I recently scaled out the web cache/proxy systems at work and had to make changes to how it was configured for clients via Group Policy. However when I rolled the changes out, the resulting configuration was not as expected, even when I used the Group Policy Modeling feature of the Group Policy Management console. I decided to look closer at the GPO configuration.
In the previous setup, students and staff had proxies configured in their respective GPOs. This was fine at the time because they used separate proxies for different filtering levels. However my new proxy setup allowed both user groups to use a common proxy, in turn allowing me to configure the setting higher up in the OU structure.
Previous setup:
OU: Users --> Global User Configuration GPO [no proxy set] OU: Users/Students --> Student Configuration GPO [student proxy set] OU: Users/Staff --> Staff Configuration GPO [staff proxy set]
New setup:
OU: Users --> Global User Configuration GPO [common proxy set] OU: Users/Students --> Student Configuration GPO [no proxy set] OU: Users/Staff --> Staff Configuration GPO [no proxy set]
My new configuration refused to work - no proxy settings were applied to clients at all! Running a Group Policy Model in the GPMC confirmed this - no proxy settings were even mentioned in the settings report. I created a test user in the "Users" OU and ran a model - the user received the settings! I concluded that something in the Students and Staff GPOs was throwing the settings off.
I opened the Student Configuration GPO and examined Internet Explorer Maintenance --> Connection --> Proxy settings. Sure enough, the "Enable Proxy Settings" check box was unchecked. It then occurred to me that most Group Policy settings have three states - Enabled, Disabled and Not Configured. It could be possible that unchecking the box would set the option to Disabled, thereby overriding the settings from the Global User Configuration GPO.
By chance I happened to right click on the "Internet Explorer Maintenance" node in the left pane of the GPO Editor and noticed the option "Reset Browser Settings". I selected it and re-ran the GPO model for a student and saw the proxy settings were now being inherited from the Global User Configuration GPO - no longer being blocked by the Students/Staff GPOs!
Quite a bizarre way of controlling proxy settings, considering most other configuration is done in the standard Enabled/Disabled/Not Configured way!
