Proxy exceptions not applying

[jcwarren]

We have a situation in which Windows 7 x64 sp1 workstations deployed within the last few weeks are not completely processing our proxy server settings, specifically the proxy exceptions list. I've not encountered a situation where a policy was partially applied and am at somewhat of a loss as to how to determine the cause of the issue. The proxy config seems to be the only GPO setting that isn't applying properly.

I inherited Group Policy administration for workstations but the GPO used to configure proxy server settings has been in place for years and working fine until recently with problems only for Win7 PCs.

Proxy settings: User Configuration | Windows Settings | Connection | Proxy Settings
- Enable proxy settings = server & port for all protocols
- Exceptions = *.domain.com,*.corp.domain.com, etc.
- Loopback (merge) enabled

A gpupdate /force seems to populate the exceptions list properly. Of course, none of the techs reporting the problem have gathered any useful information and have all manually added the exception list into Internet settings foregoing gpupdate (and then complaining about the image build). I've solicited their assistance for capturing event logs and rsop reports but thought it wise to ask the experts here on the forum.

What might cause policies to be partially applied?
Is there something unique about proxy settings that could cause this behavior?
Any suggestions as to how to approach remediating the situation?

Thanks in advance for any insight you might be able to provide.

~ JC

[trekker]

If the policy was applying properly, your techs wouldn't be able to populate it manually. So, my initial thought is that there is some kind of problem with it applying. I would run a gpresult /h on one of the boxes that is actively having the problem to see if the policy is applying at all. I would also check out the Event Log on one of those boxes to see if you're getting any errors.

[jcwarren]

Thanks for the response Trekker. The proxy server and exceptions field have always been editable in the Internet settings dialog box. That has never made much sense to me but I've not had the luxury of further investigation. It does what it's supposed to do, configure proxy stuff, so we've left it alone. It all still works fine on XP. Still don't understand why half of the policy would apply (proxy server) but not the exceptions list.

We're scheduled to deploy some more Win7 boxes today so hopefully I can get some more info.

[jcwarren]

Finally resolved the issue.

There apparently is a bug in the IEAK wizard which writes a proxy section to the Install.ins file even when selecting the 'Do not customize...' option for the Connection page in the wizard. This causes the proxy server settings to be overwritten (cleared) for each new user profile on a target machine.

The Install.ins file must be edited PRIOR to completing the wizard.

1. Run IEAK 9 wizard and configure desired options
2. Stop at the last screen ('Wizard Complete')
3. Edit the Install.ins file, deleting the entire [Proxy] section
- <local path>\INS\AMD64_WIN7\ENU\Install.ins
4. Return to wizard and complete installation package creation
5. Copy <local path>\FLAT\AMD64_WIN7\ENU\IE9-Setup-Full.msi to network location
6. Install from network location

You'll need to run through the IEAK wizard and edit the Install.ins file for each architecture. After installation, the Install.ins file is found at %ProgramFiles(x86)%\Internet Explorer\Custom. This file is used to configure IE for each new user profile.

Hope this helps someone in the future.

[brad]

Thanks for using GPAnswers


Brad Rudisail
Tech Support for GPanswers and PolicyPak Software