I use the old trick of bogus settings for the proxy server in Group Policy.
I have as an example:
When I move anyone from the OU2 to OU1 to allow them access, the proxy address still remains in the settings. I can manually change it back, but cannot get it to do so automatically.
Am I missing something, or is it just MS by design?