Windows Proxy Logon Scripts Do Not Track Later Network Changes
Treat Windows logon-time proxy selection and later network transitions as separate events, with a deliberate client update and connection policy.
A laptop can correctly receive the office proxy at login and keep it after going home. The logon script ran once; it did not subscribe to every later Wi-Fi change. Background Group Policy processing is not a promise to rerun an arbitrary logon script on a transition.
Define the later behavior explicitly:
- Trigger: a managed application can use Network List Manager connectivity-change notifications to reconsider state. The notification itself neither chooses nor writes a proxy.
- Decision: inspect enough current network state. One private address or the first enumerated interface is weak evidence when Ethernet, Wi-Fi and VPN coexist.
- Consumer update: apply the setting through the interface the clients use. WinINet saving and documented settings-change/refresh notifications are separate actions; WinHTTP or private application configuration can need another path.
- Existing work: decide whether open connections may finish, must reconnect or should stop. A new proxy selection cannot move an established socket to another exit.
For participating proxy-aware clients, PAC is another design: keep per-destination selection in the client rather than replacing a static endpoint repeatedly. Its delivery and fallback policy still need to work on the roaming networks.