"Make proxy settings per-machine (rather than per user)" Group Policy setting not applied until login as a local Administrator

We want to deploy to all our desktop the pac file to configure proxy. We have a Windows 2008 R2 server, and i've enabled the GPO "Make proxy settings per-machine (rather than per user)", and i've add a registry key AutoConfigURL in "HKLM\Software\Microsoft\Windows\Current
Version\Internet Settings" with the pac file link.
I've tested on my pc, and all was configured without any problem. I've try to login to my computer with another user (without admin rights) and the automatic configuration proxy was compiled and not modificable. It's seems that all works.
But, our users are not local admin, so i've tried to deploy the GPO in a collegue computer. I've forced the update of GPO, checked on registry that all new keys are added, and i've reboot the pc. When i've check on IE settings, autoconfig URL was empty and
grey. I'm disconnected from user and i've login to the pc with a local admin. With my surprise, the IE settings was compiled. When i'm come bac to the user profile the IE settings was compiled and not modificable.
The problem is: i've over 750 users in 3 countries, and i don't want grant them the local admin permissions. How can i configure proxy settings via GPO without login to every machine at least one time?

> have a Windows 2008 R2 server, and i've enabled the GPO "Make proxy
> settings per-machine (rather than per user)", and i've add a registry
> key AutoConfigURL in "HKLM\Software\Microsoft\Windows\Current
> Version\Internet Settings" with the pac file link.
In the past, we experienced various issues with machine proxy settings,
so we don't use them anymore. The simple approach:
Block access to the connections page through ADM template settings and
deploy the proxy through GPP Internet Settings.
This is what we do (with a pac file, too), and it works well :)
Martin
Mal ein
GUTES Buch über GPOs lesen?
NO THEY ARE NOT EVIL, if you know what you are doing:
Good or bad GPOs?
And if IT bothers me - coke bottle design refreshment :))

Similar Messages

  • Digital Signatures per page rather than per document

    I am looking for some type of solution allowing for digital signatures for pdf files using a certificate authority.
    These documents will have signatures on each page.
    Am looking for a solution which would be able to validate on a page-by-page basis rather than the entire document.
    For example, if we had 10 pages with one signature on each page, and page 7 was changed, would only expect that the signature on page 7 be validated when making changes and not forcing the signatures on all the other 9 pages to be resigned.
    Is anyone aware of such a solution?

    I have a similar problem. Firstly, I understand the "flawed" comment above but reality is flawed.
    I have a number of documents in excess of 1000 pages which I am attempting to manage digitally. However, they need to be available for inspection by my regulator who still requires a paper format. I would like to be able to print, (or have my regulator print), the digitally signed document but still have something, even a small code or watermark, that would be printed on each page to tie the paper to the digital signature on the front of the document.
    Is there such a feature?

  • How do I make a settings shortcut on the iphone 5? Specifically the do not disturb function??

    How do I make a settings shortcut on the iphone 5? Specifically the do not disturb function??

    Is there an app that does it? I found a brdrck website but it is unavailable now  

  • How to create more than 2000 users/groups in a good way.

    Hi, guys.I want to create more than 2000 users/groups with Java API. Now I use a regular method to implement this function, login; create a domain; open a maxlsession ; and then call a maxl statement to create a user or a group . I find that the performance of this way is very bad. Can I write a funcation or a marco, which can create these users/groups? If it works, How do I need to write these codes?I have looked over all Java API document, it seems that ESSBASE API don't provide some related api which enables developer to generate a function or a marco. If you know the answer to this question, please tell me. thanks in advance.

    Dear Frank,
    Thank you so much for your answer. Beside the save point functionality to save the state and values on the screen, do you know other ways to do the same function? Once again, thank you so much.
    Linh Nguyen.

  • Load more than one user groups to system session variable GROUP from table

    hi, I found that the value of the system session variable GROUP can be assigned by setting a sql in initialization blocks.
    however, if there are some users with more than one user group.
    can this be done by table driven (using sql in initialization blocks) ?
    thanks !!

    Referencing GROUP session variable in initialization blocks for different types of authentication
    http://108obiee.blogspot.com/2009/10/referencing-group-session-variable-in.html
    Users are assigned to multiple groups from external table with semicolons, see example two and three from the post.
    Regards
    Goran
    http://108obiee.blogspot.com

  • How to make proxy settings in solaris 10 i386

    Dear Sir,
    I need your help in making proxy settings in solaris 10 x86, as well as on SPARC.
    i installed on virtual machine, and later i wanted to do the same on M4000 server. please help.
    Why I need to set proxy?
    I am on a co-orporate network, and it requires proxy to use internet to download packages for sun directly from sun machine.
    What package I want to download?
    I want to dowload CUPS to configure LINE PRINTER(ALIS5180).
    What did i do to configure line printer?
    1, i installed sun solaris 10 on a dell server to make it as a "print server"
    2, with the print manager I configure "alis5180"
    3, give the print command to test the printing.
    4, I did not got success, coz it is not printing the document i want, it is printing junk.
    5, i clear the cache of alis5180 printer.
    6, reset all the emulations ANSI, IBM Proprinter III XL, Epson FX-1180, Printronix® P600 & P 5000/6000, DEC® LG01, HP 2564C, Tally line/dot matrix printer, Epson FX 1180,
    MTPL, contextual arabic, Twinax (IBM 4234/4210/5225)/Coax(IBM4234), HP LineJet HPLP Series, HP 256X no success.
    Conclusion:-
    This is why I want to configure cups. and I need internet access on the print server to download the this package, and it require internet connection.
    Regards,
    Mky
    Edited by: user9007339 on Jan 22, 2012 3:29 AM

    You could try the Dell site, but I doublt if they will have a driver for Solaris, Linux maybe but not Solaris. Otherwise try the DriverGuide web site. http://www.driverguide.com/
    You could also try installing OpenSolaris if you don't specifically need Solaris 10. Better chance that OpenSolaris will support the NIC.

  • Make sense to buy Touch rather than 3G?

    I have the original iPhone, and love it (Let's not talk about the issues associated with the 2.0 update!) When there was talk of the 3G iPhone, I was going to get that, and give my husband my iPhone. Now that the time has arrived, I have put much more thought into the "total" cost of the 3G, and it just seems very expensive to pay an extra $30 each month for the 3G.
    So since my husband really doesn't care, and only uses his phone to call me to pick him up at the train station, I was considering buying a refurbished iPod touch ($199) for him. Not being totally familiar with the touch, I want to make sure I am comparing them properly.
    Of course, the touch has no phone, and I understand no camera either. I also believe that it has wi-fi, but needs a hot spot to connect. Does that mean he would need a hot spot to check his stocks? Weather? He would have an iPod with this, and could play non-internet games during his train commute. He could also have a calendar, and I believe we could sync the same calendar.
    He could send emails, but not texts since texts are sent via the phone, correct?
    Looking at the Apple store, it states that the iPod touch comes with the latest software, so other than my $199 purchase, I would not have to buy anything else unless I purchase APPS. Could he use APPS that I have purchased for my iPhone?
    Thanks

    There is an App at the App Store that allows the iPod Touch to get on Aim when near a hotspot so texting could be an option even on the Touch. As far as using the same Apps go, I have never tried it so I would rather not give you false information.

  • Can I make ICloud my online storage rather than Google

    I keep getting messages that my Google folder is full at 15 G and they want to charge 1.99/mo for more storage. I already pay for extra ICloud storage, if I use Safari instead, does my info go to that storage instead? When did this change in using Google start? Is there some other function I'm missing here?

    iCloud storage is intended for use with iDevices' data rather than storing that data on the computer via iTunes. It is not for general cloud storage.

  • Can I download Snow leopard/Lion rather than order hard copy delivery?  Not finding in iTunes nor on apple website..

    I currently have Mac OSx and looking to upgrade to Lion (sounds like I need to go through Snow Leopard upgrade first).  Is there an easy way to simply download these upgrades rather than order via the mail?  Any way to avoid updgrading two separate times and have the ability to go direct to the Lion upgrade?
    Thanks!

    You cannot download Snow Leopard. You have to buy it on disk.
    Once you've installed that, and updated it to 10.6.8, you can download Lion from the App Store.
    Apple also sells Lion on a USB stick, but I don't know if it is possible to install that on a disk with just Leopard.
    Also, make sure your MacBook can run Lion: http://www.apple.com/macosx/specs.html

  • ISE 1.2 & AD & Meraki - Per User Group Policy ?

    I am working on a PoC for a deployment in an MDU. We are using Meraki switches and access points. There are 250 units in the building, each unit will have it's own subnet. The goal is to have the tenant be able to connect to a common building SSID and be placed into their assigned VLAN. There will also be physical ports in each unit that will need to do the same. I am trying to figure out a way to use ISE to authorize on a per user basis and not based on groups of users. On the Meraki system there are group policies that will assign the VLAN for the user as well as any type of layer 7 firewalling and bandwidth control. So there will be 250 group policies, one for each unit. There is a deployment guide that shows how to setup ISE for use with Meraki and it is great but it assumes that there will be large groups like Employees, Contractors, etc.. that will be used. This is where I'm being tripped up, also... this is my first swing at a NAC deployment so I have a lot to learn.
    1.Can I setup each user in Active Directory to have a tag that ISE can then forward on to Meraki for the group policy? Say it's unit 101 and I have a group policy called 101 in Meraki, Meraki documentation says to use the Airespace-ACL-Name attribute in ISE to indicate the group policy to use. This gives me the ability to place a group into that policy but not an individual. Or would this be better done by creating the users in ISE directly? Omit AD entirely?
    2. Each unit will have devices that will need MAB because they are not 802.1x compatible. I need to do the same as above with them. I would create a separate SSID for these devices but then use the MAC address to authenticate them but will need to authorize them to go into a specific group policy.
    I know this isn't a typical ISE application but I think that this will work really well in the end, just need to iron out these details and get a test system functioning. Any help would be greatly appreciated!!!
    Thanks,
    Nathan

    Please find the Meraki_ISE integration doc. in attachment.
    When VLAN tagging is configured per user, multiple users can be associated to the same SSID, but their traffic is tagged with different VLAN IDs. This configuration is achieved by authenticating wireless devices or users against a customer-premise RADIUS server, which can return RADIUS attributes that convey the VLAN ID that should be assigned to a particular user’s traffic.
    In order to perform per-user VLAN tagging, a RADIUS server must be used with one of the following settings:
    MAC-based access control (no encryption)
    WPA2-Enterprise with 802.1x authentication
    A per-user VLAN tag can be applied in 3 different ways:
    The RADIUS server returns a Tunnel-Private-Group-ID attribute in the Access-Accept message, which specifies the VLAN ID that should be applied to the wireless user. This VLAN ID could override whatever may be configured in the MCC (which could be no VLAN tagging, or a per-SSID VLAN tag). To have this VLAN ID take effect, “RADIUS override” must be set to “RADIUS response can override VLAN tag” under the Configure tab on the Access Control page in the “VLAN setup” section.
    The RADIUS server returns a group policy attribute (e.g., Filter-ID) in the Access-Accept message. The group policy attribute specifies a group policy that should be applied to the wireless user, overriding the policy configured on the SSID itself. If the group policy includes a VLAN ID, the group policy’s VLAN ID will be applied to the user.
    On the Client Details page, a client can be manually assigned a group policy. If the group policy includes a VLAN ID, the group policy’s VLAN ID will be applied to the user. 

  • Unable to make changes to LAN Settings in IE after Group Policy Preference is applied

    Hi all,
    I have an IE10 group policy preference on a Server 2008 R2 domain that is pushed out to Windows 7 SP1 x64 clients. This IE10 GPP is used to push out proxy settings etc. The GPP is applied fine, however when I go into LAN Settings in IE and make any
    changes such as unchecking "Use a proxy server..." these changes are not saved. As soon as I click OK and go back into LAN Settings it reverts back to the GPP settings. Are IE10 GPP's meant to allow a user to amend settings in IE? The users have
    permissions to write to the Connections key under Internet Settings in the registry. If I delete the Connections key (Which includes DefaultConnectionSettings and SavedLegacySettings) I can then make changes to the proxy (Although without the original settings).
    I know their are other, and better, methods of controlling proxy settings for users but unfortunately this is the way the customer has it implemented. All defaults for GP is applied such as refresh rate etc. I've tested IE10 on a Server 2012 R2 / Win8 environment
    with the exact same GPP settings and I can make changes to the LAN Settings. Is this possibly a bug? Any help would be appreciated.
    Thanks.

    Hi,
    So by now we could make it work by deleting the Connections key, in order to change the proxy settings of IE 10-Windows 7 in the Windows Server 2008 R2 environment?
    Besides, could it be convenient for us to perform some more tests here? How IE 10 of Windows 7 behaves in Server 2012 R2 environment? And Windows 8 in Server 2008 R2?
    Best regards
    Michael
    Michael Shao
    TechNet Community Support

  • Use System Proxy Settings - when this is selected in FF v3.6.6, does it adhere to the same local IE proxy setting? We use a pac file configured in "Use automatic configuration script."

    Does anyone know what Firefox looks at locally on the PC when the "Use System Proxy Settings" setting is selected? It appears to be the default setting, recently changed from "No Proxy" of versions past...
    Our company uses a pac file specified in IE under "Use automatic configuration script" - with this new default, does it adhere to the same setting in:
    [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings]

    I may be wrong but I think that the "Use System Proxy Settings" makes sense only on Linux and generally speaking "other OSes". As far as I know there is no generic proxy settings in Windows operating system.
    The one I know is in the registry part of Internet Explorer.
    So in my understanding in Windows, Use System Proxy Settings = No Proxy

  • Close tab groups actually closes tabs rather than just the grouping. How do I recover all tabs, not just the last 10? Pages and tabs are not in recent history.

    I had a problem with tab groups - if I mistakenly close tab groups, I can only recover the last 10 tabs.
    I had a window with many more than 10 tabs which I reopened each session by going to History > Recently Closed Windows. I knew this was risky - I could lose this if I did not keep it in an open window or recently closed window. So I was looking for a way to save this window with all the tabs. I looked into tab groups and, not knowing what I was doing, I closed the groups of tabs. There seems to be no recovery for other than the last 10 tabs. And open tabs are not necessarily in recent history if I have not accessed the tab and refreshed.

    I don't use tab groups myself, but I know of a way to increase the number of closed tabs that Firefox remembers. Unfortunately, it's not retroactive...
    (1) In a new tab, type or paste '''about:config''' in the address bar and press Enter. Click the button promising to be careful.
    (2) In the search box above the list, type or paste '''sess''' and pause while the list is filtered
    (3) Double-click the following preferences and enter the preferred new value:
    (A) '''browser.sessionstore.max_tabs_undo''' (default: 10)
    (B) '''browser.sessionstore.max_windows_undo''' (default: 3)
    Regarding what is in history, by default, Firefox will load tabs on demand when you restore a session, rather than loading every single tab immediately. If you turned off that setting, or if you visited all the tabs, then those pages should be in history, but finding them amidst all the others would be quite a challenge...

  • How do I ensure user name is shown rather than 'another user' on the 'File in Use' dialog box?

    How can I ensure user names are shown rather than just 'another user' on the 'File in Use' dialog box that appears when attempting to edit a checked out document in Microsoft Word/Excel? 
    All suggestions welcome. 

    If I recall correctly, that dialog is generated by the Office client product supporting that file type. There would be no way to modify it.
    Trevor Seward
    Follow or contact me at...
    This post is my own opinion and does not necessarily reflect the opinion or view of Microsoft, its employees, or other MVPs.

Maybe you are looking for