Proxy.pac ignored on Windows 11: why the setup script has no effect

Published 12 October 2026

On Windows a PAC file can be set correctly and still be ignored by some programs, by services or on VPN. Windows has more than one proxy setting, and its PAC engine answers some calls differently from the browsers. This page goes through the causes from the setting to the script.

The usual causes at a glance

A PAC file (proxy auto-configuration file, often proxy.pac or wpad.dat) is a small JavaScript program that decides for every request which proxy to use. On Windows 11 there are three places where it can go wrong: the program reads another setting, the file cannot be loaded or run, or the file runs but Windows answers some calls differently from the browsers.

Windows has more than one proxy setting

The user setting. In Settings > Network & internet > Proxy, the PAC file is set under Use setup script: select Set up and enter the script address (source: doc, Microsoft Support, checked 2026-10-12). Browsers and most desktop programs of the signed-in user follow this setting.

The WinHTTP setting. Windows services, the background download service BITS and many programs that run without a user use WinHTTP, one of the two network libraries of Windows. Its proxy setting is separate. netsh winhttp show advproxy shows it, and netsh winhttp set advproxy sets it, including an AutoconfigUrl for a PAC file, for one user or for the whole machine. The older set proxy and show proxy commands are deprecated (source: doc, Microsoft netsh winhttp, checked 2026-10-12). A PAC file that is set only in the user setting is therefore not used by such services.

VPN connections have their own proxy settings. A proxy set for the network does not apply to a VPN connection; it is set separately under Network & internet > VPN, the connection’s Advanced options, Proxy settings for this VPN connection (source: doc, Microsoft Support, as above). If the PAC file is ignored only on VPN, look there.

A company policy may set it for you. In a managed company, group policy or device management usually sets the proxy. A setting you change by hand may be overwritten at the next policy update.

The file cannot be downloaded: error 12167

Programs that use WinHTTP report ERROR_WINHTTP_UNABLE_TO_DOWNLOAD_SCRIPT (12167) when the PAC file cannot be downloaded, and ERROR_WINHTTP_AUTODETECTION_FAILED (12180) when automatic detection finds no PAC URL (source: doc, Microsoft WinHTTP error messages, checked 2026-10-11). Open the script address from the affected machine and check that it answers with status 200 and the file (PAC-D010). A PAC file on a file path or a share works for some Windows programs but not in Chrome and Edge (PAC-D009). For automatic detection, see WPAD not working.

The file loads but fails: error 12166

ERROR_WINHTTP_BAD_AUTO_PROXY_SCRIPT (12166) means that the script failed. On Windows the most common reason is newer JavaScript: optional chaining (a?.b), the ?? operator and object spread are syntax errors there, and then the file fails for every address, while Chrome runs it without complaint (PAC-K020). console.log() also throws on Windows, because console is not defined (source: lab, Windows 11 25H2, 2026-10-11; PAC-K022). Paste the file into the tester, choose the profile “Windows WinHTTP” and press Check.

The file runs, but some rules never match on Windows

Source for this section: lab, Windows 11 25H2, 2026-10-11 and 2026-10-12.

• dateRange and timeRange are always false, whatever the arguments, so rules for office hours never apply (dateRange and timeRange on Windows).
• The host name can arrive in upper case. Windows services and BITS pass it as typed, for example Example.COM. Start the function with host = host.toLowerCase(); (PAC-K009).
• Lower-case keywords are ignored. "proxy p.corp.example:3128" sends Windows programs direct; write PROXY, DIRECT and SOCKS in upper case (PAC-E011).
• One answer per host. Windows reuses the answer for a host for later addresses on that host, so a rule on the path is not checked again; for https:// addresses the script never sees the path, and a user name and password in the address are removed (PAC-K021).
• Programs built on .NET Framework or .NET drop SOCKS and every entry after the first DIRECT (PAC-K005).

The article Windows runs PAC files differently from Chrome and Firefox explains each point in detail.

A change does not take effect

Windows and the browsers keep the downloaded PAC file for a while. Without a Cache-Control header the engine decides how long (PAC-D003). Restart the program you test with after each change. For browsers on Windows, see PAC file not working in Chrome or Edge; all other symptoms are sorted on the page PAC file troubleshooting.

Frequently asked questions

Why is my proxy.pac ignored on Windows 11?

Usually because the program reads another proxy setting than the one you changed. Settings > Network & internet > Proxy is a per-user setting for browsers and desktop programs. Windows services and many background programs use the WinHTTP setting, which netsh winhttp show advproxy displays. A VPN connection has its own proxy settings too.

Where do I set a PAC file in Windows 11?

In Settings > Network & internet > Proxy, under Use setup script, select Set up and enter the script address. For a VPN connection, set it under Network & internet > VPN, Advanced options, Proxy settings for this VPN connection.

What do WinHTTP errors 12166, 12167 and 12180 mean?

12167 means the PAC file could not be downloaded, 12166 means it was downloaded but its script failed, and 12180 means automatic detection found no PAC URL.

Why does my PAC file work in Chrome but not in Windows programs?

Windows runs the file in its own engine. There dateRange and timeRange are always false, newer JavaScript such as ?. makes the whole file fail, and some programs pass the host name in upper case. Test the file with a Windows profile in the tester at findproxyforurl.net/check/.