Summary #

Configure Windows Server 2016, 2019, and 2022 Group Policies to auto-apply SecureSchool PAC proxy settings with step-by-step setup and fixes.

Learn how to configure Group Policy in Windows Server 2016, 2019, and 2022 to automatically distribute SecureSchool Proxy Auto Configuration (PAC) settings to client machines. Includes step-by-step setup, notes for newer Windows Server versions, and troubleshooting tips.

Overview #

For environments running Windows Server 2016 or newer, administrators can configure Group Policies to automatically distribute proxy settings (such as a PAC file URL) to domain-joined client machines. This ensures that web traffic is filtered correctly by SecureSchool without requiring manual configuration on each workstation.

This guide walks through creating and applying the necessary Group Policy Object (GPO) settings for Proxy Auto Configuration.

Requirements #

• A Windows Server 2016 or later domain controller
• Administrative access to Group Policy Management Console (GPMC)
• A Proxy Auto Configuration (PAC) file URL provided by SecureSchool (typically http://<your-secureschool-ip>/proxy.pac)

Steps #

1. Open Group Policy Management #

1. Log into your Windows Server 2016+ domain controller.
2. Launch Group Policy Management (gpmc.msc) from the Start menu or Run dialog.

2. Create a New GPO #

1. In the left-hand tree, right-click your domain or the desired Organizational Unit (OU).
2. Select Create a GPO in this domain, and Link it here…
3. Give the policy a descriptive name, such as SecureSchool Proxy Auto Config.
4. Click OK.

3. Edit the GPO #

1. Right-click the new GPO and select Edit.
2. Navigate to:
   User Configuration
   > Preferences
   > Control Panel Settings
   > Internet Settings
3. Right-click Internet Settings, then select New > Internet Explorer 10 (applies to IE10+ and Edge in IE mode).

4. Configure Proxy Auto Configuration #

1. In the Internet Properties dialog, go to the Connections tab.
2. Click LAN Settings.
3. Check Use automatic configuration script.
4. Enter your PAC file URL (e.g., http://<your-secureschool-ip>/proxy.pac).
5. Leave other proxy options unchecked unless otherwise required.
6. Click OK twice to save settings.

5. Apply and Test #

1. Close the Group Policy Editor.
2. Force a Group Policy update on a client by running: gpupdate /force
3. Open a browser on the client device and verify that traffic is filtered by SecureSchool.

Windows Server 2019/2022 Notes #

• The Group Policy steps are identical in Windows Server 2019 and 2022.
• You will still use Internet Explorer 10 settings within Group Policy Preferences. Even though Internet Explorer is officially retired, this policy applies to the underlying Windows proxy settings, which are also used by:
  • Microsoft Edge (Chromium-based)
  • Google Chrome
  • Mozilla Firefox (if set to use system proxy settings)
• Always confirm that client browsers are configured to inherit system proxy settings.

Troubleshooting #

PAC File Does Not Apply #

• Confirm the PAC URL is accessible from client machines (open in a browser).
• Ensure the PAC file is hosted on your SecureSchool appliance and accessible without authentication.

Policy Does Not Apply to Clients #

• Run gpresult /r on the client to verify that the GPO is applied.
• Confirm the GPO is linked to the correct OU containing user accounts (this is a User Configuration setting).
• If multiple domain controllers are present, allow time for replication or force replication.

Browser Ignores Proxy Settings #

• For Chrome and Edge (Chromium): Confirm “Use system proxy settings” is enabled (default).
• For Firefox: Ensure “Use system proxy settings” is selected in Network Settings.

Changes Not Appearing After Update #

• Run gpupdate /force and restart the client.
• If using laptops, verify they are connected to the domain network when applying policies.
• Check Event Viewer (Applications and Services Logs → Microsoft → Windows → GroupPolicy) for errors.

Notes #

• This GPO applies per-user. Ensure the policy is linked to the correct OU containing the user accounts.
• For environments with multiple domain controllers, allow time for Group Policy replication before testing.
• For large deployments, test the policy on a pilot group before rolling it out domain-wide.

Need help? Contact our tech team at 877-225-0100 or support@k12usa.com