ActiveX UAC and Proxy Settings via GPO

Hi there,
Wondering if anyone can help.
I am experiencing the following issue when trying to load ActiveX control without UAC prompts for standard users.
I have:
Configured ActiveXInstaller Service and configured allowed sites and settings via GPO.
Configured IE Security settings for the Trusted Zone to Allow ActiveX content to run via GPO.
Configured IE to use per user proxy settings via GPO.
Allowed the domain in our proxy and bypassed authentication for that domain.
Everything seems to be in place but I receive a UAC prompt for the Internet Explorer Add-on Installer UNLESS I either turn off the IE proxy settings or add the domain to the IE proxy exclusions list.
Unfortunately neither of these are options in our environment..
Anything I've missed?
Thanks!

Hi,
Before going further, what's the operating systems you are using? How did you configure
approved Installation Sites for ActiveX Controls and Active X installation policy for sites in Trusted zones settings?
Regarding how to configure these two settings, we can refer to the following article for double check.
Administering the ActiveX Installer Service in Windows 7
http://technet.microsoft.com/en-us/library/dd631688(v=ws.10).aspx
Besides, we can also run command gpresult/h gpreport.html with admin privileges to collect group policy result report to check if the policy settings are applied correctly.
Best regards,
Frank Shen

Similar Messages

Windows 8 and IE10 not accepting Proxy Settings via Group Policy

We have recently introduced a couple of Windows 8 computers in our network, and we are having issues applying the Internet Explorer Proxy Server settings.
We use a Microsoft TMG 2010 server as our proxy server for accessing the internet.
We have been using a GPO with the following settings to automatically configure our Windows 7 computers running IE9 with the appropriate Proxy settings:
User Configuration\Policies\Windows Settings\Internet Explorer Maintenance\Connection/Proxy Settings
“Enable Proxy Settings” : Checked
“Address of proxy” : server.domain.local
“Port” : 8080
“Use the same proxy server for all addresses” : Checked
“Exceptions” : Here we have a list of several internal or partner sites that should not be proxied.
This GPO has worked beautifully for our Windows XP and Windows 7 users with IE 7, 8 and 9.
Now with Windows 8 and IE10, this no longer works.
I’ve therefore added a Windows Server 2012 Domain Controller to the network, and using GPMC on that new DC, I created a new GPO with the following settings:
User Configuration\Preferences\Control Panel Settings\Internet Settings\Internet Explorer 10
Now, seeing as these are preferences, it’s a little different. But, I’ve “checked off” the option “Use a proxy server for your LAN” as well as “Bypass proxy server for local addresses”.
Then I click on “Advanced” and setup all my proxy settings the way I would like them, including the proxy server name, port and exceptions list.
When this new group policy gets applied to my Windows 8 PC, the only setting that gets applied is the “Use a proxy server for your LAN”.
It does not configure the name or port of the proxy server nor does it configure the exceptions list.
If I go back to the GPMC, and edit the new GPO, the settings are all there.
However, if I just view the settings from the main GPMC screen (without opening the GPO itself),
I don’t see all of those settings (again, only the one “Use a proxy server…”)
What am I missing???

Hi All, - (Revised Answer by myself)<o:p></o:p>
I banged my head against the keyboard on this one for some time trying to get this group policy to apply. I
did every thing that was suggested, learning about the F6 and F7 keys to Green underline and Red underline the options required and not required. I even gave in and used the registry settings and it still did not work. It turned out that I had
2 issues. The first one is obvious and the second not so obvious, this is how it is setup:
I have a 2012 R2 Standard DC with Windows 8.1 clients/workstations and IE 11. As you are aware you must make
sure that the following are underlined in green:
Automatically detect settings - (but not ticked)<o:p></o:p>
Use proxy server for your LAN<o:p></o:p>
Bypass Proxy for local address<o:p></o:p>
Next I made sure that the following had red dotted lines:
Address<o:p></o:p>
This still didn't work, so I went through my 'Do Not use proxy servers for addresses beginning with' removed all
of these and then re-added one by one until the problem materialized. The first issue was when using wildcards I had added an entry with the following:
http://domain.subdomain.com/*
Then caused my proxy fields not to be applied, I re-added this just with:<o:p></o:p>
http://domain.subdomain.com/
<o:p>This next one is IMPORTANT.</o:p>
I had these entries in a Word document of which I had copied and pasted from the entry box for 'Do
Not use proxy servers for addresses beginning with'. As shown in the screen shot above provided by SVEN_BURGER I had very similar entries:
http://domain.subdomain.com/;10.*.*.*;172.27.*.*;http://172.27.*.*
Each time I copied and pasted the line (+ more) above the proxy field on the Windows 8.1 client
be blank after using 'gpupdate /force' I then noticed that in my Word document the whole string was being seen as 1 URL due to the http part at the beginning, so I changed my entry to look like this:
10.*.*.*;172.27.*.*;http://172.27.*.*;http://domain.subdomain.com/
I again noticed that this section:
http://172.27.*.*;http://domain.subdomain.com/
Was being seen as one URL in my Word document. To resolve this I had to add the URL's individually and
apply and OK these before going back in and making the next entry. So I ended up adding them all individually after separating the
URL's in my Word document.
I hope this helps.

Windows 8 and IE10 and 11 not accepting Proxy Settings via Group Policy from windows server 2003

Hi
We are still running Windows Server 2003 with a Win7 and Win8 desktop environment. I can control Win7 IE9 settings,
But Win8 systems are running IE10. We have an internal proxy server.
Is there any way to force the proxy settings to the Win8/IE10 or 11 systems .
i have tried with The IE 10 .adm template and applied gpo,but does not have any proxy settings for ie10 and no changes were applies
please can anyone help me regarding this
i want to apply GPO from windows server 2003 to windows 8 ie10/11
Thanks
KNC

Hi,
I agree with Zanderol24, we can install RSAT on a windows8 client, and then we can use Group Policy Management to manage group policy from the client.
For more information about RSAT, we can refer to the following link:
Remote Server Administration Tools (RSAT) for Windows Client and Windows Server (dsforum2wiki)
http://social.technet.microsoft.com/wiki/contents/articles/2202.remote-server-administration-tools-rsat-for-windows-client-and-windows-server-dsforum2wiki.aspx
For more detailed information about how to use GPP to configure the proxy setting for ie10 and ie11, we can refer to the following link:
How to configure Group Policy Preference settings for Internet Explorer 11 in Windows 8.1 or Windows Server 2012 R2
http://support.microsoft.com/kb/2898604
When we use GPPs you need to be aware of the F5-F8 keys:
Red / Green: GP Preferences doesn’t work even though the policy applied and after gpupdate \force
http://blogs.technet.com/b/grouppolicy/archive/2008/10/13/red-green-gp-preferences-doesn-t-work-even-though-the-policy-applied-and-after-gpupdate-force.aspx
Besides, aside from using group policy to manage IE, IEAK can also be used to do this.
For IEAK, the following article can be referred to for more information.
Internet Explorer Administration Kit (IEAK) Information and Downloads
http://technet.microsoft.com/en-in/ie/bb219517.aspx
Best Regards,
Erin

Error at RSOP while trying to set Audit settings via GPO

Hello,
i've configured Audit Policy via GPO and when i run RSOP on the server 2008 R2 i get X with the error "the policy engine did not attempt to configure the setting For more
information, see %windir%\security\logs\winlogon.log on the target machine.
Please help???

Hi,
This problem may occur if the "Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings" policy setting is enabled. To resolve this issue, use one of the following methods, as appropriate for your situation.
Method 1: Disable the policy setting by using Group Policy Object Editor
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options\Audit: Force audit policy subcategory settings (Windows Vista or later) to override audit policy category settings
Method 2: Disable the policy setting by using Registry Editor
Note: Please backup the registry key before modify.
1.Locate and then click the following registry subkey:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\LSA
2.Right-click SCENoApplyLegacyAuditPolicy, and then click Modify.
3.Type 0 in the Value data box, and then click OK.
Restart the computer after you make the change.
For more information, please refer to:
Security auditing settings are not applied to Windows Vista-based and Window Server 2008-based computers when you deploy a domain-based policy
http://support.microsoft.com/kb/921468/en-us
RSOP: the policy engine did not attempt to configure the setting
http://social.technet.microsoft.com/Forums/en-AU/winserverGP/thread/fde42cfc-bb74-4e11-8b60-c1a3cb5d80ed
If the problem still continues, please check the %windir%\security\logs\winlogon.log and reply the information in this log.
Regards,
Bruce

Itunes and proxy settings. Itunes keeps the proxy setting from IE and I can't adapt it due to company policy. How can I force itunes to use firefox?

itunes can not connect to server and I can't find its proxy settings.
So I think it uses these from IE and those are blocked by company policy.
So, how can I force itunes to use the firefox settings

I fixed this issue (with help from tech support) and it involved several things.
After adding a song to iTunes, right-click on the song in iTunes and select "Update iTunes Match."
OR go to the iTunes menu-->Store-->Update iTunes Match.
Maybe that's the reason, it just hadn't updated to the cloud.
OR maybe it's not a high-enough bitrate file. This happens to me because most of my tunes are home-recorded.
Sometimes converting to .mp3 or Create AAC version might work. (You do this with a right-click in iTunes, and then you will want to remove the original file from iTunes.)
There is an iTunes Preferences setting, under General Preferences called Import Settings. Try setting it to AAC Encoder and iTunes Plus. That (I think) causes imports to be slightly better quality.
Good luck! The tech support person at Apple is requesting that a knowlege-base article be written about this.

Httpurlconnection and Proxy settings

hi all,
I wrote a servlet that uses an HTTPUrlConnection to get a page from a remote server and the code looks like this :
url = new URL(urlstr);
HttpURLConnection uc = null;
System.getProperties().put( "proxySet", "true" );
System.getProperties().put( "proxyHost", "[myproxyhost]");
System.getProperties().put( "proxyPort", "[myproxyport]);
uc = (HttpURLConnection) url.openConnection();
The code works fine for the particular connection.
If I need to get another page though another connection that needs no Proxy settings, it doesn't work.
How can I deactivate the proxy settings between the two connections?
And, finally, how can I leave the System settings in the same state as before the code execution?
Thank you.
Nicola

You could trySystem.getProperties().put( "proxySet", "false" );to temporarily turn off the proxy settings. Or you could trySystem.getProperties().remove( "proxySet");
// and the other two similarlyto remove those system properties.

Disable Firewall for Windows 8.1 in Domain Location Network Settings via GPO

I have Clients OS XP, 7, 8 and 8.1 Now I want disable only 8.1 firewall automatic via GPO. It's possible to apply only Windows version purpose with out any group and OU.
Md. Ramin Hossain

Hi Md,
In addition to Carl's suggestions, regarding how to create queries for a specified version of Windows, the following article can be referred to for more information.
Create WMI Filters for the GPO
http://technet.microsoft.com/en-us/library/jj717288.aspx
TechNetSubscriber Support
If you are TechNetSubscription user and have any feedback on our support quality, please send your feedback here
Best regards,
Frank Shen

How To Copy and run files Via GPO

HI All,
Our Domain got 300 PC's and UltraVNC is installed. Now i need to enable the MS Logon and add Security Groups.
I have export the VNC Ini file from Working computer.
also export the ACL into txt file
Exporting an ACL
MSLogonACL /e file (vnc.txt)
I have test by coping the ini file and run the ACL . Found All OK
MSLogonACL /i /a file
(vnc.txt)
"%ProgramFiles(x86)%\UltraVNC\MSLogonACL.exe" /i /o \\server\softwareshare\ultravncserver
\vnc.txt
So how do i do this via GPO?
AS

Hi,
I agree with Martin. We can run the script as a batch file. Before we deploy the script via group policy, we need to test it on a machine to see if it can run properly.
Besides, regarding how to utilize group policy to assign startup scripts, the following article can be referred to for more information.
Assign computer startup scripts
http://technet.microsoft.com/en-us/library/cc779329(v=WS.10).aspx
TechNet Subscriber Support
If you are TechNet Subscription user and have any feedback on our support quality, please send your feedback here.
Best regards,
Frank Shen

IPad and proxy settings for more than AppStore and Safari?

Why am I having problems w/ most apps and the proxy settings? My corp. network requires proxy settings to get to the internet and only the AppStore and Safari (and a few specifically designed apps) will use the proxy settings. All other apps simply do not work.
Is this an Apple problem? Why was this not addressed by Apple?

NestOfRobins wrote:
That sounds like a "cop-out" to me. Do individual applications on desktop machines have to be "proxy aware"?
Yes, they have. Not only on iPad, but every internet application, on Mac or on PC or on *nix, have to be coded internally to use proxies. Some are, and are also smart enough to check for any proxy info on network options of your system, some other will have the proxy info to be given in internal application setup, and some other, simply does not know what proxies are.
NestOfRobins wrote:
How can Apple expect to compete in the Enterprise space with this glaring hole in their operating system? Why can't there be a setting, e.g., "all internet traffic to use proxy server".?
That is a SOCK, and is another different stuff. There is no hole in the O.S., it is the app you want to use, because that app wants connect the internet by herself, without using your proxy.
Best advice is, you ask that app's developer, to add in future releases, proxy connectivity or (best) to check if network requires a proxy and act accordingly without bother the user on the issue
Anyway, I'd like answer also your other questions:
NestOfRobins wrote:
Why am I having problems w/ most apps and the proxy settings?
You have problems because that apps don't think about the proxy setting you have in your network configuration (app poorly coded), or they require direct internet access in their specs (app aware of proxy, and do not want use it), access that you don't have because of proxy. Not your fault. Nor Apple's
NestOfRobins wrote:
this an Apple problem? Why was this not addressed by Apple?
Not an Apple problem, so there is nothing to address.

Setting WMI and Registry permissions via GPO?

Hi,
I am configuring SCOM 2012 R2 for my environment. To configure it for SQL Serve,r I neeed to do the following:
Grant Read permission on HKLM:\Software\Microsoft\Microsoft SQL Server registry path for SQLDefaultAction and SQLMPLowPriv
Grant “Execute Methods”, “Enable Account”, “Remote Enable”, “Read Security” permissions for root, root\cimv2, root\default, root\Microsoft\SqlServer\ComputerManagement11 WMI namespaces to SQLDefaultAction and SQLMPLowPriv
Grant Read permission on HKLM:\Software\Microsoft\Microsoft SQL Server\[InstanceID]\MSSQLServer\Parameters registry path for SQLMPLowPriv for each monitored instance
So I need to assign registry permissions and wmi permissions.
Is there a way to do this via GPO?
Thanks

Hi,
You can not change the permission by using group policy directly.
Steps to solve your requirement,
1. Using the SetACL tool you can automate the management of Windows permissions. It is inherently automatable and scriptable. The
COM version provides the full functionality to any COM-enabled programming language (C#, Visual Basic, C++, Delphi, PowerShell, VBScript, …).
Supported object types: files and folders, registry keys, printers, services, network shares, WMI
So using this tool you can create script to automate Windows permissions.
2. Then you can use the created script as the Startup script in the GPO with privileges to allow the permission changes.
Checkout the below links on similar discussion,
http://social.technet.microsoft.com/Forums/windowsserver/en-US/87d4ed25-5247-41e4-8bb6-e29a078a1da0/change-permissions-for-a-specific-key?forum=winserverGP
http://social.technet.microsoft.com/Forums/en-US/c60ad5bb-309e-471d-9f48-e04e897ba61b/problems-setting-registry-permissions-via-gpo?forum=winserverGP
Regards,
Gopi
www.jijitechnologies.com

JRE and Proxy Settings

Hello,
I've created a proxy.pac that's been deployed to our ouposts. It works fine except for one web application which is using java.
Now, I figured out that it's because I have to not only change the proxy-settings for IE and Firefox, but also for Java. Point is, it's user-based. So every user has to make these changes to make them become active.
My question is: Is there a way (probably by manipulating the net.properties) to make this change systemwide and not only limited to a single user?

The application is a browser based application. It's partially HTML/XML (right frame with content) and partially Javabased (left frame with navigation tree).
Now when I change the browsers' settings to use a pac-file as a proxy configuration file, the HTML/XML-based part is using the proxy setting that is set in the browsers' properties and connects by using the proxy. But the Java-side of the application seems to ignore these settings and tries to get a direct connection to the application. This ends in two different sessions where you have to login again in order to see the navigation-tree displayed. Since these two sessions are different from each other, they won't work together.
After correcting the proxy settings for the java runtime engine to also work with the configurationfile it works just fine.
As I said, we already found a solution for the problem itself. All we need to have now is a way to make the proxy-settings for java systemwide for we don't want to correct these settings for each and every user.

Nokia Suite and proxy settings

Hi,
the suite has a big bug. Instead of using any Windows network connection, it defines its own proxy settings which is obviously nonsense. I entered the correct proxy credentials, it still fails to connect to the internet. If it would rely on Windows' own mechanisms, it could like just any other program.
Conclusion: Nokia suite is unusable in a business environemt.
Olaf

In my campus where i live our network needs a proxy so the 1st problem was to download Nokia Suite. even i was not able to download it from its official site. Kindly look into this.
Now when i got it and installed i cannot find a button of settings as it is in rest of the s/w's. there is a button called Tools but its value is 0. Due to this iam not able to log into my account and furture proceed.
I have attached a screen shot of PC Suite window showing View, Sync and Tools buttons have a value 0.
Kindly look into this matter.
Attachments:
nokia.JPG ‏33 KB

Shockwave player and proxy settings

Hi,
all clients our company must use a web-proxy to connect with the internet.
If anyone want to watch a stream with rtmp://....swf , nothing happens.
RTMP should work with port 1935 and fallback to 443, 80.
Problem: shockwave ignores the proxy settings from browser and Device. He tries to connect
directly without proxy, whitch is not working of course..
Are there any options to configure the proxy settings for Shockwave or is this a bug?
Thanks for any help!

I think you're looking for a Flash Player forum

9ias and Proxy Settings for Client(Urgent !!! )

Dear All,
I am facing a very strange problem.
Our application is running on Oracle 9ias installed on Windows2000.
When I access this from a WindowsXP M/C with browser(IE 6.0) privacy settings as medium(which is by default medium)and without IP address of 9ias m/c.(Which is infact not required),I do not get the menu of my application generated.
I some how did some hit and trial and now when I put
the IP in proxy settings of my client Browser, I am able to get the menus.
Can anyone give some hint or somebody has faced the
problem like this.
Thanks in advance.
Regards
Dushyant

NestOfRobins wrote:
That sounds like a "cop-out" to me. Do individual applications on desktop machines have to be "proxy aware"?
Yes, they have. Not only on iPad, but every internet application, on Mac or on PC or on *nix, have to be coded internally to use proxies. Some are, and are also smart enough to check for any proxy info on network options of your system, some other will have the proxy info to be given in internal application setup, and some other, simply does not know what proxies are.
NestOfRobins wrote:
How can Apple expect to compete in the Enterprise space with this glaring hole in their operating system? Why can't there be a setting, e.g., "all internet traffic to use proxy server".?
That is a SOCK, and is another different stuff. There is no hole in the O.S., it is the app you want to use, because that app wants connect the internet by herself, without using your proxy.
Best advice is, you ask that app's developer, to add in future releases, proxy connectivity or (best) to check if network requires a proxy and act accordingly without bother the user on the issue
Anyway, I'd like answer also your other questions:
NestOfRobins wrote:
Why am I having problems w/ most apps and the proxy settings?
You have problems because that apps don't think about the proxy setting you have in your network configuration (app poorly coded), or they require direct internet access in their specs (app aware of proxy, and do not want use it), access that you don't have because of proxy. Not your fault. Nor Apple's
NestOfRobins wrote:
this an Apple problem? Why was this not addressed by Apple?
Not an Apple problem, so there is nothing to address.

IE, Disable 'Automatically Detect Settings' Via GPO

Hi guys,
We have recently been having a small problem with IE, whereby the 'automatically detect settings' check box will get ticked - resulting in our users not being able to traverse our proxy server.
I use the User Configuration > Policies > Windows Settings > IE Maintenance > Connection to set up our proxy settings, however I can't see an option to explicitly disable the 'automatically detect settings' check box.
Is this located somewhere else in an admin template, or am I simply missing an option that is right in front of me?
Thanks.
Glen

here is a script that does the trick: source
http://www.craig-tolley.co.uk/2011/08/30/disable-automatically-detect-settings-in-internet-explorer/
Option Explicit
On Error Resume Next
'Create a constant for the HKEY_CURRENT_USER object
Const HKCU = &H80000001
'Define variables
Dim strComputer
Dim strRegistryKey
Dim objRegistry
Dim strRegistryValue
DIm binValue
strComputer = "."
strRegistryKey = "Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections"
strRegistryValue = "DefaultConnectionSettings"
'Connect to the Registry
Set objRegistry = GetObject("winmgmts:\\" & strComputer & "\root\default:StdRegProv")
'Retrieve the current settings.
objRegistry.GetBinaryValue HKCU, strRegistryKey, strRegistryValue, binValue
'Change the 'Automatically detect settings' box to unticked
binValue(8) = 05
'binValue(8) = 13 - Enable this line to check the box instead of uncheck
'Save the changes
objRegistry.SetBinaryValue HKCU, strRegistryKey, strRegistryValue, binValue

ActiveX UAC and Proxy Settings via GPO

Similar Messages

Maybe you are looking for