Comments on: computer based and user based policy implemented together?

By: sheldon.sc

sheldon.sc — Fri, 22 Feb 2008 18:18:19 +0000

Well, I dont want to add all users to the proxy yet. Its on a test run to see how it works with some before I put it out on a whole.

And going out to each user would mean just about 15-20 but its increasing. There are users on remote sites too. Which is why I just wanted to implement it without me having to go and get it done manually.

What is a Group Policy Modeling ? How do I check the effects of my Group Policy before I deploy it?
All this time I would just keep shutting down and restarting a test user computer to see if it works. Which is quite annoying since I have enabled the GP refresh interval for users to 2 mins. Which I guess should work even when I am logged in. This should change my IE settings right? OR does it need a restart?

By: buddyfarr

buddyfarr — Fri, 22 Feb 2008 02:21:36 +0000

ok, that makes more sense. did you try linking that GP to an OU instead of adding the computers to it? if you link it to an OU it should affect all users or computers in that OU.

also you should be able to use Group Policy Modeling to see the effects of your Group Policy before you enact it.

By: sheldon.sc

sheldon.sc — Fri, 22 Feb 2008 00:40:08 +0000

Actually, I was referring to the GPO because I implemented a GP and added the computers to it but for some reason I cannot add the proxy address to go out to all machines.

I have to manually go to each computer and set a LOCAL group policy (gpedit.msc) under the User Configuration so that it is taken in for all users.

With the GPO editor under >Computer Configuration > Administrative Templates >Internet Explorer, I have enabled 1) Make proxy settings per-machine 2) Disable changing proxy setting.
AND
Under User Configuration > Windows Settings >Internet Explorer Maintenance > Connection > Proxy Setting, I have enabled proxy setting and put in the proxy address with the port number, without any exceptions.

Now, I have implemented this group policy by adding just the computer to the group and not the user. I don’t see the sense in adding both since I wanted it implemented per computer and not user I just added the Computer to the GP. So, even if I add both the Computer and the user, the computers don’t seem to catch the setting when I restart them.
So, my question was to know if there is any easier way to get the same done without me having to go to each computer and putting the GP on each computer. OR is there something that I’m missing.

By: buddyfarr

buddyfarr — Thu, 21 Feb 2008 01:30:02 +0000

please correct me if I am wrong but what the poster is asking is about the squid proxy server, not Active Directory GPO’s. So the AD GPO would not apply here. He is trying to setup rules on his Squid proxy server to apply to users and to also apply to individual computers. I am sure that there is a MAC address filter you can use on Squid to filter their surfing. Then you can setup regular user-based rules. When that person is sitting at the particular computer then both rules, computer- and user-based, would apply. If two rules conflict the more strict rule should apply.