Windows Proxy Server Settings: How to Set Up, Manage and Turn Off a Proxy in Windows 11 and 10

Windows guide · Last reviewed 1 October 2026 · 15 min read

A Windows proxy server setting tells Windows, and the apps that listen to it, to send web traffic through another computer instead of connecting directly. This guide covers every place that setting lives on Windows 11 and Windows 10: the Settings app, the separate WinHTTP setting you manage with netsh, environment variables for PowerShell and command-line tools, and Group Policy or Intune for admins. It also explains how proxy logins work when Windows has no password box, which apps ignore the system proxy, how to turn it all off, and how to fix the usual errors. If the terms are new, start with our explainer on what proxy settings mean.

How a Windows proxy server setting works

People say “the Windows proxy” as if there were one switch. There are really three places a proxy can be set, and each one is read by a different kind of program. Most “the proxy isn’t working” problems come from setting it in one place while the app you care about reads another.

Microsoft’s own documentation draws the line between the first two. WinINet, the library behind the per-user setting, is meant for interactive desktop apps: it can prompt for credentials and keeps a credential cache. WinHTTP is the one to use in a service or service account, and it has neither of those. Microsoft’s WinHTTP docs add that on servers “the proxy configuration is normally managed by the server’s administrator”, originally with the old ProxyCfg.exe tool and now with netsh.

Settings > Network & internet > Proxy   (per user, WinINet)
      |--> Microsoft Edge, Google Chrome, most desktop apps

netsh winhttp set advproxy ...           (WinHTTP)
      |--> Windows services, background updaters, WinHTTP apps

$env:HTTPS_PROXY / set HTTPS_PROXY=...   (environment)
      |--> curl.exe, PowerShell 7, .NET HttpClient, dev tools

The app's own proxy fields / Proxifier
      |--> everything else, including apps that ignore all of the above

Set up a Windows proxy server in Windows 11 and 10

Open the page with Start, Settings, Network & internet, Proxy. The shortcut ms-settings:network-proxy, typed into the Run box (Windows key + R), opens the same page; Microsoft lists it among the official Settings URIs. The page has three options, and Microsoft’s support article describes them for both Windows 11 and Windows 10.

1. Automatically detect settings

Under Automatic proxy setup, the Automatically detect settings switch makes Windows look for a proxy script on the local network, using the Web Proxy Auto-Discovery method (WPAD). It is meant for company networks that publish one; at home it usually finds nothing.

2. Use setup script

Next to Use setup script, select Set up, turn on Use setup script, enter the script address and select Save. The address points to a PAC file, a small script that decides per site whether to use a proxy; see setup scripts below.

3. Manual proxy setup

1. Under Manual proxy setup, next to Use a proxy server, select Set up.
2. Turn on Use a proxy server.
3. In Proxy IP address, enter the proxy’s name or IP address, and in Port its port. Microsoft marks the port as optional, but almost every commercial proxy needs one.
4. Add any sites that should skip the proxy to the exceptions box, separated by semicolons.
5. Tick Don’t use the proxy server for local (intranet) addresses. Microsoft recommends it unless your organisation says otherwise.
6. Select Save.

On Windows 10 the same three options sit directly on the Proxy page as switches and boxes, instead of behind Set up buttons: turn on Use a proxy server, fill in the address and port, and select Save at the bottom. The fields and their meaning are the same.

If more than one option is on, Windows works through them in order. Microsoft’s NetworkProxy documentation lays it out: automatic detection first, then the setup script, then the manual proxy server, and a direct connection if none of them works. So if you type a manual proxy but traffic doesn’t go through it, check that detection or a script isn’t answering first.

VPN connections are separate. A VPN has its own proxy settings: Settings, Network & internet, VPN, select the connection, Advanced options, then Edit next to Proxy settings for this VPN connection. Microsoft notes that proxy settings deployed for Ethernet and Wi-Fi don’t apply to VPN connections.

The bypass list and “don’t use the proxy for local addresses”

A proxy on the internet can’t reach devices on your home or office network. If your router’s admin page, a network printer or an intranet site go through it, they simply fail. Two settings stop that:

• Don’t use the proxy server for local (intranet) addresses. Sends local names, such as single-word intranet hosts, straight to the network. Tick it in almost every case.
• The exceptions list. Addresses entered here always go direct. Separate entries with semicolons, for example 192.168.1.1;printer.home;intranet.example.com. Use it for local IP addresses, internal domains and any site that shouldn’t see the proxy’s IP.

The WinHTTP setting has its own bypass list. There, <local> is a special entry that, in Microsoft’s words, bypasses “all short name hosts”, and wildcards such as *.contoso.com appear in Microsoft’s own examples. Environment variables use NO_PROXY, a comma-separated list covered below.

Proxy username and password on Windows

Look at the manual proxy dialog again: there is an address, a port and an exceptions list, and nowhere to type a username or password. That is deliberate. Windows stores where the proxy is, not how to sign in to it. When a proxy needs a login, it answers the first request with HTTP status 407 Proxy Authentication Required and a Proxy-Authenticate header, as defined in RFC 9110. The app that sent the request has to answer with credentials, so how you enter them depends on the app:

• Browsers. Edge and Chrome show a sign-in box the first time a page needs the proxy. Enter the proxy username and password there. Chromium’s proxy documentation adds a detail worth knowing: Chrome “will not use any credentials embedded in the proxy settings”, so typing user:pass@host into the Windows address box doesn’t work. Our guide to Chrome proxy settings walks through the browser side.
• Desktop apps built on WinINet. WinINet includes a credential-prompting API and a credential cache, so these apps can ask once and reuse the answer. Visual Studio is one documented example: it prompts at startup and saves the login in Windows Credential Manager under Windows Credentials, as VSCredentials_<proxyAddress>.
• Services. WinHTTP has no prompt and no credential cache. A background service behind a proxy that demands a username and password can’t ask anyone, so it fails unless the program supplies credentials itself.
• Apps with their own proxy fields. curl, PowerShell, Proxifier, anti-detect browsers and browser extensions take the username and password directly. This is the most reliable route for an authenticated proxy.

Browser prompts are fine for a quick check, but they appear again in each new browser session and in every browser you use. If you switch proxies often or need one browser only, a proxy extension that stores the login is less work: ProxyEmpire’s free ProxyEmpire Proxy Manager extension for Chrome sets the proxy for Chrome alone and signs in for you.

Set up ProxyEmpire on Windows

ProxyEmpire’s rotating residential and mobile proxies run through one gateway: host v2.proxyempire.io, port 5000. Sign-in is by username and password only, so there is no IP whitelist to maintain when your home IP changes. Open the Proxy Manager in your dashboard and use the Connection Builder to pick the country, region or state, city, ZIP code, ISP (carrier on mobile), ASN and OS fingerprint, all included at no extra charge. Your choices are written into the proxy username, so a different location is simply a different username with the same host, port and password.

System-wide, through Windows Settings

1. Open Settings, Network & internet, Proxy, and select Set up next to Use a proxy server.
2. Turn it on. Enter v2.proxyempire.io as the proxy address and 5000 as the port.
3. Tick Don’t use the proxy server for local (intranet) addresses and select Save.
4. Open Edge or Chrome and load any page. When the sign-in box appears, paste the full proxy username from the Connection Builder, including its targeting part, and your proxy password.
5. Visit an IP-check page. The IP and location should match what you picked.

Everything that follows the system proxy now uses your plan’s bandwidth, including browser tabs you forget about and apps that update in the background. For most work it is better to proxy only what needs it: the Chrome extension for one browser, or the app’s own settings for a tool. On Android there is also a free ProxyEmpire Proxy Manager app on Google Play that routes Chrome or any app you choose.

In a single tool

For tools that accept a proxy URL, use http://YOUR_USERNAME:YOUR_PASSWORD@v2.proxyempire.io:5000. The gateway also speaks SOCKS5 on the same host and port. The Windows Settings page is for HTTP proxies, and Chromium browsers can’t send a SOCKS5 username and password, so use HTTP there and keep SOCKS5 for tools and Proxifier.

# curl.exe (included in current Windows 10 and 11); US exit, sticky session 123456
curl.exe -x "http://YOUR_USERNAME-country-us-sid-123456:YOUR_PASSWORD@v2.proxyempire.io:5000" https://ifconfig.me

# PowerShell 7: pass the proxy and ask for the login once
$cred = Get-Credential    # proxy username and password
Invoke-RestMethod https://ifconfig.me -Proxy "http://v2.proxyempire.io:5000" -ProxyCredential $cred

A few limits apply on every ProxyEmpire product. Only target ports 80 and 443 are open by default, and there is no UDP, so games and voice apps that need UDP won’t work through the proxy. Financial, government, crypto exchange, bank and payment sites are blocked on all proxy types; unblocking needs identity verification and a use-case review. Exit IPs are mostly IPv4, with some IPv6. Network status is public on the status page, which tracks the 99.9% uptime target.

netsh winhttp: show, set, import and reset

WinHTTP keeps its own proxy setting, separate from the one in Settings. Changing the Settings page doesn’t change it, and the reverse is also true. Use it when a service, a scheduled task or a server component needs to reach the internet through a proxy. Run these in Command Prompt or Windows Terminal opened as administrator, because the machine-wide setting is protected.

:: see the current WinHTTP proxy (newer and older commands)
netsh winhttp show advproxy
netsh winhttp show proxy

:: typical output when nothing is set
Current WinHTTP proxy settings:

    Direct access (no proxy server).

:: copy the current user's Internet Options proxy into WinHTTP
netsh winhttp import proxy source=ie

:: set a proxy for WinHTTP, skipping short local names and one domain
netsh winhttp set proxy proxy-server="proxy.example.com:8080" bypass-list="<local>;*.example.com"

:: the newer JSON form, machine-wide
netsh winhttp set advproxy setting-scope=machine settings={\"Proxy\":\"proxy.example.com:8080\",\"ProxyBypass\":\"\",\"AutoconfigUrl\":\"\",\"AutoDetect\":false}

:: back to a direct connection
netsh winhttp reset proxy

• show advproxy / show proxy display the current WinHTTP setting. Microsoft now marks show proxy and set proxy as deprecated in favour of the advproxy forms, which exist on current Windows 11 builds; the older forms are still accepted.
• set advproxy takes setting-scope=user or machine and a JSON object with four properties: Proxy, ProxyBypass, AutoconfigUrl and AutoDetect. It can also read the JSON from a file with settings-file=. Microsoft notes that SOCKS5 isn’t supported.
• set proxy takes proxy-server= (required) and an optional bypass-list=, where <local> skips short host names.
• import proxy source=ie copies the proxy from Internet Options, the same per-user setting the Settings app edits. Microsoft says importing from Internet Explorer’s settings is the only option available.
• reset proxy sets WinHTTP back to DIRECT, meaning no proxy.

Two cautions. First, WinHTTP can’t prompt for a password, so pointing it at a proxy that needs a username and password makes services fail with 407 unless the service passes credentials itself. Residential proxies with a username and password are rarely a good fit for machine-wide WinHTTP; set them in the tool instead. Second, the JSON escaping above is for Command Prompt. PowerShell treats quotes differently, so either run netsh from Command Prompt or save the JSON to a file and use settings-file=.

PowerShell, CMD and environment variables

Command-line tools don’t read the Settings page. curl reads its -x option or environment variables. Since PowerShell 7.0, Invoke-WebRequest and Invoke-RestMethod also honour environment variables, through .NET’s default proxy. Microsoft’s .NET documentation spells out the rule on Windows: read the environment variables first and, if none are set, fall back to the user’s proxy settings.

# PowerShell: this window only
$env:HTTP_PROXY  = "http://YOUR_USERNAME:YOUR_PASSWORD@v2.proxyempire.io:5000"
$env:HTTPS_PROXY = "http://YOUR_USERNAME:YOUR_PASSWORD@v2.proxyempire.io:5000"
$env:NO_PROXY    = "localhost,127.0.0.1,.internal.example"
curl.exe https://ifconfig.me

# PowerShell: save for your user account (new windows only)
[Environment]::SetEnvironmentVariable('HTTPS_PROXY', 'http://YOUR_USERNAME:YOUR_PASSWORD@v2.proxyempire.io:5000', 'User')

# Windows PowerShell 5.1 doesn't read the variables: pass the proxy directly
Invoke-WebRequest https://ifconfig.me -UseBasicParsing -Proxy "http://v2.proxyempire.io:5000" -ProxyCredential (Get-Credential)

:: Command Prompt: this window only
set HTTPS_PROXY=http://YOUR_USERNAME:YOUR_PASSWORD@v2.proxyempire.io:5000
curl https://ifconfig.me

Changes made with $env: or set last only for that window and the programs it starts. To keep them, use SetEnvironmentVariable with the User scope, or System Properties, Advanced, Environment Variables; Microsoft notes that changing the Machine scope needs permission, normally administrator rights. Already-open windows keep their old values, so open a new one. If the password contains characters such as @, : or #, URL-encode them in the proxy URL. And remember that a password in an environment variable is readable by anything running as you.

For every curl option, the socks5h:// scheme, and the curl errors you are likely to see, read our full guide to using curl with a proxy. In Windows PowerShell 5.1 note that curl is an alias for Invoke-WebRequest; type curl.exe for the real curl.

Setup scripts (PAC files)

A setup script is a PAC file: JavaScript with one function, FindProxyForURL(url, host), that returns either a proxy or DIRECT for each request. It is the Windows way to use a proxy for a few sites only, without an extension. Host the file on a web server and enter its address under Use setup script. Microsoft’s WinHTTP documentation notes that WinHTTP accepts only http: and https: script addresses, not file: paths, so a web address works for both kinds of app.

function FindProxyForURL(url, host) {
  // short local names go direct
  if (isPlainHostName(host)) return "DIRECT";
  // example.com and its subdomains use the proxy, then fall back to direct
  if (dnsDomainIs(host, ".example.com") || host == "example.com")
    return "PROXY v2.proxyempire.io:5000; DIRECT";
  // everything else goes direct
  return "DIRECT";
}

The proxy login still works the same way: the browser asks for the username and password when the script first sends it to the proxy. isPlainHostName and dnsDomainIs are standard PAC helper functions, documented in MDN’s PAC reference.

Group Policy and Intune for admins

• Intune or another MDM. The NetworkProxy CSP, available since Windows 10 version 1703 on Pro, Enterprise and Education, sets the same three options as the Settings page: AutoDetect, SetupScriptUrl and ProxyServer, with ProxyAddress, Exceptions and UseProxyForLocalAddresses beneath it. ProxySettingsPerUser (version 1803 and later) set to 0 makes the proxy machine-wide instead of per user. These settings apply to Ethernet and Wi-Fi, not VPN connections.
• Group Policy. The policy Prevent changing proxy settings sits under Administrative Templates, Windows Components, Internet Explorer, in both Computer and User Configuration (file inetres.admx). Microsoft’s description is simple: if you enable it, the user won’t be able to configure proxy settings. The name still says Internet Explorer because the policy dates from there.
• WinHTTP. Services still need their own setting: deploy netsh winhttp set advproxy setting-scope=machine settings-file=... through a startup script or your management tool.

If a user’s Proxy page is greyed out or reports that an organisation manages it, one of these policies is in force. Change it at the source, not on the PC.

Apps that ignore the system proxy

The Windows setting is a suggestion that apps can follow, not a network-level rule. Apps that use Windows’ web libraries follow it; apps that open their own connections, many command-line tools, and anything that sends UDP don’t. Firefox has its own connection settings, which can follow the system setting or use their own. Your options, from simplest to broadest:

1. The app’s own proxy settings. Many tools, scrapers and anti-detect browsers have proxy fields with a username and password. Use them when they exist.
2. A browser extension for one browser, such as ProxyEmpire Proxy Manager for Chrome.
3. Proxifier. Proxifier for Windows lets apps with no proxy support run through a proxy. Its documentation describes tunnelling all of a system’s TCP connections or only the ones you select, over HTTP, HTTPS, SOCKS4, SOCKS4A or SOCKS5, with SOCKS5 username and password, HTTP Basic, NTLM and Kerberos login. Rules match by application name and hostname, DNS can be resolved through the proxy, and proxies can be chained. Our Proxifier guide covers the setup step by step.

How to turn off a Windows proxy server setting

1. Settings. Go to Network & internet, Proxy. Select Set up (or Edit) next to Use a proxy server, turn it off and save. Turn off Use setup script too if a script is set. Leave Automatically detect settings on at work if your network uses it; at home it is safe either way.
2. VPN. If you use a VPN, check Proxy settings for this VPN connection as well.
3. WinHTTP. In an administrator prompt, run netsh winhttp show advproxy. If a proxy is set and you don’t want it, run netsh winhttp reset proxy.
4. Environment variables. In PowerShell, Get-ChildItem Env: | Where-Object Name -like '*proxy*' lists them. Remove one for your account with [Environment]::SetEnvironmentVariable('HTTPS_PROXY', '', 'User'), then open a new window.
5. Apps and extensions. Switch off proxies set inside browsers, extensions, Proxifier and individual tools.

If the proxy switches itself back on after a restart, something is setting it: a policy on a work PC, a VPN client, proxy software, or occasionally unwanted software. Check installed programs and extensions before changing it again.

Troubleshooting Windows proxy server problems

When in doubt, test in layers. First prove the proxy works with curl, which uses only what you give it. Then check the Settings page with a browser, then WinHTTP with netsh, then the environment. The layer where it breaks tells you which setting to fix.

Which proxies to use on Windows

Any standard HTTP or SOCKS5 proxy works on Windows; nothing special is needed for the operating system. What matters is that it supports what Windows and your tools expect: HTTP for the system setting and browsers, SOCKS5 for tools that want it, and username and password login, because Windows can pass a password through the prompt and every serious tool accepts one. Then choose the IP type for the task:

Residential proxies are $3.50/GB pay as you go, falling to $1.50/GB on larger plans, and unused bandwidth rolls over. Sticky sessions keep one IP on residential, mobile and rotating datacenter proxies when a series of requests must come from the same address. The $1.97 trial includes 100 MB of residential and 50 MB of mobile traffic; datacenter proxies start at a single GB for $2. Support is 24/7 from real people. Avoid free public proxy lists for anything that matters: you don’t know who runs them, and over plain HTTP the operator can read or change what you load.

Windows Server and “Microsoft Proxy Server”

Searches for “Windows Server proxy server” usually mean one of two things. The first is making a server reach the internet through a proxy. That is WinHTTP (netsh winhttp) for services, environment variables for command-line tools and scripts, and each application’s own settings; the Settings page only affects the signed-in user.

The second is running a proxy server on Windows Server, and here older guides mislead. The Remote Access role offers three role services: DirectAccess and VPN, Routing (NAT, BGP, RIP and other LAN routing), and Web Application Proxy, which Microsoft describes as reverse proxy functionality for publishing internal web apps, pre-authenticated with AD FS. None of them is a forward web proxy for users’ browsing, and following Routing and Remote Access setup steps doesn’t create one. Microsoft’s former web proxy and firewall product, Forefront Threat Management Gateway 2010, reached the end of extended support in April 2020. To run a forward proxy on Windows today, install third-party proxy software, or use a hosted proxy service.

Windows proxy FAQ

References

1. Microsoft Support — Use a proxy server in Windows (Windows 11 and 10). support.microsoft.com
2. Microsoft Learn — Netsh.exe commands for WinHTTP (import, reset, set advproxy, set proxy, show). learn.microsoft.com/windows/win32/winhttp/netsh-exe-commands
3. Microsoft Learn — WinINet vs. WinHTTP. learn.microsoft.com/windows/win32/wininet/wininet-vs-winhttp
4. Microsoft Learn — WinHTTP AutoProxy Support (WPAD and PAC). learn.microsoft.com/windows/win32/winhttp/winhttp-autoproxy-support
5. Microsoft Learn — NetworkProxy CSP. learn.microsoft.com/windows/client-management/mdm/networkproxy-csp
6. Microsoft Learn — InternetExplorer Policy CSP (“Prevent changing proxy settings”). learn.microsoft.com/windows/client-management/mdm/policy-csp-internetexplorer
7. Microsoft Learn — Launch the Windows Settings app (ms-settings URIs). learn.microsoft.com/windows/apps/develop/launch/launch-settings-app
8. Microsoft Learn — HttpClient.DefaultProxy (environment variables on Windows). learn.microsoft.com/dotnet/api/system.net.http.httpclient.defaultproxy
9. Microsoft Learn — Invoke-WebRequest (-Proxy, -ProxyCredential, -NoProxy). learn.microsoft.com/powershell/module/microsoft.powershell.utility/invoke-webrequest
10. Microsoft Learn — about_Environment_Variables. learn.microsoft.com/powershell/…/about_environment_variables
11. Microsoft Learn — Troubleshoot proxy and firewall issues in Visual Studio (proxy credential prompt, Credential Manager). learn.microsoft.com/visualstudio/ide/reference/proxy-firewall-troubleshoot
12. Microsoft Learn — Remote Access in Windows Server (Routing, Web Application Proxy). learn.microsoft.com/windows-server/remote/remote-access/remote-access
13. Microsoft Lifecycle — Forefront Threat Management Gateway 2010. learn.microsoft.com/lifecycle/products/…-gateway-2010
14. Chromium — Proxy support in Chrome (credentials in proxy settings, SOCKS5). chromium.googlesource.com/…/net/docs/proxy.md
15. IETF — RFC 9110, “HTTP Semantics”: 407 Proxy Authentication Required. rfc-editor.org/rfc/rfc9110
16. MDN — Proxy Auto-Configuration (PAC) file. developer.mozilla.org/…/Proxy_Auto-Configuration_PAC_file
17. curl — curl.1 man page (-x, environment variables). curl.se/docs/manpage.html
18. Proxifier — Proxifier for Windows v4 documentation. proxifier.com/docs/win-v4
19. Chrome Web Store — ProxyEmpire Proxy Manager extension. chromewebstore.google.com
20. Google Play — ProxyEmpire Proxy Manager app for Android. play.google.com