Tag: edge

How to Point Your Browser at CyBlock (Manual Settings and PAC File)

Applies to: CyBlock · Connecting browsers to your CyBlock web filter — manual settings for testing, PAC file via Group Policy for production.

CyBlock is a web filter that businesses use to control and monitor employee web access. To have a browser send its traffic through CyBlock, you point the browser at your CyBlock server using its connection settings. There are two ways to do this: for production, push CyBlock’s PAC file to all browsers using Group Policy (GPO) so every machine is configured automatically and stays consistent; for quick testing on a single machine, enter the connection settings manually in the browser.

Before you begin

You’ll need your CyBlock connection settings:

The server address and port for your CyBlock filter
Your PAC file URL (for PAC-based setup) — see Finding your PAC file URL below

Where to find your connection settings: These are specific to your deployment. Find the server address and port in the product under Settings → Proxy. If you’re on the CyBlock Cloud service, use the connection details Wavecrest provided when your account was set up. If you can’t locate them, contact us at 321-953-5351 or support@wavecrest.net.

Finding your PAC file URL

Your PAC file URL is available in CyBlock at:

Settings → Proxy → PAC File

Use this URL wherever a PAC or automatic-configuration URL is required below.

Which method should I use?

Production → push the PAC file via Group Policy. It’s centrally managed, consistent across all machines, and updates everywhere when the PAC file changes.
Testing / a single machine → enter the connection settings manually in the browser.

Manual setup (for testing)

Google Chrome, Microsoft Edge, and Internet Explorer (Windows connection settings)

Chrome, Edge, and Internet Explorer all use the Windows system connection settings, so configuring them once covers all three. (Chrome’s and Edge’s own buttons simply open these Windows settings.)

Windows 10 / 11:

Open Settings → Network & Internet → Proxy.
To connect directly: under Manual proxy setup, turn on Use a proxy server and click Set up. Enter your CyBlock server address and port, then click Save.
To use the PAC file instead: under Automatic proxy setup, turn on Use setup script, enter your PAC file URL, then click Save.

Classic dialog (any Windows version):

Press Win + R, type inetcpl.cpl, and press Enter to open Internet Options.
On the Connections tab, click LAN settings.
To connect directly: check Use a proxy server for your LAN, enter your CyBlock server address and port, and clear the other checkboxes.
For the PAC file: check Use automatic configuration script and enter your PAC file URL in the Address field.
Click OK, then OK again.

Mozilla Firefox

Firefox keeps its own connection settings, separate from Windows.

Click the menu button (☰) and choose Settings.
In the General panel, scroll down to Network Settings and click Settings….
To connect directly: select Manual proxy configuration, enter your CyBlock server address in the HTTP Proxy field, enter your port, and check Also use this proxy for HTTPS.
For the PAC file: select Automatic proxy configuration URL and enter your PAC file URL.
Click OK.

To have Firefox follow the Windows setting instead, choose Use system proxy settings.

Pushing the PAC file via Group Policy (for production)

Use Group Policy to deploy the PAC file to all managed browsers automatically. The correct method depends on the browser.

Google Chrome and Microsoft Edge (ADMX policies)

Import the Chrome and/or Edge ADMX templates into your domain Central Store (if not already present).
In Group Policy Management, edit the GPO that targets your users or computers.
Go to Computer Configuration → Policies → Administrative Templates → Google → Google Chrome → Proxy server (for Edge: Microsoft Edge → Proxy server).
Enable Choose how to specify proxy server settings and set it to Use a .pac proxy script.
Enable URL to a proxy .pac file and enter your PAC file URL.
Apply the GPO. Clients pick it up on the next policy refresh, or immediately with gpupdate /force.

Windows connection settings / Internet Explorer (Group Policy Preferences)

For browsers that rely on the Windows system connection settings (Internet Explorer, and Chrome/Edge where their own ADMX policies aren’t used):

In Group Policy Management, edit your GPO.
Go to User Configuration → Preferences → Control Panel Settings → Internet Settings and create a new item for your Windows/IE version.
Enable the Use automatic configuration script option and enter your PAC file URL. Press F5 so the setting applies (it turns green).
Apply the GPO.

The exact controls vary by Windows version; if the Internet Settings preference doesn’t expose the auto-config field on your build, push the PAC URL by setting the AutoConfigURL value under HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings with a Registry preference instead.

Note on older documentation: Earlier guides configured this through Internet Explorer Maintenance (User Configuration → Windows Settings → Internet Explorer Maintenance → Automatic Browser Configuration). That method no longer applies — Microsoft removed Internet Explorer Maintenance for managing Windows 8 and later, and Internet Explorer was retired in June 2022. Use the ADMX or Internet Settings methods above.

CyBlock — Users Not Being Identified (Missing User IDs / Browser Login Prompt)

Applies to: CyBlock · When activity isn’t logged by username, or employees get browser login prompts.

CyBlock identifies users automatically via NTLM as their traffic passes through the proxy. When that identification fails, you’ll see one or both of these symptoms:

Usernames are blank or show as IP addresses in CyBlock activity and reports.
Employees get a pop-up username/password prompt in Edge or Chrome when browsing — even to everyday sites.

Both symptoms mean CyBlock isn’t successfully identifying the user. Work through the two areas below in order: first confirm CyBlock’s own authentication rule, then (if users are being prompted) the Windows/browser configuration.

(If usernames are appearing but all fall under Ungrouped IDs, that’s a different issue — IDs are captured but not organized into your Groups and IDs tree. See the Terms Glossary for Ungrouped IDs.)

Step 1 — Check the CyBlock Authentication Manager rule

Start here. CyBlock needs an NTLM authentication rule to identify users.

Go to User Management → Authentication → Authentication Manager.
Open the Rules tab.
Confirm there is a rule with:
- Type: NTLM, and
- Network definition: *Default

If that NTLM rule is present and correct, CyBlock is set up to identify users, and the problem is most likely on the Windows/browser side — continue to Step 2. If the rule is missing or its network definition is wrong, correcting it here is the fix.

Step 2 — If employees are being prompted to log in (Windows/browser configuration)

What’s happening and why

CyBlock identifies users silently by asking the browser to confirm the employee’s Windows login as traffic passes through the proxy — normally invisible to the user. Recent Windows 11 and Edge/Chrome security changes tightened the rules around this automatic sign-in, so the browser now needs to be explicitly told it’s safe to release Windows credentials to the CyBlock proxy. If it isn’t, the browser either prompts the employee for credentials or skips identification entirely (leaving usernames blank).

This is a Microsoft security change, not a CyBlock defect. The fix is applied by your IT administrator via Group Policy (GPO), which pushes the settings to all computers at once. Getting cloud-proxy NTLM working reliably requires two GPO controls — both must be in place.

Which browsers need configuration

Microsoft Edge — requires configuration
Google Chrome — requires configuration
Internet Explorer — not affected
Firefox — uses a separate process; contact Wavecrest Support if Firefox is in use

Layer 1 — Allow the proxy to request Windows authentication (AuthServerAllowlist)

This tells Edge and Chrome that the CyBlock proxy is allowed to request integrated Windows authentication.

Microsoft Edge (GPO):

Open Group Policy Management Console (gpmc.msc) and edit a GPO linked to the OU containing your computers.
Go to Computer Configuration → Administrative Templates → Microsoft Edge → HTTP authentication.
Open Configure list of allowed authentication servers, set it to Enabled.
In the value field, enter: *.cloud.cyblock.com,cloud.cyblock.com
Click OK.

(First-time setup: download the Edge policy templates from https://www.microsoft.com/en-us/edge/business/download and copy msedge.admx / msedge.adml into your domain controller’s Central Store.)

Google Chrome (GPO):

In the same or a linked GPO, go to Computer Configuration → Administrative Templates → Google → Google Chrome → HTTP authentication.
Open Authentication server allowlist, set it to Enabled.
In the value field, enter: *.cloud.cyblock.com,cloud.cyblock.com
Click OK.

(Registry equivalent, for non-domain machines — apply as a computer/HKLM policy:

Edge: HKLM\SOFTWARE\Policies\Microsoft\Edge → AuthServerAllowlist (REG_SZ) = *.cloud.cyblock.com,cloud.cyblock.com
Chrome: HKLM\SOFTWARE\Policies\Google\Chrome → AuthServerAllowlist (REG_SZ) = *.cloud.cyblock.com,cloud.cyblock.com)

Layer 2 — Move the proxy into the Local Intranet zone (Site to Zone Assignment)

Even with Layer 1 set, Windows checks the security zone of the proxy host before it will release credentials automatically. Because cloud.cyblock.com is an internet-hosted address, Windows treats it as the Internet zone, and Internet-zone hosts prompt the user instead of signing in silently. The proxy must be reassigned to the Local Intranet zone for automatic authentication to work.

GPO:

Go to Computer Configuration → Policies → Administrative Templates → Windows Components → Internet Explorer → Internet Control Panel → Security Page → Site to Zone Assignment List.
Set it to Enabled, then click Show and add:
- Value name: cloud.cyblock.com
- Value: 1 (1 = Local Intranet zone)
Click OK.

(Even though the GPO path says “Internet Explorer,” this zone list is also read by Edge and Chrome for the integrated Windows authentication credential decision.)

(On-premise / appliance deployments: substitute your own internal proxy hostname for cloud.cyblock.com. Whether the zone step is needed depends on whether your proxy hostname already resolves to the Local Intranet zone — contact Wavecrest Support if unsure.)

Single-machine test (before a full GPO rollout)

To confirm the two-layer fix on one affected machine before deploying via GPO, run these as Administrator, then fully restart the browser and check the CyBlock log for usernames:

reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\cloud.cyblock.com" /v https /t REG_DWORD /d 1 /f

reg add "HKLM\SOFTWARE\Policies\Microsoft\Edge" /v AuthServerAllowlist /t REG_SZ /d "*.cloud.cyblock.com,cloud.cyblock.com" /f

Apply and verify

Run gpupdate /force on a test machine (or wait for Group Policy to refresh).
Fully restart the browser — these policies require a complete browser restart, not just a new tab.
Confirm the policy is active: open edge://policy (Edge) or chrome://policy (Chrome) and check that AuthServerAllowlist shows the correct value.
Browse to any external site, then check the CyBlock activity log for the username.
If it’s still not working, check Event Viewer → Applications and Services Logs → Microsoft → Windows → GroupPolicy for GPO application errors.

Troubleshooting

Symptom	Likely cause	Action
Usernames blank, no NTLM rule found	CyBlock auth rule missing	Add/correct the NTLM rule (`*Default`) in Authentication Manager (Step 1)
Login prompts persist after GPO deployed	Browser not fully restarted	Close and reopen all browser windows
Usernames still blank after Layer 1	Proxy still in Internet zone	Apply the Layer 2 Site-to-Zone assignment
Policy not showing in `edge://policy`	Edge ADMX templates not installed	Install templates in the Central Store on your domain controller
Only some computers affected	GPO linked to wrong OU	Ensure the GPO is linked to the OU with computer accounts, not user accounts

Additional notes

Apply these as computer policies (HKEY_LOCAL_MACHINE), not user policies.
Multiple proxy addresses can be listed, comma-separated, no spaces.
This is part of Microsoft’s ongoing phase-out of older authentication methods; Wavecrest will update guidance as the rollout continues.
For help, contact support@wavecrest.net.