# PAC file not applied by Group Policy or Intune: where the setting really lands

Source: https://findproxyforurl.net/articles/pac-not-applied-group-policy-intune/ · last updated 2026-10-13

When a PAC file is not applied after a Group Policy or Intune rollout, the policy usually did arrive, but in a place the program does not read. Windows has a per-user setting, a per-machine setting and a separate WinHTTP setting, and Edge and Chrome have their own proxy policy. This page shows how to find out which setting a program uses and where your policy went.

A PAC file (proxy auto-configuration file) decides for every request which proxy to use. In a company it is
usually set by Group Policy or by Intune, Microsoft's device management service. This page is about the
case where the policy was rolled out but the PAC file is not used. If the file is used but fails, start at
[PAC file troubleshooting](https://findproxyforurl.net/articles/pac-file-troubleshooting/); if you rely on auto-detection, start at
[WPAD not loading](https://findproxyforurl.net/articles/wpad-not-working/).

## Four settings, and each program reads one of them

| Setting | Who reads it | Set by | Check with |
|---|---|---|---|
| Windows proxy setting, per user (the default) | browsers and desktop programs of that user | user policy, Intune | Settings > Network & internet > Proxy |
| Windows proxy setting, per machine | the same programs, for every user | "Make proxy settings per-machine", Intune NetworkProxy | Settings > Network & internet > Proxy |
| WinHTTP proxy setting | Windows services and many background programs | `netsh winhttp`, not by Internet Options policies | `netsh winhttp show advproxy` |
| Browser policy `ProxySettings` | Edge or Chrome only | Edge or Chrome policy, Intune settings catalog | `edge://policy`, `chrome://policy` |

A PAC URL that sits in one of these does nothing for a program that reads another. The sections below go
through them.

## Per user or per machine: the setting may land in the other place

By default the Windows proxy setting is stored per user. The policy **Make proxy settings per-machine
(rather than per-user)** writes the value `ProxySettingsPerUser` = `0` under
`HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings`, and then "changes to the proxy
settings can only be made by elevated applications running with Administrative permissions" (source: doc,
[Microsoft: Understanding web proxy configuration](https://learn.microsoft.com/en-us/archive/blogs/ieinternals/understanding-web-proxy-configuration),
checked 2026-10-13).

So a PAC URL deployed as a user setting has no effect on a machine that is switched to per-machine
settings, and a per-machine value is not what a machine with per-user settings uses. Check which mode the
machine is in before you look for the error in the PAC file.

## Intune sets the Windows proxy for the device

For Windows itself, Intune uses the NetworkProxy configuration service provider (CSP), the interface through
which device management changes the proxy setting. Its nodes are `AutoDetect`, `SetupScriptUrl` ("Address to
the PAC script you want to use"), `ProxyServer` and `ProxySettingsPerUser`. Every node applies to the
device, not to a user. `ProxySettingsPerUser` = `0` makes the setting "global, machine wide"; the default `1`
keeps it per user. Microsoft also notes that these settings do not apply to VPN connections (source: doc,
[NetworkProxy CSP](https://learn.microsoft.com/en-us/windows/client-management/mdm/networkproxy-csp),
checked 2026-10-13).

**What follows:** a PAC URL that works on the office network but not on VPN is expected with this CSP. The
VPN connection has its own proxy setting; the
[Windows 11 page](https://findproxyforurl.net/articles/pac-file-ignored-windows-11/) shows where it is.

## The Edge and Chrome ProxySettings policy wins inside the browser

Edge and Chrome have their own proxy policy, `ProxySettings`, with a field `ProxyMode`. With the mode
`system` the browser uses the Windows setting; with `pac_script` it uses the `ProxyPacUrl` from the policy;
`direct`, `auto_detect` and `fixed_servers` ignore the PAC URL entirely. Microsoft writes: "This policy
overrides the following individual policies: ProxyMode, ProxyPacUrl, ProxyServer, ProxyBypassList", and when
it is set, Edge "ignores all proxy-related options specified from the command line" (source: doc,
[Microsoft Edge policy ProxySettings](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-browser-policies/proxysettings),
checked 2026-10-13). Chrome's policy has the same fields and the same wording (source: code,
[ProxySettings.yaml](https://chromium.googlesource.com/chromium/src/+/main/components/policy/resources/templates/policy_definitions/Miscellaneous/ProxySettings.yaml),
checked 2026-10-13).

Two things follow:

- A Windows PAC URL set by Group Policy does nothing in a browser whose policy sets another mode.
- `ProxyPacMandatory` stops the browser from going direct when the PAC file cannot be loaded or run. That is
  safer, but a broken file then stops all browsing in that browser.

**Check:** open `edge://policy` or `chrome://policy`. The page lists every policy in effect, with "Applies
to" (machine or current user) and the source, and has a button **Reload policies** (source: doc,
[Chrome Enterprise help: view a device's policies](https://support.google.com/chrome/a/answer/9024365),
checked 2026-10-13). In Intune, Edge and Chrome policies are set in the settings catalog; Microsoft describes
the Edge side in
[Configure Microsoft Edge with Intune](https://learn.microsoft.com/en-us/deployedge/configure-edge-with-intune).

## gpresult shows which Group Policy settings arrived

Run in the affected user's session:

```bat
gpupdate /force
gpresult /h "%USERPROFILE%\Desktop\gpresult.html"
```

`gpupdate /force` "reapplies all policy settings", not only those that changed. `gpresult /h` writes the
report as HTML; "if /scope is omitted, gpresult displays RSoP data for both the user and the computer" (RSoP is
the resulting set of policy, what actually applies). Add `/scope user` or `/scope computer` to see one side
only, and `/f` to overwrite an old report (source: doc,
[Microsoft gpresult](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpresult)
and [gpupdate](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/gpupdate),
checked 2026-10-13).

In the report, look for the proxy settings, the policy "Make proxy settings per-machine", and the Edge and
Chrome proxy policies. A policy listed under "Denied" or missing from the report did not reach this user or
machine; check where the policy object is linked and how it is filtered.

## WinHTTP needs its own setting

Windows services and many background programs use WinHTTP, whose proxy setting is separate from the one in
Settings. Microsoft writes that the WinHTTP stack "was designed for use in services" and that the calling code
sets the proxy itself (source: doc,
[Microsoft: Understanding web proxy configuration](https://learn.microsoft.com/en-us/archive/blogs/ieinternals/understanding-web-proxy-configuration)).
So a PAC URL set for users does not reach a service.

`netsh winhttp import proxy source=ie` "imports the proxy settings in the Internet Explorer (IE) Web browser's
Internet Options" (source: doc,
[Microsoft netsh winhttp](https://learn.microsoft.com/en-us/windows/win32/winhttp/netsh-exe-commands), checked
2026-10-13). It does not carry a PAC URL over: Microsoft wrote that these tools "only support fixed proxy
settings (not autodetection or PAC script URLs)" (source: doc, Understanding web proxy configuration, as
above). To give WinHTTP a PAC URL, use `set advproxy`, whose JSON has the fields `Proxy`, `ProxyBypass`,
`AutoconfigUrl` and `AutoDetect`, in an elevated prompt:

```bat
netsh winhttp set advproxy setting-scope=machine settings={\"Proxy\":\"\",\"ProxyBypass\":\"\",\"AutoconfigUrl\":\"https://pac.corp.example/proxy.pac\",\"AutoDetect\":false}
netsh winhttp show advproxy
```

The older commands `set proxy` and `show proxy` are deprecated in favour of `set advproxy` and
`show advproxy` (same source).

## After the policy is right

Clients may still use what they loaded before. The page on
[resetting the PAC cache](https://findproxyforurl.net/articles/pac-cache-reset/) shows how to make each engine load the file again. Then
check the file itself in the [online PAC file tester](https://findproxyforurl.net/check/) with the engine profile of the program that
failed.


## Frequently asked questions

### Why is my PAC file not applied by Group Policy?

Usually the setting arrived, but somewhere the program does not read. The proxy setting is per user by default; a browser policy for Edge or Chrome can set another mode; and Windows services read the separate WinHTTP setting, which no Internet Options policy changes. Check with gpresult /h report.html, edge://policy or chrome://policy, and netsh winhttp show advproxy.

### Does the Edge ProxySettings policy override the Windows proxy settings?

When it sets a mode other than system, Edge uses the policy and not the Windows settings. With the mode pac_script it uses the ProxyPacUrl from the policy. The policy also overrides the single policies ProxyMode, ProxyPacUrl, ProxyServer and ProxyBypassList, and makes Edge ignore proxy options on the command line.

### How do I set a PAC file with Intune?

For Windows itself, use the NetworkProxy configuration service provider, which has the nodes SetupScriptUrl for the PAC address, AutoDetect and ProxySettingsPerUser; it applies to the device, not to a user, and not to VPN connections. For Edge and Chrome, set the ProxySettings policy, for example from the Intune settings catalog.

### Does netsh winhttp import proxy source=ie import the PAC URL?

No. It imports the proxy settings from Internet Options, and Microsoft wrote that these tools support only fixed proxy settings, not auto-detection or PAC script addresses. To give WinHTTP a PAC URL, use netsh winhttp set advproxy with the field AutoconfigUrl.

### How do I check which proxy policy applies?

Run gpresult /h report.html in the user's session and open the report; add /scope computer or /scope user to limit it. In Edge open edge://policy, in Chrome chrome://policy; both list every policy in effect and where it came from. For services, run netsh winhttp show advproxy.