GROUP POLICY??

  • Thread starter Thread starter Guest
  • Start date Start date
G

Guest

I have enabled the Proxy setting on my GP (User config, win set, IE main,
connection) and entere my proxy IP and Port 8080. Now I have VPN users that
log in and can surf IE with no problems, but when they log off our VPN they
can't surf IE at all...how can I correct this. All VPN users log in from the
road/hotels and or home.

I have Win2k and Win2003 servers, both DC are Win2k and the GP reside on
them. All users have WinXP Pro.

Al
 
Al said:
I have enabled the Proxy setting on my GP (User config, win set, IE main,
connection) and entere my proxy IP and Port 8080. Now I have VPN users that
log in and can surf IE with no problems, but when they log off our VPN they
can't surf IE at all...how can I correct this. All VPN users log in from the
road/hotels and or home.
Click to expand...

Forget about using GPO to define the proxy, start using WPAD.
Indipendend from any kind of operating system, discovered via DHCP
and works with all popular browsers.
After configuring WPAD the only policy you need to manage IE is
"Automatically detect settings"
http://www.microsoft.com/technet/prodtechnol/isa/2004/plan/automaticdiscovery.mspx

If they are connected locally or via VPN, they will discover your
internal proxy, if they don´t find it, they are going directly to
the internet.

Mark
 
Mark,

Thanks for the info, but it seems like that will only work with ISA
2000/2004 and I don't want to install that on my server.

Al
 
Hi,
Thanks for the info, but it seems like that will only work with ISA
2000/2004 and I don't want to install that on my server.
Click to expand...

No it works with every Proxy and doesn´t need the ISA. The Article
just mentioned the ISA, because it´s MS and the ISA Client can
handle it a litle bit easier.

All you need is the DHCP Option, the URL and a script file that the
browser can reach to read the proxy settings.

Sorry, didn´t find a better one in english, than this ...
http://www.craigjconsulting.com/setproxy.html
http://www.craigjconsulting.com/proxypac.html

Mark
 
Mark, I did create the DHCP Option 252 per the article in your first
post...but when I remove the Proxy settings in the GPO, I'm able to browse IE
with no problems, meanings my user can do the same and that isn't truly what
I want them to do.
 
also Mark in your second post you mentioned a "script file" but in the
instructions on how to Create an Option 252 Entry no script is created,
unless WPAD.DAT si the script entry.
 
Hi,

1. create clients.wpad, copy to e.g. inetpub\wwwroot
so that it can be reached via http://yourserver/clients.wpad
Edit the "return "Proxy ..." line to your settings.

------- clients.wpad -------
function FindProxyForURL(url, host)
{
if (isPlainHostName(host) || dnsDomainIs(host, ".yourdomain.dom"))
return "DIRECT";
else
return "PROXY yourserver.yourdomain.dom:8080; DIRECT";
}
------- clients.wpad -------

2. Create a option in DHCP and apply the URL
- DHCP Server -> Properties -> Set Predefined Options -> add
- Name: WPAP
Code: 252
Datatyp: String
String: http://yourserver/clients.wpad
- add this option to your scope

3. IIS configuration
if you copied the script to the wwwroot of the defaultwebsite, go to
properities of the website -> http-header -> MIME Types ->
New: x-ns-proxy-autoconfig -> .wpad

4. Change IE to "Automatic detect settings"

Connect the client to your LAN, it will detect yourdomain.com
and starts using your proxy. If I´m outside the LAN it can´t find
the script and will start using the gateway definied by IP Settings.

Mark
 
Hi Mark,

I clearly dont understand your script but let me know if I created it
correctly.

------- clients.wpad -------
function FindProxyForURL(url, host)
{
if (isPlainHostName(host) || dnsDomainIs(host, ".yourdomain.dom"))
return "DIRECT";
else
return "PROXY 192.196.0.xxx.abc.net:8080; DIRECT";
}
 
Hi,
------- clients.wpad -------
function FindProxyForURL(url, host)
{
if (isPlainHostName(host) || dnsDomainIs(host, ".yourdomain.dom"))
Click to expand...

Change this to the name of your DNS. "yourdomain" is just a sample.
return "DIRECT";
else
return "PROXY 192.196.0.xxx.abc.net:8080; DIRECT";
Click to expand...

Then you mix IP and Name of proxy, decied one...
name or IP.
If your proxy is: 192.196.0.1
and the name is : myproxy.yourdomain.dom

use 192.196.0.1:8080 or myproxy.yourdomain.dom:8080
... if 8080 is the port of your proxy, 3128 is also where common ...

Mark
 
Al said:
I clearly dont understand your script [...]
Click to expand...

Addition:
| if (isPlainHostName(host) || dnsDomainIs(host, ".yourdomain.dom"))
| return "DIRECT";

means, that if you are accessing website inside your LAN, then
the client will not use the proxy.
Similar to IE Settings: bypass proxy at local adresses
(or whatever the right translationb is ;-)

Syntax of the proxy script and a few more examples:
http://wp.netscape.com/eng/mozilla/2.0/relnotes/demo/proxy-live.html

Mark
 
Ok Mark,

I corrected the scrip and just used the name instead of IP. But no luck.
Once I disable the GP and run gpudate on a WinXP machine I can still browse
the internet freely meaning my user can browse all kinds of web sites. So I
had to place the GP back on.

I just need to find a way for the users VPN to browse when they are at home
and not VPN'd in. If I clear the Proxy tab on IE then other users can clear
and surf freely so I can't do that. Currently the tab is blocked so users
cant change the Proxy tab, but when I users at home they can't surf the net
because they can't clear the Proxy tab, hope that makes sense. Again,
thanks for your help.
 
Hi,
I corrected the scrip and just used the name instead of IP. But no luck.
Once I disable the GP and run gpudate on a WinXP machine I can still browse
the internet freely meaning my user can browse all kinds of web sites. So I
had to place the GP back on.
Click to expand...

So, they don´t use the proxy?
Just to test that your envirnment works with WPAD, remove the
Default gateway from a test client ... as long, as the client
can´t browse, your WPAD isn´t working properly ...

Mark
 
Back
Top