Differences

This shows you the differences between two versions of the page.

--- playground:playground [2026/08/08 19:55] – superwizard
+++ playground:playground [2026/08/13 02:50] (current) – superwizard
@@ Line 1: / Line 1: @@
 ====== PlayGround ======
-Yes. In a Windows Active Directory domain, you can use **Group Policy** to turn off proxy settings on domain-joined computers. The exact method depends on whether you want to disable only the **manual proxy server**, or also disable **automatic proxy detection and setup scripts**.
-Given your environment with a Windows Server 2016 domain controller and Windows 10/11 clients, I would recommend explicitly setting all three Windows proxy options to **Off**:
-  * **Automatically detect settings:** Off
-  * **Use setup script:** Off
-  * **Use a proxy server:** Off
-Microsoft confirms that Windows stores these proxy settings under the current user's Internet Settings registry area, while WPAD can additionally be disabled at the computer level. [[https://learn.microsoft.com/en-us/answers/questions/5593693/remove-all-settings-about-proxy-in-client-windows|Microsoft Learn]]((https://learn.microsoft.com/en-us/answers/questions/5593693/remove-all-settings-about-proxy-in-client-windows?utm_source=chatgpt.com "remove all settings about proxy in client Windows 10/11"))
-===== Recommended approach for your AD domain =====
-In **Group Policy Management**, create a GPO such as:
-<code>
-Disable Windows Proxy Settings
-</code>
-Then edit it and go to:
-<code>
-User Configuration
-└── Preferences
-    └── Windows Settings
-        └── Registry
-</code>
-Create these registry preference items:
-^ Hive               ^ Key Path                                                    ^ Value Name     ^ Type       ^ Value      ^
-| HKEY_CURRENT_USER  | Software\Microsoft\Windows\CurrentVersion\Internet Settings | ProxyEnable    | REG_DWORD   | 0            |
-| HKEY_CURRENT_USER  | Software\Microsoft\Windows\CurrentVersion\Internet Settings | AutoDetect     | REG_DWORD   | 0            |
-| HKEY_CURRENT_USER  | Software\Microsoft\Windows\CurrentVersion\Internet Settings | AutoConfigURL  | REG_SZ      | *(empty)*    |
-This produces the equivalent of:
-<code>
-Settings
-└── Network & Internet
-    └── Proxy
-        ├── Automatically detect settings: Off
-        ├── Use setup script: Off
-        └── Use a proxy server: Off
-</code>
-===== Prevent users from turning the proxy back on =====
-You can also configure:
-<code>
-User Configuration
-└── Policies
-    └── Administrative Templates
-        └── Windows Components
-            └── Internet Explorer
-                └── Prevent changing proxy settings
-</code>
-Set this policy to **Enabled**. This prevents users from manually changing the proxy configuration. The underlying policy uses the `Proxy` value under the Internet Explorer Control Panel policy registry location. [[https://insiderthreatmatrix.org/preventions/PV060|Insider Threat Matrix™]]((https://insiderthreatmatrix.org/preventions/PV060?utm_source=chatgpt.com "Disable Proxy Configuration on Windows Systems"))
-===== One important distinction for your environment =====
-Windows actually has **two major proxy systems**, which can make this topic a small networking hydra 🐉:
-<code>
-WinINET proxy
-    Used by:
-    - Windows user settings
-    - Edge/Chrome in many configurations
-    - Applications using Windows Internet APIs
-WinHTTP proxy
-    Used by:
-    - Windows services
-    - Some system components
-    - Server applications
-</code>
-You can check the WinHTTP proxy on a computer with:
-<code powershell>
-netsh winhttp show proxy
-</code>
-Microsoft documents this command for examining the current WinHTTP proxy configuration. [[https://support.microsoft.com/en-us/topic/skype-for-business-front-end-servers-connecting-to-exchange-online-for-oauth-doesn-t-use-proxy-server-a3a1a2f9-2ad6-5414-33a6-9897a78252f9|Microsoft Support]]((https://support.microsoft.com/en-us/topic/skype-for-business-front-end-servers-connecting-to-exchange-online-for-oauth-doesn-t-use-proxy-server-a3a1a2f9-2ad6-5414-33a6-9897a78252f9?utm_source=chatgpt.com "Skype for Business Front-End Servers connecting to ..."))
-If your objective is **"make sure all domain computers have no proxy configured, and users cannot enable one,"** I would use a slightly more comprehensive GPO that handles **WinINET, WPAD, automatic configuration scripts, and WinHTTP**. For your small AD environment, I can give you the exact GPMC configuration I would recommend, including every registry preference and policy setting.