I am using a proxy server for my environment deployed on premises for internal hosts and on the cloud from BYOD. When a user takes their device off the premises, the proxy changes to an external proxy address. However, I am concerned that if a machine is compromised with malware and gets admin privileges, it might change proxy settings which will bypass my proxy.

How do I prevent the end user from changing proxy settings? even with admin privileges?

I am looking for a way to harden proxy settings on network stack so that the end user can not overwrite it.

  • Admin can do anything. So I'm not sure there is a way to control this. – schroeder Jan 23 at 8:36
  • Why is bypassing your proxy a problem? What harm will occur? What are you trying to prevent? – schroeder Jan 23 at 8:39
  • if a machine is compromised, the malware will bypass network policies created on proxy and allow connection to sites that are blocked proxy. – Hammad Qureshi Jan 23 at 8:44
  • Right, ok, but if malware gets admin access and is able to do this, is accessing blocked sites the important problem? It's already "game over" even if the malware cannot access the sites it wants to. – schroeder Jan 23 at 8:47
  • 1
    @HammadQureshi: just block any network connection to the outside which does not go over the proxy. Then no other proxy or direct connection can be used. This can be done with a firewall. – Steffen Ullrich Jan 23 at 10:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.