PAC file not applied by Group Policy or Intune: where the setting really lands

Published 13 October 2026

When a PAC file is not applied after a Group Policy or Intune rollout, the policy usually did arrive, but in a place the program does not read. Windows has a per-user setting, a per-machine setting and a separate WinHTTP setting, and Edge and Chrome have their own proxy policy. This page shows how to find out which setting a program uses and where your policy went.

A PAC file (proxy auto-configuration file) decides for every request which proxy to use. In a company it is usually set by Group Policy or by Intune, Microsoft’s device management service. This page is about the case where the policy was rolled out but the PAC file is not used. If the file is used but fails, start at PAC file troubleshooting; if you rely on auto-detection, start at WPAD not loading.

Four settings, and each program reads one of them

A PAC URL that sits in one of these does nothing for a program that reads another. The sections below go through them.

Per user or per machine: the setting may land in the other place

By default the Windows proxy setting is stored per user. The policy Make proxy settings per-machine (rather than per-user) writes the value ProxySettingsPerUser = 0 under HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings, and then “changes to the proxy settings can only be made by elevated applications running with Administrative permissions” (source: doc, Microsoft: Understanding web proxy configuration, checked 2026-10-13).

So a PAC URL deployed as a user setting has no effect on a machine that is switched to per-machine settings, and a per-machine value is not what a machine with per-user settings uses. Check which mode the machine is in before you look for the error in the PAC file.

Intune sets the Windows proxy for the device

For Windows itself, Intune uses the NetworkProxy configuration service provider (CSP), the interface through which device management changes the proxy setting. Its nodes are AutoDetect, SetupScriptUrl (“Address to the PAC script you want to use”), ProxyServer and ProxySettingsPerUser. Every node applies to the device, not to a user. ProxySettingsPerUser = 0 makes the setting “global, machine wide”; the default 1 keeps it per user. Microsoft also notes that these settings do not apply to VPN connections (source: doc, NetworkProxy CSP, checked 2026-10-13).

What follows: a PAC URL that works on the office network but not on VPN is expected with this CSP. The VPN connection has its own proxy setting; the Windows 11 page shows where it is.

The Edge and Chrome ProxySettings policy wins inside the browser

Edge and Chrome have their own proxy policy, ProxySettings, with a field ProxyMode. With the mode system the browser uses the Windows setting; with pac_script it uses the ProxyPacUrl from the policy; direct, auto_detect and fixed_servers ignore the PAC URL entirely. Microsoft writes: “This policy overrides the following individual policies: ProxyMode, ProxyPacUrl, ProxyServer, ProxyBypassList”, and when it is set, Edge “ignores all proxy-related options specified from the command line” (source: doc, Microsoft Edge policy ProxySettings, checked 2026-10-13). Chrome’s policy has the same fields and the same wording (source: code, ProxySettings.yaml, checked 2026-10-13).

Two things follow:

• A Windows PAC URL set by Group Policy does nothing in a browser whose policy sets another mode.
• ProxyPacMandatory stops the browser from going direct when the PAC file cannot be loaded or run. That is safer, but a broken file then stops all browsing in that browser.

Check: open edge://policy or chrome://policy. The page lists every policy in effect, with “Applies to” (machine or current user) and the source, and has a button Reload policies (source: doc, Chrome Enterprise help: view a device’s policies, checked 2026-10-13). In Intune, Edge and Chrome policies are set in the settings catalog; Microsoft describes the Edge side in Configure Microsoft Edge with Intune.

gpresult shows which Group Policy settings arrived

Run in the affected user’s session:

gpupdate /force
gpresult /h "%USERPROFILE%\Desktop\gpresult.html"

gpupdate /force “reapplies all policy settings”, not only those that changed. gpresult /h writes the report as HTML; “if /scope is omitted, gpresult displays RSoP data for both the user and the computer” (RSoP is the resulting set of policy, what actually applies). Add /scope user or /scope computer to see one side only, and /f to overwrite an old report (source: doc, Microsoft gpresult and gpupdate, checked 2026-10-13).

In the report, look for the proxy settings, the policy “Make proxy settings per-machine”, and the Edge and Chrome proxy policies. A policy listed under “Denied” or missing from the report did not reach this user or machine; check where the policy object is linked and how it is filtered.

WinHTTP needs its own setting

Windows services and many background programs use WinHTTP, whose proxy setting is separate from the one in Settings. Microsoft writes that the WinHTTP stack “was designed for use in services” and that the calling code sets the proxy itself (source: doc, Microsoft: Understanding web proxy configuration). So a PAC URL set for users does not reach a service.

netsh winhttp import proxy source=ie “imports the proxy settings in the Internet Explorer (IE) Web browser’s Internet Options” (source: doc, Microsoft netsh winhttp, checked 2026-10-13). It does not carry a PAC URL over: Microsoft wrote that these tools “only support fixed proxy settings (not autodetection or PAC script URLs)” (source: doc, Understanding web proxy configuration, as above). To give WinHTTP a PAC URL, use set advproxy, whose JSON has the fields Proxy, ProxyBypass, AutoconfigUrl and AutoDetect, in an elevated prompt:

netsh winhttp set advproxy setting-scope=machine settings={\"Proxy\":\"\",\"ProxyBypass\":\"\",\"AutoconfigUrl\":\"https://pac.corp.example/proxy.pac\",\"AutoDetect\":false}
netsh winhttp show advproxy

The older commands set proxy and show proxy are deprecated in favour of set advproxy and show advproxy (same source).

After the policy is right

Clients may still use what they loaded before. The page on resetting the PAC cache shows how to make each engine load the file again. Then check the file itself in the online PAC file tester with the engine profile of the program that failed.

Frequently asked questions

Why is my PAC file not applied by Group Policy?

Usually the setting arrived, but somewhere the program does not read. The proxy setting is per user by default; a browser policy for Edge or Chrome can set another mode; and Windows services read the separate WinHTTP setting, which no Internet Options policy changes. Check with gpresult /h report.html, edge://policy or chrome://policy, and netsh winhttp show advproxy.

Does the Edge ProxySettings policy override the Windows proxy settings?

When it sets a mode other than system, Edge uses the policy and not the Windows settings. With the mode pac_script it uses the ProxyPacUrl from the policy. The policy also overrides the single policies ProxyMode, ProxyPacUrl, ProxyServer and ProxyBypassList, and makes Edge ignore proxy options on the command line.

How do I set a PAC file with Intune?

For Windows itself, use the NetworkProxy configuration service provider, which has the nodes SetupScriptUrl for the PAC address, AutoDetect and ProxySettingsPerUser; it applies to the device, not to a user, and not to VPN connections. For Edge and Chrome, set the ProxySettings policy, for example from the Intune settings catalog.

Does netsh winhttp import proxy source=ie import the PAC URL?

No. It imports the proxy settings from Internet Options, and Microsoft wrote that these tools support only fixed proxy settings, not auto-detection or PAC script addresses. To give WinHTTP a PAC URL, use netsh winhttp set advproxy with the field AutoconfigUrl.

How do I check which proxy policy applies?

Run gpresult /h report.html in the user's session and open the report; add /scope computer or /scope user to limit it. In Edge open edge://policy, in Chrome chrome://policy; both list every policy in effect and where it came from. For services, run netsh winhttp show advproxy.