Skip to main content

Deploy to Windows with Active Directory

Describes distributing proxy PAC URL and root CA through AD Group Policy using PowerShell or manual GPO. Covers single/shared device modes, email identification, and verification.

Active Directory Group Policy has more than one deployment method. This article covers two methods. One is the recommended PowerShell script. The other is manual Group Policy.

Supported platforms

  • Windows 10 version 1709 and later

  • Windows 11 (Home, S, Pro, Education, Enterprise, and IoT Enterprise editions)

About this document

This article covers two ways to deploy F5 Workforce AI Security proxy settings through Active Directory Group Policy. The first is a PowerShell script (recommended). The second is manual Group Policy Objects (GPOs). If you prefer policy-based deployment or must fit into existing Group Policy settings, use the manual method.

Both methods deploy two items. The Workforce AI Security proxy auto-config (PAC) URL sets the proxy settings. Workforce AI Security uses the root certificate authority (CA) certificate to intercept traffic. This article doesn't explain how to connect devices to Active Directory. It also doesn't explain how to manage or distribute Group Policy within Active Directory.

Background

Proxy auto-config file

Workforce AI Security distributes its proxy information in a PAC file. The PAC file has all the information needed to send only generative AI traffic to the Workforce AI Security proxy service. All other traffic takes its typical route.

With the PAC file, Workforce AI Security can update the list of generative AI domains. Most operating systems and browsers request the PAC file every hour or two. If a device can't retrieve a new file, it keeps using the current one.

Root certificate

Workforce AI Security uses certificate trust to intercept connections to generative AI websites. It then applies policy to those connections. Other vendors of network security and secure access service edge (SASE) work the same way. Every device that Workforce AI Security governs must trust the Workforce AI Security root CA certificate.

Configure Group Policy

You do all configuration in this section in the Group Policy Management console. The console is on an Active Directory server. It's also on a client system that has the Remote Server Administration Tools (RSAT) installed.

Get the deployment files

Before you deploy Workforce AI Security through Active Directory Group Policy, get the root certificate, the PAC URL, and the deployment script. Do the tasks in this section.

Download the root certificate

  1. In CONFIGURE, go to Organization > Integration.

  2. In the File Downloads section, find the SurePath AI Root CA Certificate.

  3. Download the certificate with the CER option.

  4. Keep the certificate so you can upload it into a Group Policy Object.

Create a Proxy connector and get the proxy auto-config URL

  1. In CONFIGURE, go to Connectors.

  2. Select ADD CONNECTOR.

  3. Enter a descriptive name for the connector, such as Windows Active Directory Deployment.

  4. Select Proxy as the connector type.

  5. Select SAVE to generate the unique PAC file URL.

  6. Copy the PAC file URL from the connector details page. You need it in the deployment steps below.

Download the PowerShell deployment script

The PowerShell deployment script is a flexible, automated way to configure proxy settings on Windows devices. To download the script:

  1. On the Proxy connector details page, find the MDM Files section.

  2. Select DOWNLOAD to download the mobile device management (MDM) deployment files.

  3. Extract the ZIP file to get SurePath.AI.deploy.ps1 for Windows deployment.

Use the PowerShell deployment script to deploy Workforce AI Security proxy settings to Windows devices through Active Directory Group Policy. This is the recommended method.

Script features

The PowerShell script has these features:

  • Simplified deployment: One script handles all proxy settings, the certificate, and security policies. You don't create many separate Group Policy settings.

  • User identification: The script can detect user email addresses and add them to the PAC URL. Workforce AI Security can then link native application traffic to a specific user, not only to the connector. This improves visibility in User Activity logs. You can also apply user-specific policy.

  • Flexible configuration: Script parameters cover single-user devices and shared computers. They also control optional features such as email detection.

  • Easier maintenance: To update proxy settings, you change the script parameters. You don't recreate several Group Policy settings.

  • Automatic detection and fallback: The script detects the deployment context automatically. It can also remove its own configuration. It has fallback mechanisms.

How Group Policy runs scripts

The two script types work differently.

Computer Configuration startup scripts run at system startup, before any user logs in. They run with Local System privileges. They can change machine-wide settings in the HKEY_LOCAL_MACHINE (HKLM) registry hive. They can install certificates to the Local Machine store. Use them for single-user device deployments and for machine setup on shared devices.

User Configuration login scripts run when a user logs in, under that user's credentials. They can change user-specific settings in the HKEY_CURRENT_USER (HKCU) registry hive. Their privileges are limited. Use them for user-specific configuration on shared devices.

You link a Group Policy Object that has a login script to an organizational unit (OU). The script then runs for every user who logs in to a device in that OU.

64-bit PowerShell requirement

The Workforce AI Security deployment script must run in 64-bit PowerShell on 64-bit Windows systems. When you add scripts to Group Policy, always use the full path to 64-bit PowerShell: %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe. Use the 32-bit path (%SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe) only for 32-bit Windows systems. These systems are rare in enterprise environments.

Single-user device deployment

Use this method for devices where only one user regularly logs in. The PowerShell script deploys a complete system-wide configuration with a Computer Configuration startup script. This method suits personal work devices, dedicated workstations, and devices assigned to one user. Each device has only one user, so the script can run with Local System privileges. In one pass, it installs the certificate, sets the PAC URL, and applies security policies.

Configure the script for single-user deployment

Before you deploy the script through Group Policy, set the argumentOverride variable. It holds the deployment parameters.

By default, the script adds a globally unique identifier (GUID) to the PAC URL. The GUID identifies the user. This method works in all environments.

It doesn't need email address detection. Some identity setups have no email information. The GUID gives consistent user tracking in User Activity logs. You can also apply user-specific policy.

To use the default GUID-based identification, leave the argumentOverride variable empty. You can also leave the script unmodified:

$argumentOverride = ""

The script does these tasks automatically:

  • Installs the Workforce AI Security root CA certificate to the Local Machine trusted certificate store

  • Deploys proxy settings system-wide, so they apply to all users on the device

  • Generates a unique GUID and adds it to the PAC URL for user tracking

Use email-based identification (optional)

You can also set the script to detect the user's email address and use it for identification. With email-based identification, users don't need to authenticate to use generative AI services through Workforce AI Security. Workforce AI Security identifies each user from the email address in the PAC URL. This method needs email information from an identity source. Sources include Active Directory, Entra ID, and user environment variables.

To turn on email-based identification:

  1. Open the SurePath.AI.deploy.ps1 file in a text editor.

  2. Find the $argumentOverride = "" line near the top of the script.

  3. Set the override to turn on email detection:

$argumentOverride = "-Email"

  1. Save the modified script file.

With this setting, the script tries to detect the user's email address from these sources, in this order:

  1. Entra - Uses dsregcmd /status to query Azure AD (Entra ID) user information, with fallback to the CloudDomainJoin registry.

  2. Outlook - Checks Outlook profile registry locations for configured email addresses.

  3. Office - Queries Microsoft 365/Office identity from the Office registry keys.

  4. Intune - Queries Intune MDM enrollment data for user email.

  5. ActiveDirectory - Queries on-premises Active Directory for the user's email attribute (only on domain-joined devices).

  6. EntraID - Uses the whoami /upn command (legacy method).

  7. UserEnvironment - Checks the Volatile Environment registry for the user principal name (UPN).

  8. IdentityStore - Checks Windows identity store cache for cached user identities.

If email detection fails, the script falls back to a GUID. To require email-based identification with no fallback, add the -NoGUID flag (for example, $argumentOverride = "-Email -NoGUID"). With this flag, if the script can't detect an email address, deployment fails.

Deploy the script through Group Policy

After you set the argumentOverride variable, deploy the script to target devices. Use a Computer Configuration startup script:

  1. Store the modified SurePath.AI.deploy.ps1 script in a network location that all target computers can reach. Examples are the SYSVOL folder or a shared network location.

  2. Open the Group Policy Management console.

  3. Create a Group Policy Object, or edit an existing one:

    1. Right-click the Group Policy Objects folder and select New.

    2. Enter a descriptive name such as Workforce AI Security Proxy - Single User Devices.

    3. Right-click the new GPO and select Edit.

  4. In the Group Policy Management Editor, go to Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown).

  5. Double-click Startup.

  6. In the Startup Properties window, select Add.

  7. In the Add a Script window, do these steps:

    1. For Script Name, enter the full path to PowerShell: %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe.

    2. For Script Parameters, enter -NoProfile -ExecutionPolicy Bypass -File "\\domain\SYSVOL\domain.com\scripts\SurePath.AI.deploy.ps1". Replace the path with the actual script location.

    3. Select OK.

  8. Select OK to close the Startup Properties window.

  9. Close the Group Policy Management Editor.

After you create the GPO, link it to the OUs that contain single-user devices:

  1. In the Group Policy Management console, right-click the target OU. It contains the computer objects for single-user devices.

  2. Select Link an Existing GPO.

  3. Select the new GPO from the list.

  4. Select OK.

The script runs at the next system startup on devices in the linked OU. Each device gets the complete configuration. The complete configuration includes the certificate, the PAC URL, and the security policies.

Shared/multi-user device deployment

Use this method for devices where many users log in, such as shared workstations, kiosks, or terminal servers. It has two steps. The first step installs the root CA certificate and sets security policies at the machine level. The second step deploys user-specific proxy settings when each user logs in.

Overview of the two-step approach

Machine setup (once for each device)

Machine setup configures the components that apply to all users on the device:

  • Installs the Workforce AI Security root CA certificate to the Local Machine trusted certificate store

  • Sets policies that prevent users from changing proxy settings

You can do this step with manual Group Policy configuration. You can also use a PowerShell script with the -NoProxy flag. Deploy it through Computer Configuration startup scripts. Both ways give the same result. Choose the one that fits your existing Group Policy practices.

User-level proxy configuration (runs at each user's first login)

After machine setup, each user who logs in needs their own proxy configuration. This step uses User Configuration login scripts to write the PAC URL to each user's HKCU registry hive. The PAC URL has a user-specific identifier. By default, the identifier is a GUID. You can also use an email address. With this identifier, Workforce AI Security can track activity by individual user, not only by device.

Machine setup options

Option A: Use manual Group Policy for the certificate and lockdown

You can deploy the root CA certificate and the proxy lockdown policies with standard Group Policy settings. This option fits well with existing certificate and policy management workflows.

For the certificate, follow the steps in Distribute the root certificate.

For the proxy lockdown policies, follow the steps in Prevent users from changing proxy settings (optional).

Option B: Use the PowerShell script with the -NoProxy flag

You can also use the PowerShell deployment script. It installs the certificate and sets security policies without setting the PAC URL. If you prefer one script for all components, this option suits you.

To configure the script for machine setup:

  1. Open the SurePath.AI.deploy.ps1 file in a text editor.

  2. Find the $argumentOverride = "" line.

  3. Set the override to configure machine setup without a proxy:

$argumentOverride = "-NoProxy"

  1. Save the modified script file.

Deploy this version of the script with Group Policy Computer Configuration startup scripts:

  1. Store the modified script in a network location that all target computers can reach.

  2. Create a Group Policy Object with a descriptive name such as Workforce AI Security - Machine Setup (Shared Devices).

  3. Go to Computer Configuration > Policies > Windows Settings > Scripts (Startup/Shutdown).

  4. Double-click Startup.

  5. Add the script with these values:

    • Script Name: %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe

    • Script Parameters: -NoProfile -ExecutionPolicy Bypass -File "\\domain\SYSVOL\domain.com\scripts\SurePath.AI.deploy.ps1". Use your script path.

  6. Link the GPO to the OUs that contain shared/multi-user devices.

The script installs the certificate and sets lockdown policies without setting the PAC URL.

Set up user-level proxy auto-config

After machine setup, deploy a second PowerShell script. Configure it for user-level proxy settings. This script must run when each user logs in. Then every user gets the proxy configuration with their own unique identifier.

By default, the script adds a GUID to the PAC URL for each user. This method works in all environments and gives consistent per-user tracking in Workforce AI Security. It doesn't need email address detection. Each user who logs in to the shared device gets a unique identifier in the PAC URL.

To configure the script with default GUID-based identification:

  1. Open a new copy of SurePath.AI.deploy.ps1 in a text editor. If you didn't use Option B, you can use the same file.

  2. Find the $argumentOverride = "" line.

  3. Set the override to configure the user-level proxy:

$argumentOverride = "-User"

  1. Save the modified script file with a different name, for example SurePath.AI.deploy.user.ps1. The different name distinguishes this script from the machine setup script.

Use email-based identification (optional)

You can also turn on email-based identification. With email-based identification, users don't need to authenticate to use generative AI services. The script detects each user's email address from several identity sources and adds it to the PAC URL. The sources include Entra ID, Outlook, Office, Intune, and Active Directory. If email detection fails for a user, the script falls back to a GUID.

To turn on email-based identification, use this setting:

$argumentOverride = "-User -Email"

With the -Email flag, the script tries to detect the user's email address from several sources. These include Active Directory, the Entra ID registry, and user environment variables. The first email address that the script detects goes into the PAC URL.

Deploy this version through Group Policy User Configuration login scripts:

  1. Store the modified script in a network location that all users can reach.

  2. Create a Group Policy Object with a descriptive name such as Workforce AI Security Proxy - User Level (Shared Devices).

  3. Go to User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff).

  4. Double-click Logon.

  5. In the Logon Properties window, select Add.

  6. In the Add a Script window, enter these values:

    • Script Name: %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe

    • Script Parameters: -NoProfile -ExecutionPolicy Bypass -File "\\domain\SYSVOL\domain.com\scripts\SurePath.AI.deploy.user.ps1". Use your script path.

  7. Select OK.

  8. Select OK to close the Logon Properties window.

  9. Link the GPO to the same OUs that you used for machine setup.

This configuration writes the PAC URL to each user's HKCU registry hive. The URL has the user's unique identifier. By default, the identifier is a GUID. If you set the -Email flag, the identifier is an email address.

Machine setup already installed the certificate. The script finishes quickly for each user. Each user gets their own proxy configuration the first time they log in to the shared device.

Deploy with manual Group Policy settings (alternative)

The manual method deploys Workforce AI Security proxy settings through standard Group Policy Objects. If you use policy-based management exclusively, use this method. Use it also if you must combine Workforce AI Security settings with existing Group Policy configurations.

The manual method needs three Group Policy settings. One sets the PAC URL and proxy settings. One prevents users from changing proxy settings. One distributes the root CA certificate. This method gives fine control over each component. It takes more administrative effort to create and maintain than the PowerShell script method.

Distribute the proxy auto-config URL

You can distribute the PAC URL with Internet Settings preferences or Registry preferences. Configure only one of them. Both together can conflict.

Option A: Internet Settings (preferred)

  1. Open the Group Policy Management console.

  2. Create or edit a Group Policy Object.

  3. In the Group Policy Management Editor, go to User Configuration > Preferences > Control Panel Settings > Internet Settings.

  4. In the Internet Settings section, right-click an empty area and select New > Internet Explorer 10.

  5. Open the Connections tab.

  6. Select LAN settings.

  7. In the Address box, enter the Workforce AI Security Proxy PAC URL that you copied earlier.

  8. Select OK to close the LAN settings window.

  9. Select OK to close the Internet Settings window.

Option B: Registry

  1. In the Group Policy Management Editor, go to Computer Configuration > Preferences > Windows Settings > Registry.

  2. In the Registry section, right-click an empty area and select New > Registry Item.

  3. Configure the registry item:

    • Action: Create

    • Hive: HKEY_LOCAL_MACHINE

    • Key Path: SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings

    • Value name: AutoConfigURL. Make sure Default isn't selected.

    • Value type: REG_SZ

    • Value data: Enter the Workforce AI Security Proxy PAC URL that you copied earlier.

  4. Select OK to close the window.

Distribute the root certificate

  1. In the Group Policy Management Editor, go to Computer Configuration > Policies > Windows Settings > Security Settings > Public Key Policies > Trusted Root Certification Authorities.

  2. Right-click the blank space and select Import....

  3. When the Certificate Import Wizard opens, select Next.

  4. Select Browse....

  5. Choose the Workforce AI Security root certificate that you downloaded earlier.

  6. Select Next.

  7. On the Certificate Store page, keep the default selections.

  8. Select Next.

  9. On the confirmation page, select Finish.

Make proxy settings system-wide

  1. In the Group Policy Management Editor, go to Computer Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer.

  2. Double-click the Make proxy settings per-machine (rather than per-user) setting.

  3. Select Enabled.

  4. Select OK.

Prevent users from changing proxy settings (optional)

  1. In the Group Policy Management Editor, go to User Configuration > Policies > Administrative Templates > Windows Components > Internet Explorer.

  2. Double-click the Prevent changing proxy settings setting.

  3. Select Enabled.

  4. Select OK.

After you configure the Group Policy settings, link the GPO to the right OUs:

  1. In the Group Policy Management console, right-click the OU where you want to apply the policy.

  2. Select Link an Existing GPO.

  3. Select the configured Group Policy Object from the list.

  4. Select OK. The policy now applies to all devices in that OU.

Verify the integration

After you complete the deployment, use the Workforce AI Security Ready tool to verify that the endpoint is integrated.

Things to know

Group Policy propagation

Group Policy can take a long time to propagate across an organization. To avoid the wait, run a command on a specific Windows device. The command forces the device to download the latest Group Policy from Active Directory immediately.

To force the update:

  1. Open a command prompt (CMD) on the Windows device with administrative privileges.

  2. Enter gpupdate /force. When the command finishes, the local computer has the latest version of its Group Policy.

Embedded generative AI services

Workforce AI Security requires users to authenticate in a web browser. This applies when they use generative AI web services such as ChatGPT. Some applications and platforms have generative AI built into their own systems and don't use a browser. These embedded services can't complete the browser-based authentication.

Workforce AI Security doesn't currently support routing traffic from embedded services. Support is planned for a future release. Check this documentation for updates when that support becomes available.

Applications with internal proxy configurations

Some applications can bypass system-level network settings such as proxies. For example, Mozilla Firefox can use the system-level settings. You can also configure it to override them. You can control this behavior through Group Policy or application settings. Some applications don't allow that control.

Related Articles
Did this answer your question?