This topic explains the use of the Microsoft Windows HTTP Services (WinHTTP) proxy configuration tool, "ProxyCfg.exe".

There are two ways to access HTTP and Secure Hypertext Transfer Protocol (HTTPS) servers through a proxy using Microsoft Windows HTTP Services (WinHTTP). First, you can specify proxy settings from within your WinHTTP application. Second, you can specify default proxy settings from outside your application using the proxy configuration utility located in the %windir%\system32 directory.

Command Line Parameters

The following table lists the command line parameters available for use with the ProxyCfg.exe tool.

You can specify proxies in a space-delimited string. The proxy listings can contain the port number that is used to access the proxy. To list a proxy for a specific protocol, the string must follow the format, <protocol>=http://<proxy_name>. The valid protocols are HTTP and HTTPS. For example, to list an HTTP proxy, a valid string is http=http://http_proxy_name:80, where http_proxy_name is the name of the proxy server and 80 is the port number that you must use to access the proxy. If the proxy uses the default port number for that protocol, then you can omit the port number. If a proxy name is listed by itself, you can use it as the default proxy for any protocols that do not have a specified proxy. For example, http=http://http_proxy other_proxy uses http_proxy for any HTTP operations, while the HTTPS protocol uses the proxy named other_proxy.

You can list locally known host names or IP addresses in the proxy bypass list. This list can contain wildcards, such as "*", that cause the application to bypass the proxy server for addresses that fit the specified pattern, for example, "*.microsoft.com" or "*.org". Wildcard characters must be the left-most characters in the list. For example, "aaa.*" is not supported. To list multiple addresses and host names, separate them with blank spaces or semicolons in the proxy bypass string. If you specify the <local> macro, the function bypasses any host name that does not contain a period.

Warning: After Proxycfg.exe runs, you cannot restore the previous proxy settings. However, you can remove the proxy settings entirely.

Usage

To use the proxy configuration tool, open a command prompt window and run the proxy configuration utility with the appropriate command line parameters. The following section provides syntax examples.

Example Syntax

Example 1: Use a proxy only for external resources

The following is the most common use for Proxycfg.exe. This command specifies that both HTTP and HTTPS servers are accessed through the proxy server named "proxy_server", except for host names that do not contain a period.

proxycfg -p proxy_server "<local>"

Example 2: Use a proxy for all resources

The following example specifies that both HTTP and HTTPS servers are accessed through the proxy server named "proxy_server". No bypass list is specified.

proxycfg -p proxy_server

Example 3: Use a different proxy for secure resources

The following example specifies that HTTP servers are accessed through the http_proxy proxy and HTTPS servers are accessed through https_proxy. Local intranet sites and any site in the *.microsoft.com domain bypass the proxy.

proxycfg -p "http=http_proxy https=https_proxy" "<local>;*.microsoft.com"

Removing ProxyCfg.exe

After using the proxy configuration tool, you cannot restore your original proxy settings. However, if necessary, you can remove the registry settings that the utility creates. To remove the registry entries that ProxyCfg.exe creates, you must delete the WinHttpSettings value from the following registry key.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\
CurrentVersion\Internet Settings\Connections\WinHttpSettings

Deleting this key removes all proxy configurations.

ProxyCfg.exe and Authentication

The proxy configuration utility sets the default authentication policy. Because you should not perform NTLM authentication with untrusted hosts, by default, NTLM authentication only occurs automatically with hosts on the proxy bypass list. If there is no proxy, you can still use ProxyCfg.exe to specify a bypass list of hosts that you trust to perform NTLM authentication. A proxy name is required when using ProxyCfg.exe for this purpose, but you can use any valid string in place of a real proxy name.

For more information about the auto-logon policy, see Automatic Logon Policy.