HCSHAW
asked on
Group Policy not applying for IE Maintenance settings
I have set a group policy to set the values in internet options > Connections > Lan > Proxy > Advanced > exceptions to specify addresses that are to bypass the proxy for port 80 / 443 connections. It is linked to the domain. The Group policy is located at User Configurations > windows settings > Internet Explorer Maintenance > Connection > Proxy settings.
Sometimes the settings show up on the local user, sometimes they don't. I was under the impression that at logon the settings would be applied to the local computer/user. However after checking a rebooted computer after the user logged in, the settings were not applied. GPUPDATE /Force has no effect either.
How do these settings get pushed down? I read somewhere that these might be preferences not settings, which could indicate that if not defined on the computer they are then set. Not sure about this, just grasping at straws.
Checking a Group Policy modeling shows that the policy would be applied.
Could someone explain how the settings are pushed down and why they may not be getting set. Another related question is how does the bypass proxy checkbox really work. It seems to make any difference if it is checked or not. This is why I went to the exceptions list approach.
Sometimes the settings show up on the local user, sometimes they don't. I was under the impression that at logon the settings would be applied to the local computer/user. However after checking a rebooted computer after the user logged in, the settings were not applied. GPUPDATE /Force has no effect either.
How do these settings get pushed down? I read somewhere that these might be preferences not settings, which could indicate that if not defined on the computer they are then set. Not sure about this, just grasping at straws.
Checking a Group Policy modeling shows that the policy would be applied.
Could someone explain how the settings are pushed down and why they may not be getting set. Another related question is how does the bypass proxy checkbox really work. It seems to make any difference if it is checked or not. This is why I went to the exceptions list approach.
Your exception list should be accurate, there should not be any extra spaces, otherwise it won't apply correctly
http://technet.microsoft.com/en-us/library/dd361953.aspx
Also are you running IE 10 OR 11, those browsers don't understand IE maintenance GPO settings, IE maintenance is removed from those browsers
Also with win 8\ 2012 server IE maintenance option is replaced via GPO preferences, you can't set IE maintenance from win 8 \ 8.1 \ 2012 \2012R2 GPMC console, instead you need to use GP preferences and there you will find options for IE 5 to IE 10, and IE 10 will also applicable to IE 11
http://support.microsoft.com/kb/2898604
http://technet.microsoft.com/en-us/library/dd361953.aspx
Also are you running IE 10 OR 11, those browsers don't understand IE maintenance GPO settings, IE maintenance is removed from those browsers
Also with win 8\ 2012 server IE maintenance option is replaced via GPO preferences, you can't set IE maintenance from win 8 \ 8.1 \ 2012 \2012R2 GPMC console, instead you need to use GP preferences and there you will find options for IE 5 to IE 10, and IE 10 will also applicable to IE 11
http://support.microsoft.com/kb/2898604
ASKER
Mahesh.
* This is a 2008r2 server environment with some 2003 legacy servers.
* The exceptions are clean, no spaces, semicolon separated.
* Browsers are IE 8 (2003 R2 Sever) and 11 (2008 R2 Server) , Chrome is current
To your point on IE11. I do see that the policy was not applied to the Internet settings. The exceptions are incorrect.
I ran a GP modeling on that server / user and it shows the policy being applied. I checked to see if the GP could be set for 11 as described in the second link, but in the 2008r2 gp editor that option is not available. The documentation refers to 2012 so it must be a 2012 GP.
Joshua G.
It seems I have other polices that are user specific that are applied at the domain level, and they get passed off to the user. I do not have to attach them to the OU for each user group. So I don't think that is the issue.
Thanks for your input. Do you have any other ideas?
* This is a 2008r2 server environment with some 2003 legacy servers.
* The exceptions are clean, no spaces, semicolon separated.
* Browsers are IE 8 (2003 R2 Sever) and 11 (2008 R2 Server) , Chrome is current
To your point on IE11. I do see that the policy was not applied to the Internet settings. The exceptions are incorrect.
I ran a GP modeling on that server / user and it shows the policy being applied. I checked to see if the GP could be set for 11 as described in the second link, but in the 2008r2 gp editor that option is not available. The documentation refers to 2012 so it must be a 2012 GP.
Joshua G.
It seems I have other polices that are user specific that are applied at the domain level, and they get passed off to the user. I do not have to attach them to the OU for each user group. So I don't think that is the issue.
Thanks for your input. Do you have any other ideas?
ASKER CERTIFIED SOLUTION
membership
This solution is only available to members.
To access this solution, you must be a member of Experts Exchange.
ASKER
Your referenced links put me onto the this link:
http://www.blackforce.co.uk/2013/12/05/configure-internet-explorer-ie-11-home-page-proxy-settings-using-the-registry-and-group-policy-preferences
Here it describes adding to the GP, GP Registry Entries for IE 11. Before, I was only adding in GP entries for Internet Explorer Maintenance.
I took my policy which was called Network Config, which created a User GP using the
USER CONFIGURATION/Policies/Win
and added another section for the
PREFERENCES/Windows Settings/REgistry/
Proxy Enable
Start page
ProxyOVerride
ProxyServer
Testing, it looks like it now updates the INTERNET OPTIONS consistently for the user(s).
My thought in having both the MAINTENANCE and the PREFERENCES is that one of them should apply for whatever version of IE the users is using. We have IE8 (2003 Servers) and above , with mostly IE11. The earlier versions always appeared to get set correctly. It could be that more GP are required to make sure the IE8 works properly, but I will just wait and see. Right now, all seems to be updating properly.
Thank you for the assistance.
http://www.blackforce.co.uk/2013/12/05/configure-internet-explorer-ie-11-home-page-proxy-settings-using-the-registry-and-group-policy-preferences
Here it describes adding to the GP, GP Registry Entries for IE 11. Before, I was only adding in GP entries for Internet Explorer Maintenance.
I took my policy which was called Network Config, which created a User GP using the
USER CONFIGURATION/Policies/Win
and added another section for the
PREFERENCES/Windows Settings/REgistry/
Proxy Enable
Start page
ProxyOVerride
ProxyServer
Testing, it looks like it now updates the INTERNET OPTIONS consistently for the user(s).
My thought in having both the MAINTENANCE and the PREFERENCES is that one of them should apply for whatever version of IE the users is using. We have IE8 (2003 Servers) and above , with mostly IE11. The earlier versions always appeared to get set correctly. It could be that more GP are required to make sure the IE8 works properly, but I will just wait and see. Right now, all seems to be updating properly.
Thank you for the assistance.
What does your Security Filtering look like for this GPO?