GPO's in W2k3

[kr5kernel]

So I recently upgraded to the group policy management console on my windows 2003 server, and i have noticed something a little weird.

I have setup a gpo that forces a certain OU to use a proxy for internet filtering. I am noticing that another OU, though not linked or set to use the filtered policy is also using the proxy, even though its policy says to not detect internet settings, and not to use a proxy. Any ideas?

When i check out the OU of the unfiltered computers, it only has listed the unfiltered policy and thge default domain policy, which does not point to the proxy either.

[rapier57]

This may not have to do with the GPO tool, but with the fact that IE default settings are to automatically configure for a proxy (if available). If you have a policy in an OU that sets the IE configuration so that it won't bother to even look for a proxy, you may need to run a gpupdate on the systems in that OU to see if the policy is going down. Or, you can run a resulting set of policy in the group policy management tool to see where the policy is being blocked.

[dinowuff]

Originally posted here by rapier57
If you have a policy in an OU that sets the IE configuration so that it won't bother to even look for a proxy

And until you set the policy new installs and IE upgrades will use the proxy.

[kr5kernel]

I am not sure I am following, when I disable the policy and logon the machine, the proxy is set in IE, which I don't remember setting at all....

Shouldn't the gpo take precedence when I specifically not to use a proxy?

[Timmy77]

Yes, the GPO will take precendence when you set it to not use the proxy.

The challenge is that with this setting, it may be being read as "not configured" rather than "configured as empty." In that case, the workstation will default to whatever settings it was configured with before...which may include your proxy.

[kr5kernel]

Thats what I figuired, but the weird thing was that it was never configured to use the proxy before, it just kind of "popped in there" after the gpo was created....its almost like it auto searched for settings or a proxy, even though I disabled (specifically disabled) not to do so.

For the mean time I just disabled the policy and disabled the proxy on the machines (6 of them, so it wasn't too annoying) but if I was doing this in a large scale environment, that would have sucked.

[Timmy77]

The other option could be to set a bogus proxy in there, with everything listed as an internal exception. That would let them get to the intranet, but not out through the proxy server.

[kr5kernel]

i dont know what happened, but now it just works as it should, I added 2 more machines that never had a proxy configured, threw them in the ou the gpo in question is applird to and bam, it worked like a champ.

Perhaps my gremlins have returned, or i am on ancient burial ground or something....thanks for all the help.

[Timmy77]

Perhaps it's gremlins who live on an ancient burial ground.

Did you allow enough time for DC replication, previously?