine and both times the group policy appeared to work without a problem. It looks like the group policy is working and picking up but only on machines that have never been logged into before.
Any ideas why?
Not pursuing anything above....
Group Policy Objects are never applied to GROUPS but leaf objects -- You can use Group to filter policy settings. By default group policy applies to all leaf objects (user and computer accounts) in the container where you have set GPO.
You need to configure *Security* tab of Group Policy so that GP Settings can be applied to only the users/computers who are member of this group.
This is how you do it:
Remove Authenticated users group as this also contains all users who log on to network.
Deny Domain, Enterprise, Administrators, Administrator permission.
Add Group and set "Read" and "Apply Group Policy"
This way group policy settings must be applied to users who are member of this group.
But make sure leaf objects are inside the OU.
Let us know.
"Group Policy Objects are never applied to GROUPS but leaf objects -- You can use Group to filter policy settings. By default group policy applies to all leaf objects (user and computer accounts) in the container where you have set GPO"
I dont think that this will be a problem beacuse the way the AD structure is set up the container which the group policy is set for is only about 4-5 people in a remote office. There are no other users listed under this conatiner and there are also no administrators etc in this container. And since the group policy is set under the user accounts of the people logging in wouldnt it only affect those users who are listed in the container for which the GPO is set?
From reading it looks like you configured IE maintenance under the user configuration. You created an OU under your domain and you moved the test account inside the OU.
If you have not done it the way I described then follow SystemProg's suggestion to single out only those that should get the policy applied to them.
IE maintenance detects if there is a slow link detection. You can change the behavior to not check for slow link detection, but for some reason I only had success with windows 2000 machines and xp machines did not get it applied. Maybe I should have "waited for full network" on the xp machiens via a gpo.
I did manage to create a custom ADM template that modifies the registry keys ProxyEnable, ProxyServer, ProxyOverride so that all users inside my OU gets the proxy server settings.
regards,
kshays
Kshays: That is the exact way that I did it.
I think I actually might have gotten it to work with a registry tweak supplied by microsoft. By using regedit and editing the noGPOlistChanges to a 0 rather than a 1 it makes it so that the computer checks the group policy each time the machine is logged into the domain. So that the proxy server is always set to the appropriate address and then is dimmed so that it is not user editable.
Here is a link to the microsoft KB article. The example they give is setting a home page but it can be used for all internet explorer settings through group policies.
http://support.microsoft.c
Business Accounts
Answer for Membership
by: RajatMeherPosted on 2006-02-06 at 09:05:57ID: 15884487
Hi,
It appears taht you have correctly set the policy. By default group policies for users are refreshed every 90 minutes, with a random offset of 0 to 30 minutes. So any policy settings you make in active directory will not take effect instantly. However for the new policies to be applied immediately issue "gpupdate /force" from the user's command prompt if its a XP system or issue "secedit /refreshpolicy user_policy" for a 2000 system. It will ask for logging out, log out and login back and all your policies should be applied.
More info on Group Policy refresh interval for users is available at http://www.microsoft.com/r
Rajat