RE: GPO that forces users to use a proxy server.

From: Jim Harrison (ISA) (jmharr_at_microsoft.com)
Date: 10/29/04

  • Next message: Jef Feltman: "RE: 802.1x Authentication" 
    Date: Thu, 28 Oct 2004 17:55:38 -0700
To: "Ryan Parrish" <RyanP@foxracing.com>, <focus-ms@securityfocus.com>

    Hi Ryan,

    The better way may be to use GPO to set IE to "auto detect.." and create auto-detect support in your DNS/WINS structure.
    This way, when the users go home, IE auto-detection will fail to produce any proxy information and it'll default to "direct" mode.

    If your proxy solution is capable of producing its own response to such a request, so much the better, but without DHCP information 252 data, IE will make a query for http://wpad. suffix>/wpad.dat. If you need a different URL (some folks use proxy.pac as defined by Netscape), then you can use one of your IIS servers to deliver a custom script that you can easily create.

    Proxy.pac reference:
    http://home.netscape.com/eng/mozilla/2.0/relnotes/demo/proxy-live.html

    Jim Harrison
    MCP(NT4/2K), A+, Network+
    Security Business Unit (ISA SE)

    "The last 10 years of Internet usage has disproven
    the theory that a million monkeys typing on a million
    typewriters would eventually produce the complete
    works of Shakespeare. ..or maybe it only works for
    typewriters..."
    (unclaimed)

    -----Original Message-----
    From: Ryan Parrish [mailto:RyanP@foxracing.com]
    Sent: Thursday, October 28, 2004 12:28 PM
    To: focus-ms@securityfocus.com
    Subject: GPO that forces users to use a proxy server.

    We are trying to implement a GPO that forces all users/computers to use a proxy sever for there internet access in the company, but have hit a snag. We have lots of laptop users that we found during testing when they take there laptops home they can access the internet using there own ISP since we set the policy to use a proxy server that is not available to the outside internet, thus they get no internet access.
    Has anybody dealt with this kind of situation before? Is there a way to set a GPO to only be active during business hours?

    _-`-_-`-_-`-_-`-_-`-_-`-_-`-_-`-_-`-_

    Ryan Parrish
    ryanp@foxracing.com
    IT Dept.
    408-776-8633 extension 1229
    Please direct all support questions to -
    (¯`·.¸¸.-> itsupport@foxracing.com

    _-`-_-`-_-`-_-`-_-`-_-`-_-`-_-`-_-`-_

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

    ---------------------------------------------------------------------------
    ---------------------------------------------------------------------------

  • Next message: Jef Feltman: "RE: 802.1x Authentication"