# Proxy.pac ignored on Windows 11: why the setup script has no effect

Source: https://findproxyforurl.net/articles/pac-file-ignored-windows-11/ · last updated 2026-10-12

On Windows a PAC file can be set correctly and still be ignored by some programs, by services or on VPN. Windows has more than one proxy setting, and its PAC engine answers some calls differently from the browsers. This page goes through the causes from the setting to the script.

## The usual causes at a glance

| What you see | Likely cause | Check or fix |
|---|---|---|
| Browsers use the PAC file, services and background programs do not | They use the separate WinHTTP setting | `netsh winhttp show advproxy` |
| The PAC file is ignored only on VPN | The VPN connection has its own proxy settings | Network & internet > VPN > Advanced options |
| Error 12167 | The PAC file cannot be downloaded | Open the script address; it must answer with status 200 |
| Error 12166 | The script fails, often because of `?.` or `??` | The [tester](https://findproxyforurl.net/check/) with the profile "Windows WinHTTP" |
| Error 12180 | Automatic detection finds no PAC URL | [WPAD not working](https://findproxyforurl.net/articles/wpad-not-working/) |
| Rules for office hours never apply | `dateRange()` and `timeRange()` are always false on Windows | Do not route by date or time for Windows programs |
| Some host names miss every rule | Windows services pass the host as typed | `host = host.toLowerCase();` at the start |

A PAC file (proxy auto-configuration file, often `proxy.pac` or `wpad.dat`) is a small JavaScript
program that decides for every request which proxy to use. On Windows 11 there are three places where
it can go wrong: the program reads another setting, the file cannot be loaded or run, or the file runs
but Windows answers some calls differently from the browsers.

## Windows has more than one proxy setting

**The user setting.** In **Settings > Network & internet > Proxy**, the PAC file is set under
**Use setup script**: select **Set up** and enter the script address (source: doc,
[Microsoft Support](https://support.microsoft.com/en-us/windows/use-a-proxy-server-in-windows-03096c53-0554-4ffe-b6ab-8b1deee8dae1),
checked 2026-10-12). Browsers and most desktop programs of the signed-in user follow this setting.

**The WinHTTP setting.** Windows services, the background download service BITS and many programs
that run without a user use WinHTTP, one of the two network libraries of Windows. Its proxy setting is
separate. `netsh winhttp show advproxy` shows it, and `netsh winhttp set advproxy` sets it, including
an `AutoconfigUrl` for a PAC file, for one user or for the whole machine. The older `set proxy` and
`show proxy` commands are deprecated (source: doc,
[Microsoft netsh winhttp](https://learn.microsoft.com/en-us/windows/win32/winhttp/netsh-exe-commands),
checked 2026-10-12). A PAC file that is set only in the user setting is therefore not used by such
services.

**VPN connections have their own proxy settings.** A proxy set for the network does not apply to a
VPN connection; it is set separately under **Network & internet > VPN**, the connection's
**Advanced options**, **Proxy settings for this VPN connection** (source: doc, Microsoft Support, as
above). If the PAC file is ignored only on VPN, look there.

**A company policy may set it for you.** In a managed company, group policy or device management
usually sets the proxy. A setting you change by hand may be overwritten at the next policy update.

## The file cannot be downloaded: error 12167

Programs that use WinHTTP report `ERROR_WINHTTP_UNABLE_TO_DOWNLOAD_SCRIPT` (12167) when the PAC file
cannot be downloaded, and `ERROR_WINHTTP_AUTODETECTION_FAILED` (12180) when automatic detection finds
no PAC URL (source: doc,
[Microsoft WinHTTP error messages](https://learn.microsoft.com/en-us/windows/win32/winhttp/error-messages),
checked 2026-10-11). Open the script address from the affected machine and check that it answers with
status 200 and the file ([PAC-D010](https://findproxyforurl.net/rules/http-error-status/)). A PAC file on a file path or a share
works for some Windows programs but not in Chrome and Edge ([PAC-D009](https://findproxyforurl.net/rules/pac-from-file-share/)).
For automatic detection, see [WPAD not working](https://findproxyforurl.net/articles/wpad-not-working/).

## The file loads but fails: error 12166

`ERROR_WINHTTP_BAD_AUTO_PROXY_SCRIPT` (12166) means that the script failed. On Windows the most common
reason is newer JavaScript: optional chaining (`a?.b`), the `??` operator and object spread are syntax
errors there, and then the file fails for every address, while Chrome runs it without complaint
([PAC-K020](https://findproxyforurl.net/rules/es2018-syntax/)). `console.log()` also throws on Windows, because `console` is not
defined (source: lab, Windows 11 25H2, 2026-10-11; [PAC-K022](https://findproxyforurl.net/rules/console-in-pac/)). Paste the
file into the [tester](https://findproxyforurl.net/check/), choose the profile "Windows WinHTTP" and press **Check**.

## The file runs, but some rules never match on Windows

*Source for this section: lab, Windows 11 25H2, 2026-10-11 and 2026-10-12.*

- **dateRange and timeRange are always false**, whatever the arguments, so rules for office hours
  never apply ([dateRange and timeRange on Windows](https://findproxyforurl.net/articles/pac-time-functions-windows/)).
- **The host name can arrive in upper case.** Windows services and BITS pass it as typed, for example
  `Example.COM`. Start the function with `host = host.toLowerCase();`
  ([PAC-K009](https://findproxyforurl.net/rules/host-not-lowercased/)).
- **Lower-case keywords are ignored.** `"proxy p.corp.example:3128"` sends Windows programs direct;
  write `PROXY`, `DIRECT` and `SOCKS` in upper case ([PAC-E011](https://findproxyforurl.net/rules/invalid-return-value/)).
- **One answer per host.** Windows reuses the answer for a host for later addresses on that host, so a
  rule on the path is not checked again; for `https://` addresses the script never sees the path, and a
  user name and password in the address are removed ([PAC-K021](https://findproxyforurl.net/rules/url-path-decision/)).
- **Programs built on .NET Framework or .NET drop SOCKS** and every entry after the first `DIRECT`
  ([PAC-K005](https://findproxyforurl.net/rules/socks-version-keyword/)).

The article [Windows runs PAC files differently from Chrome and Firefox](https://findproxyforurl.net/articles/pac-on-windows/)
explains each point in detail.

## A change does not take effect

Windows and the browsers keep the downloaded PAC file for a while. Without a `Cache-Control` header the
engine decides how long ([PAC-D003](https://findproxyforurl.net/rules/missing-cache-control/)). Restart the program you test with
after each change. For browsers on Windows, see
[PAC file not working in Chrome or Edge](https://findproxyforurl.net/articles/pac-file-not-working-chrome-edge/); all other
symptoms are sorted on the page [PAC file troubleshooting](https://findproxyforurl.net/articles/pac-file-troubleshooting/).


## Frequently asked questions

### Why is my proxy.pac ignored on Windows 11?

Usually because the program reads another proxy setting than the one you changed. Settings > Network & internet > Proxy is a per-user setting for browsers and desktop programs. Windows services and many background programs use the WinHTTP setting, which netsh winhttp show advproxy displays. A VPN connection has its own proxy settings too.

### Where do I set a PAC file in Windows 11?

In Settings > Network & internet > Proxy, under Use setup script, select Set up and enter the script address. For a VPN connection, set it under Network & internet > VPN, Advanced options, Proxy settings for this VPN connection.

### What do WinHTTP errors 12166, 12167 and 12180 mean?

12167 means the PAC file could not be downloaded, 12166 means it was downloaded but its script failed, and 12180 means automatic detection found no PAC URL.

### Why does my PAC file work in Chrome but not in Windows programs?

Windows runs the file in its own engine. There dateRange and timeRange are always false, newer JavaScript such as ?. makes the whole file fail, and some programs pass the host name in upper case. Test the file with a Windows profile in the tester at findproxyforurl.net/check/.