The article shows how to use Active Directory Group Policies (GPOs) to configure proxy server settings on domain-joined computers running Windows 10/11 and Windows Server 2022/2019/2016/2012R2. These proxy server settings are used by all modern browsers, including Internet Explorer 11 (reached end of support on June 2022), Google Chrome, Microsoft Edge, Opera, and Mozilla Firefox (with the option Use system proxy settings enabled by default).
How to Set Proxy Settings via Group Policy?
To manage the browser’s proxy server settings on a Windows computer, you can use Group Policy Preferences (GPP) or Internet Explorer Administration Kit 11 (IEAK 11). In order to set proxy settings via GPO on users’ computers in the AD domain, perform the following actions:
- Open Group Policy Management Console (gpmc.msc);
- Select the Active Directory organization unit (OU) for which you want to apply the new proxy settings. In this example, we want to apply a proxy settings policy to user OU (OU=Users,OU=California,OU=USA,DC=theitbros,DC=com);
- Right-click on OU and select Create a GPO in this domain and link it here;
- Specify a policy name, for example, CA_Proxy;
- Click on the policy and select Edit;
- Expand the following section: User Configuration > Preferences > Control Panel Settings > Internet Settings. Right-click and select New > Internet Explorer 10 (this policy will also be applied for the IE 11);
Note. In previous versions of Internet Explorer (6, 7, and 9) to configure Internet Explorer settings you needed to use the following section in the Group Policy Editor console: User configuration > Policies > Windows Settings > Internet Explorer Maintenance. However, in Internet Explorer 10 (which firstly appeared on Windows Server 2012 and Windows 8) the Internet Explorer Maintenance (IEM) section was removed from GPO Editor. Moreover, this section also disappeared in Windows 7/Windows Server 2008 R2 after Internet Explorer 10 or 11 was installed. If you try to apply the IEM policy to a computer with IE 10 or 11, it won’t work; - On the standard window with the Internet Explorer settings, go to the Connections tab and press the LAN Settings button;
- Tick the checkbox “Use a proxy server for your LAN” and specify the Address and Port of your proxy server (for example, 192.168.1.11, port 3128). To enable this option, press the F6 button (underline for that setting will change the color from red to green). To disable a specific policy setting press F7 (disable the option “Automatic detect settings” this way).
Tip. The green underscore for the IE parameter means this setting is enabled and will be applied through Group Policy. Red underlining means the setting is configured, but disabled. To enable all settings on the current tab, press F5. To disable all policies on this tab use the F8 key. Note the Bypass Proxy Server for Local Addresses option. When this policy setting is enabled, local resources are always accessed directly, not through a proxy server. Windows automatically recognizes the address of the format http://theitbros as local and IE when accessing them bypasses the proxy (Local addresses are all URLs without a domain suffix). However, it is important to note that the addresses of the format http://forum.theitbros.local or http://192.168.0.50 can’t be recognized by the system as a local. In order to avoid using a proxy to access such resources, you need to configure exceptions for them using the policy Do not use proxy servers for addresses beginning with (see below);
- If you need to specify the list of address exceptions, click Advanced. In the field Do not use proxy servers for addresses beginning with specify the list of IP addresses or domains (this option allows you to bypass the proxy for the specified domains/IP addresses). You can use the wildcards in proxy exception list. The exclusion list is a simple string with the list of DNS names and/or IP addresses (values in the list must be separated by a semicolon). For example:
192.*;*.theitbros.com
- Press OK twice to save settings.
Note. This rule only works for Internet Explorer 10 and Internet Explorer 11. For earlier IE versions, you need to create separate rules.
It remains to update group policy settings on client computers (with the command: gpupdate /force), and check proxy settings in IE (Control Panel > Network and Internet > Internet Options > Connections > LAN Settings).
If you want the proxy server settings to be applied to users based on the IP subnet where their devices are located, you can use the GPP Item Level-Targeting. To do this, switch to the Common tab in the policy settings and check the Item-Level Targeting option. Click on the Targeting button.
Select New Item > IP address ranges. Specify the range of IP addresses in your subnet for which you want to apply proxy settings.
Save the policy settings. Similarly, create several IE policies with proxy settings for different IP subnets.
As a result, the proxy settings for the users will be applied depending on the IP network (office) in which they work (convenient for mobile employees with laptops).
Tip. To configure the new IE policy from Windows Server 2008/R2, you need to download Administrative Templates for Internet Explorer, and copy files Inetres.admx and Inetres.adml to the folder %SYSTEMROOT%\PolicyDefinitions.
When a policy with proxy server settings is applied to a user computer, it changes the values of the registry settings under the following key: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings.
Accordingly, you can directly configure the IE proxy settings in registry. In order to configure proxy setting for a current user on your computer, you can use the following PowerShell script:
$proxyregkey = "HKCU:\Software\Microsoft\Windows\CurrentVersion\Internet Settings"Set-ItemProperty -Path $proxyregkey -Name ProxyEnable -Value 1
Set-ItemProperty -Path $proxyregkey -Name ProxyServer -Value "192.168.1.11:3128"
Set-ItemProperty -Path $proxyregkey -Name ProxyOverride -Value '10.*;192.168.*;*.theitbros.com;<local>'
Set-ItemProperty -Path $proxyregkey-Name AutoDetect -Value 0
This means that you can deploy the same registry settings with your proxy configuration to domain-joined computers using GPO (Group Policy Preferences, to be more precise).
Create a new GPO and expand the GPP section User Configuration > Preferences > Registry and create 3 registry parameters in the registry key HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings]:
- ProxyEnable (REG_DWORD) = 00000001;
- ProxyServer (REG_SZ) = 192.168.1.11:3128;
- ProxyOverride (REG_SZ) = 192.*;*.theitbros.com.
Proxy Settings for Computers in Group Policy
By default, IE proxy settings are per user. However, you can use the different GPO to apply proxy settings to all users of the computer. To do this, go to the following section in the GPO Editor console: Computer Configuration > Administrative Templates > Windows Components > Internet Explorer. Enable the policy Make proxy settings per-machine (rather than per user).
Note. The same setting can be enabled through the registry:
$proxyregkey = "HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings"
New-ItemProperty -Path $proxyregkey -Name ProxySettingsPerUser -Value 0
To apply settings to computer objects, also enable the policy Configure user Group Policy loopback processing mode under the Computer Configuration > Policies > Administrative Templates > System > Group Policy. Select the Merge mode in the policy settings.
How to Apply WinHTTP Proxy Settings via GPO?
By default, the WinHTTP service does not use the proxy settings configured in Internet Explorer. As a result, some system services (including the Windows Update service: Wususerv) won’t be able to access the Internet.
Check current WinHTTP proxy settings with the command:
netsh.exe winhttp show proxy

To enable WinHTTP proxy for a computer through a GPO, you must configure a special registry parameter.
First, you need to configure a proxy for WinHTTP on the reference computer. The easiest way is to import proxy settings from IE:
netsh winhttp import proxy source=ie
These settings will be saved in the WinHttpSettings parameter under the registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections.
Now open your proxy GPO and go to Computer Configuration > Preferences > Windows Settings > Registry > New > Registry Wizard.
Select Local computer and specify the full path to the WinHttpSettings parameter.
It remains to click Finish, update the policy on computers, and make sure the WinHTTP proxy settings are applied successfully.
How to Prevent Users from Changing Proxy Settings in Browsers?
By default, if you configure the proxy server settings in Windows through the GPO, computer users can change the proxy settings themselves.
Note that proxy settings in Windows can be edited using both IE options and the modern Settings control panel.
You can prevent users from changing proxy settings in Windows using the “Prevent changing proxy settings” additional GPO option. This parameter is present in both the user and computer GPO sections.
- Computer Configuration > Policies > Administrative Templates > Windows Components – Internet Explorer
- User Configuration > Policies > Administrative Templates > Windows Components Internet Explorer
If you enable this policy and apply it to the domain computer, then the fields with proxy settings in Windows will be blocked, and the caption will appear below: Some settings are managed by your system administrator.
Hint. Settings in the Computer Configuration section take precedence over user settings.
Typically, you want to use a more flexible way of granting permissions to change proxy settings on computers. For example, you can restrict proxy settings for all users except members of the ca_workstation_admins domain security group.
- Create a new GPO with proxy settings (or edit an existing one);
- Go to Group Policy Preferences (User Configuration > Preferences > Windows Settings > Registry) and create two registry values:
The first parameter prohibits changing proxy settings:
Hive: HKEY_CURRENT_USERKey Path: Software\Policies\Microsoft\Internet Explorer\Control Panel
Value name: Proxy
Value type: REG_DWORD
Value data: 00000001
The second parameter blocks the launch of the IE window with proxy settings:
Hive: HKEY_CURRENT_USERKey Path: Software\Policies\Microsoft\Internet Explorer\Restrictions
Value name: NoBrowserOptions
Value type: REG_DWORD
Value data: 00000001
- These policies will apply to all computer users;
- To prevent policies from applying to a specific security group, you need to copy these two parameters, set a larger Order, and change their values to 00000000;
- Then open the properties of each of these two registry settings, go to Common > Item level targeting > Targeting;
- Create a new targeting rule: New > Security Group > provide a group name (ca_workstation_admins);
- Create a similar targeting rule for the second registry parameter;
- As a result, if a user from the specified group logs on to the computer, the proxy settings for him won’t be locked.
It is also worth noting that for .NET Core 3.0 applications (including PowerShell Core 7.x) you can set proxy server settings using the following Windows environment variables:
- HTTP_PROXY:
- HTTPS_PROXY
- ALL_PROXY
- NO_PROXY
You can create and distribute these environment variables to domain user computers using GPP. Just create the required environment variables under Computer Configuration > Preferences > Windows Settings > Environment.
- Author
- Recent Posts
Cyril Kardashevsky
I enjoy technology and developing websites. Since 2012 I'm running a few of my own websites, and share useful content on gadgets, PC administration and website promotion.
Latest posts by Cyril Kardashevsky (see all)
- Configuring Proxy Settings via GPO on Windows - July 20, 2022
- How to Reset or Change Password in Microsoft 365 (Office 365)? - July 17, 2022
- How to Deploy Printers to Users or Computers via Group Policy? - July 14, 2022
FAQs
How do I force proxy settings via Group Policy? ›
- Click Start > All Programs > Administrative Tools > Group Policy Management.
- Create or Edit Group Policy Objects.
- Expand User configuration > Policies > Windows Settings > Internet Explorer Maintenance > Connection.
- Under Proxy Settings, add the proxy information.
...
Navigate to User Configuration -> Preferences -> Windows Settings -> Registry.
- Enable Proxy Settings: ...
- Specify the Proxy Server Address: ...
- Bypass Proxy Server for Local Addresses:
Expand User Configuration, and then expand Preference. Right-click Internet Settings, click New and then click Internet Explorer 10. Click LAN settings on the Connections tab, select the Use a proxy server for your LAN check box. Set the proxy, for example, Proxy1, Port: 80, and then click OK.
How do I set proxy settings for all users? ›- Login to the OS as local administrator.
- Update the Proxy settings as needed from the internet explorer settings.
- Manually enter the proxy that the site is using in the http and https field and set the needed bypasses.
- Open CMD and type: netsh winhttp import proxy source =ie.
- Click Start > All Programs > Administrative Tools > Group Policy Management.
- Create or Edit Group Policy Objects.
- Expand User configuration > Policies > Windows Settings > Internet Explorer Maintenance > Connection.
- Under Proxy Settings, add the proxy information.
- Open Start.
- Search for gpedit. ...
- Browse the following path: User Configuration > Administrative Templates > Windows Components > Internet Explorer.
- On the right side, double-click the Prevent changing proxy settings policy.
Navigate within the folders in regedit to "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings." You should see a setting called "ProxyEnable." Double-click it to edit it. Set it to 1 to enable a proxy server and 0 to disable one, connecting directly to the internet.
How do I configure proxy settings for local system? ›Set up the proxy for a system account
Open the Control Panel, and go to Internet Options > Connections > LAN settings. Click Use a proxy server, and define your proxy settings.
- On your computer, go to Start > Settings.
- Click on the Network & Internet option.
- Within the side menu, click on Proxy.
- Enable the Use setup script option.
- Enter the script address you were given (by your employer, school, or another server owner.) and select Save.
A proxy server is a computer that acts as an intermediary between your computer and your internet service provider (ISP). Your computer's proxy settings manage the connection between your computer and the proxy server.
How do I manage proxy server? ›
- Start the ISM.
- Double-click the computer name of the Proxy Server next to the Web proxy service.
- Select the Service tab.
- Click Current Sessions.
- From the list of connections, click the Refresh button to get an update. ...
- Click Close.
Applies proxy settings to all users of the same computer. If you enable this policy, users cannot set user-specific proxy settings. They must use the zones created for all users of the computer.
How do I change proxy settings on Windows? ›- Click on Start, then click on the gear icon (Settings) at the far left.
- In the Windows Settings menu, click on Network & Internet.
- In the left pane, click on Proxy.
- Here you have all the settings that are related to setting up a proxy in Windows.
- Open an elevated command line: Go to Start and type cmd. Right-click Command prompt and select Run as administrator.
- Enter the following command and press Enter: command Copy. netsh winhttp set proxy <proxy>:<port> For example: netsh winhttp set proxy 10.0.0.6:8080.
- Go to Tools >> Internet Options.
- Click on the Connections tab.
- Click on LAN settings in the Local Area Network (LAN) settings section.
- Click on the Advanced button in the Proxy Server section.
- Add your exceptions in the Exceptions section, separated by semi-colon. ...
- stlouis-mo.gov.
The proxy exception list is used to tell IE to access the URL, Host or IP directly and to not forward the request to the proxy that has been configured under "Use a proxy server for your LAN".
How do I set Internet Options in group policy? ›- User Configuration\Preferences\Control Panel Settings\Internet Settings.
- Select Internet Settings and then right-click to select New and choose the option of Internet Explorer 10.
Here's how to set up a proxy server using Windows 10's built-in settings. First, open your Settings, then click the Network & Internet section. Click Proxy, then make sure Automatically detect settings is turned on. Turn Use setup script on, then enter the script address for whatever proxy you want to use.
Why does my proxy change automatically? ›Some anti-virus or other software can change your proxy settings if they are set to "automatically detect", and this can cause issues. Go to Start Menu or Cortana. Search for Settings and open it. Select Network & Internet.
What is script address in proxy settings? ›What is a script address? It's the URL or IP address of a proxy configuration script that has to be loaded by Windows 10 in order to set the proxy server. If your mind is set on using a proxy server like this, go to the “Automatic proxy setup” section.
How do I find my proxy PAC in Registry? ›
...
Set the proxy . pac file URL (deprecated)
Registry Hive | HKEY_LOCAL_MACHINE or HKEY_CURRENT_USER |
---|---|
Registry Path | Software\Policies\Microsoft\Edge |
Value Name | ProxyPacUrl |
Value Type | REG_SZ |
Default Value |
IE stores its configuration settings in the HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings registry subkey. In this subkey, the ProxyEnable entry controls enabling and disabling IE's proxy settings. Setting ProxyEnable to 0 disables them; setting ProxyEnable to 1 enables them.
How do I check proxy and firewall? ›- Go to the "Start" - "Settings" menu. ...
- In the "Settings" window, look for the "Network and Internet" section, where you need to check.
- In the list on the left, click on the "Proxy" button and disable manual proxy settings in its window.
Select Connections tab. Under Local Area Network (LAN) settings, click on LAN settings button. Under Proxy server, the address and port number for the proxy server used by your computer are shown if the check box for Use proxy server for your LAN option is checked.
How can you install and configure a Web application proxy? ›Example 1: Configure Web Application Proxy on the server
For more information, type Get-Help Get-Credential . The second command configures Web Application Proxy on the local server. The command specifies the name of the Federation Service for which Web Application Proxy provides an AD FS proxy.
Open the Internet Explorer and navigate to the Tools menu > Internet options > connections tab > LAN settings. In the address bar, type the proxy IP address and enter the port value that is used by a proxy server for a client connection. Click OK to apply the changes.
How do you check if proxy is working in Windows? ›- Click the Start button, then click Control Panel.
- In the Control Panel window, click Internet Options.
- In the Internet Options window, go to the Connections tab and click the LAN Settings button.
- If "Use a proxy server for your LAN" is not checked, it means that you don't use a proxy server.
- Select the “Start” button, then type “cmd“.
- Right-click “Command Prompt“, then choose “Run as Administrator“.
- Type “netsh winhttp show proxy“, then press “Enter“.
Click the “Connections” tab in the Internet Options window. Click the “LAN Settings” button. If there is a check mark in the box next to the “Us a proxy server for your LAN” option, then your PC accesses the Web through a proxy server. If there is no check mark in the box, your computer does not use a proxy server.
What does netsh Winhttp set proxy do? ›The Netsh.exe tool is used to configure a system-wide static proxy. You can use commands in the netsh winhttp context to configure proxy and tracing settings for Windows HTTP. The Netsh commands for winhttp can be run manually at the netsh prompt or in scripts and batch files.
How do I configure proxy settings for local system? ›
Set up the proxy for a system account
Open the Control Panel, and go to Internet Options > Connections > LAN settings. Click Use a proxy server, and define your proxy settings.
- Double-click the Internet Explorer icon on your desktop and select Internet Options from the Tools menu. ...
- Click the Connections tab. ...
- Click LAN Settings. ...
- Select the Bypass Proxy Server for Local Addresses check box.
- Click Advanced.
Applies proxy settings to all users of the same computer. If you enable this policy, users cannot set user-specific proxy settings. They must use the zones created for all users of the computer.
How do I enable auto configuration script? ›On the Tools menu, click Internet Options, and then click Connections. Click Settings or LAN Settings. In the Automatic configuration area, check that you've chosen the Use automatic configuration script box, and that it has the correct location to your automatic configuration script or for your automatic proxy URL.
What is configure proxy? ›Published 22 Feb 2017. iOS has a feature that allows you to set up a proxy so that all the network requests from your device are forwarded to a proxy server. This is usually used on business and school networks and can also be used for hiding your IP address or accessing websites that are blocked in your region.
What is system proxy settings? ›Your computer's proxy settings manage the connection between your computer and the proxy server. Malicious software can change your computer's proxy settings, preventing you from accessing the internet.
How do I setup a proxy server in Windows? ›- To access the Windows Settings menu, press the Windows + I keys simultaneously.
- On Windows 10, click Settings > Network & Internet > Proxy. ...
- Scroll down to “Manual proxy setup” and set the “Use a Proxy Server” switch to On.
A VPN can be used to bypass a proxy server or firewall and prevent your computer from being directed to a site it doesn't want to visit. This action provides an additional measure of security for anyone using a public Wi-Fi connection or any other unfamiliar network.
What does it mean to bypass proxy settings for these hosts and domains? ›The Proxy Bypass tab of the Bypass Settings page enables you to define sites that bypass the cloud service for all policies. This may include, for example, internal sites that are not accessible from the Internet, so the cloud service cannot serve or analyze them.
What is the best free proxy? ›- Comparison of the Best Proxy Servers.
- #1) Bright Data (Formerly Luminati)
- #2) HMA.
- #3) Whoer.
- #4) Hide.me.
- #5) Oxylabs Proxy Server.
- #6) 4everproxy.
- #7) CroxyProxy.
What is automatic configuration script for proxy? ›
A Proxy Auto-Configuration (PAC) file is a JavaScript function that determines whether web browser requests (HTTP, HTTPS, and FTP) go directly to the destination or are forwarded to a web proxy server.
Where is proxy server automatically detect settings? ›- Reboot Your Computer and Router. ...
- Review Proxy Settings in Windows. ...
- Run the Network Adapter Troubleshooter. ...
- Auto-Obtain IP Address and DNS Info. ...
- Update or Roll Back Your Network Driver. ...
- Reset Network Configuration via the Command Prompt.
Here's how to set up a proxy server using Windows 10's built-in settings. First, open your Settings, then click the Network & Internet section. Click Proxy, then make sure Automatically detect settings is turned on. Turn Use setup script on, then enter the script address for whatever proxy you want to use.