Marcus Hall

In Group Policy Management, create a GPO such as:

Disable Windows Proxy Settings

Then edit it and go to:

User Configuration
└── Preferences
    └── Windows Settings
        └── Registry

Create these registry preference items:

This produces the equivalent of:

Settings
└── Network & Internet
    └── Proxy
        ├── Automatically detect settings: Off
        ├── Use setup script: Off
        └── Use a proxy server: Off

You can also configure:

User Configuration
└── Policies
    └── Administrative Templates
        └── Windows Components
            └── Internet Explorer
                └── Prevent changing proxy settings

Set this policy to Enabled. This prevents users from manually changing the proxy configuration. The underlying policy uses the `Proxy` value under the Internet Explorer Control Panel policy registry location. Insider Threat Matrix™²⁾

Windows actually has two major proxy systems, which can make this topic a small networking hydra 🐉:

WinINET proxy
    Used by:
    - Windows user settings
    - Edge/Chrome in many configurations
    - Applications using Windows Internet APIs

WinHTTP proxy
    Used by:
    - Windows services
    - Some system components
    - Server applications

You can check the WinHTTP proxy on a computer with:

netsh winhttp show proxy

Microsoft documents this command for examining the current WinHTTP proxy configuration. Microsoft Support³⁾

If your objective is “make sure all domain computers have no proxy configured, and users cannot enable one,” I would use a slightly more comprehensive GPO that handles WinINET, WPAD, automatic configuration scripts, and WinHTTP. For your small AD environment, I can give you the exact GPMC configuration I would recommend, including every registry preference and policy setting.

^{4) 5) 6)}