Proxy Settings getting disabled and removed

[Sanishku]

Hi,

 

From last 3-4 days, few of our client computers IE proxy server settings are getting removed and getting grayed out randomly and the number of systems so affected are increasing. Please assist us.

 

Regards,

Anishk

[GeoGeo]

SEP would not normally grey out proxy settings on IE have you tried disabling SEP to confirm? 

The only place that client proxy settings are set are in Clients > Policies > External Communication Settings for Clients > Proxy Server (Windows). The default is usually set to Use proxy server defined by default client browser. 

[ℬrίαη]

Proxy settings on what? Browser or SEP client? Be specific and provide more info/screenshots.

[Sanishku]

Hi,

 

The Internet explorer proxy settings are getting greyed and disabled here. (Screenshot attached ..)

Also, we can even see a new registry value ProxyEnable getting set in Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings to "0". This value is getting created only in the affected machines. 

We have already set a registry value before in HKEY_CURRENT_USER where value is "1" ie, enabled but HKLM is taking precedence over HKCU and making it disabled.

It can also be seen in the screenshot that there is info message in the internet settings "Some settings are managed by your system administrator" which is also coming only in the affected machines.

 

Regards,

Anshk

[Systems Team]

Hi Anshk,

That looks very much like Group Policy is doing that - particularly the fact it is greyed out and you also see "Some settings are managed by your system administrator".

I would be checking who has access to modify GPO's.  You can run a GRPRESULT or an RSOP report to see what GPO's are applying.  Do this on a problem versus a non-problem machine.  See if there are any different GPO's being apllied on your problem machines.  Then review those GPO's and see how they are targetted - they've probably been assigned individually or by a group or OU that only contains your problem machines.

When you check the GPO's. make sure you check BOTH User and Computer Configuration, and both Policies and Preferences under each, just so you know exactly what settings are being applied.  Suspect this setting will be coming from Computer Configuration.

Hope this helps,

Steve

 

[Sanishku]

Thanks Steve,

 

But we have configured same group policy for all machines and that too this poping up randomly and machines getting affected doesn't points gpo being a problem. 

We have now tried changing External communication settings to change from "Do not use a proxy server" to "use the proxy server specified by the client browser" for the group in sepm for the affected branch(not all systems in a branch are affected).

After changing this, we have taken the affected machine of that branch and given "update policy". After that, the greyed out option is gone and got enabled. Even the message "some settings are managed by your system administrator" also went away.

We are now not sure what is the root cause as there are some groups in which External communication settings are already set to "use the proxy server specified by the client browser" but still the issue is coming but while either after some time or after taking the machine remotely and giving "update policy", the issue is getting resolved.

Request your support.

Regards,

Anishk

 

 

[Mohideen Yassar]

Hi Anish / Steve,

Have you foound any workaround/fix for this issue. In my scenario almost same kind of issue

Issue: All users in Domain will use Proxy setting once they are in office and uncheck proxy when they are out of office to browse internet. After upgrading to SEP 14.2 once the users went to home and try uncheck proxy option its not working. Proxy getting enabled again.

For some users when they change proxy via Edge/Chrome its working. All affected machines are windows 10. External Communication settings for these groups are already set to "Use Proxy server specified by the client browser". We tried removing SEP in one of the affected machine using clean wipe and the machine is still having problem. 

Some affected machines after running GPUPDATE seems to be fine. The issue is still under monitor..Let me know if you have any idea.

Thanks

Mohideen

[Sanishku]

Hi Mohideen,

 

We are still waiting for a solution from Symantec(raised a case). We could found a registry value under Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings changing from 1 to 0 where 0 is disabling domain users to edit proxy settings. This action is invoked from Symantec which could be seen after enabling registry logging in Event Viewer. Temporarily, we have created a policy through AD to change the value again back to 1 to anable domain users to edit proxy and the exisitng proxy value to be populated again. But the problem is sometimes, symantec policy is applying at last which is changing value again back to 0.

 

Regards,

Anishk

[Mohideen Yassar]

HI Anish,

Thanks much for the response. Let me check the registry in affected machines and will let you know. One more strange thing happened is some users are not able to enable the proxy 

You are facing this issue after any upgrade or major changes  in policy? In my case it was upgrade from 12.6 to 14.2 MP1 RU1

Thanks

Mohideen

[Sanishku]

Hi Mohideen,

 

In our case, there was no upgrade done. We have just brought in Symantec EDR as UAT phase to understand the product. 

 

If user is not able to change\edit proxy, i suspect it to be "Proxyperuser" setting changed to 0 from 1 for the above mentioned registry path.

 

Regards,

Anishk