Set Up a PAC Proxy Script in Windows 11 and 10: Configuration, Testing and Fixes

Prerequisites and Compatibility Requirements​

Before configuring an automatic proxy script in Windows, confirm that your environment and script address meet the platform's networking requirements:

• Valid HTTP or HTTPS URL: You need the exact URL to the .pac or .dat script provided by your network administrator or proxy service (for example, [url]http://proxy.example.com/proxy.pac[/url]).
• Local File Protocol Restriction: Modern versions of Windows 10 and Windows 11 do not support referencing local PAC files using the file:// protocol (such as file://C:/proxy.pac). Microsoft deprecated local file parsing in the WinHTTP proxy service for security reasons. If you are testing a PAC file locally, you must host it on a local web server (such as IIS or a lightweight local HTTP server) and reference it via [url]http://localhost/[/url] or [url]http://127.0.0.1/[/url].
• Server MIME Type Configuration: The web server hosting the PAC file must serve it with the application/x-ns-proxy-autoconfig (or application/x-javascript-config) MIME type so the Windows HTTP Services (WinHttpAutoProxySvc) can parse it reliably.
• Connection Scope: Proxy setup scripts configured in Windows Settings apply to Wi-Fi and Ethernet connections for applications that rely on system WinINET/WinHTTP settings (including Microsoft Edge, Google Chrome, and Microsoft 365 apps). According to Microsoft Support documentation, these settings do not automatically apply to active Windows VPN connections.
• Account Permissions: Standard user accounts can change per-user proxy settings unless a system administrator has locked the interface via Active Directory Group Policy or Microsoft Intune.

Configure a PAC Script in Windows 11 and Windows 10​

Although both operating systems configure the same underlying WinINET user profile settings, the layout and controls inside the Settings app differ between Windows 11 and Windows 10.

Warning: Entering an unreachable URL, a mistyped address, or a syntactically broken PAC script can block outbound HTTP and HTTPS traffic for browsers and system apps. Keep a record of any existing proxy URL before modifying it so you can restore your configuration if connectivity drops.

Click to expand...

Windows 11 Procedure​

1. Press Windows + I to open the Settings app.
2. In the left navigation pane, select Network & internet.
3. In the right pane, click Proxy.
4. Locate the Automatic proxy setup section at the top of the page.
5. Next to Use setup script, click the Set up button (if a script is already configured, this button is labeled Edit).
6. In the Edit setup script dialog box that opens, toggle the Use setup script switch to On.
7. In the Script address field, type or paste the complete http:// or https:// URL pointing to your PAC file.
8. Click Save to apply the setting immediately. No system restart is required.

Windows 10 Procedure​

1. Press Windows + I to open Settings, then click Network & Internet.
2. Select Proxy from the bottom of the left-hand menu.
3. Under the Automatic proxy setup heading in the right pane, toggle the Use setup script switch to On.
4. In the Script address text box that becomes active, enter the full URL of your PAC script.
5. Click Save directly below the text box. Changes take effect immediately for new network connections.

Alternate Method: Configure the PAC Script via Legacy Internet Options or Command Prompt​

If you are working in an administrative environment, writing a logon script, or troubleshooting a machine where the modern Settings app is restricted, you can configure the PAC script through the classic Control Panel applet or the Windows Registry.

Using the Internet Properties Control Panel (inetcpl.cpl)​

This interface is identical in Windows 10 and Windows 11:

1. Press Windows + R to open the Run dialog.
2. Type inetcpl.cpl and press Enter to open the Internet Properties window.
3. Switch to the Connections tab and click the LAN settings button near the bottom.
4. In the Local Area Network (LAN) Settings dialog box, check the box labeled Use automatic configuration script.
5. Enter the PAC script URL into the Address field.
6. Click OK to close the LAN settings dialog, then click OK again to close Internet Properties.

Using Command Prompt or PowerShell (Registry Method)​

When you enable a setup script in the UI, Windows writes the script URL to the AutoConfigURL string value under the current user's Internet Settings registry key. You can set this directly from a standard Command Prompt window without elevating to Administrator:

1. Open Start, type cmd, and select Command Prompt.
2. Run the following command, replacing the example URL with your actual PAC file address:
   reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL /t REG_SZ /d "[url]http://proxy.example.com/proxy.pac[/url]" /f
3. Restart your open web browsers so they read the updated registry value, or open the LAN settings dialog (inetcpl.cpl) once and click OK to broadcast the setting change to running WinINET applications.

Verify That the PAC Script Is Applied and Working​

After saving the script address, confirm both that Windows has stored the setting and that applications are actively evaluating the script rules for outbound traffic.

1. Check the Active Registry Configuration​

Open Command Prompt and query the AutoConfigURL value under your user profile:

reg query "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL

If the PAC script is active, the output displays AutoConfigURL, the type REG_SZ, and the exact URL you configured. If the command returns ERROR: The system was unable to find the specified registry key or value, the automatic setup script is currently turned off.

2. Verify Proxy Evaluation in Microsoft Edge​

Because Microsoft Edge uses the Windows system proxy configuration by default, its internal networking diagnostics page shows whether the PAC script was successfully downloaded and which proxy servers it resolves for active connections:

1. Open Microsoft Edge.
2. In the address bar, type edge://net-internals/#proxy and press Enter.
3. Look under Effective proxy settings. You should see PAC script: followed by the exact URL you entered in Windows Settings.
4. If the script failed to load or contains syntax errors, this page will indicate a PAC fetch failure or fallback state.

3. Test Script Logic Against Specific URLs with PowerShell​

To confirm that the PAC file itself is reachable over the network and returning valid JavaScript functions, run the following command in PowerShell (substituting your script URL):

Invoke-WebRequest -Uri "[url]http://proxy.example.com/proxy.pac[/url]" -UseBasicParsing | Select-Object StatusCode, Headers, Content

Verify three things in the output:

• StatusCode returns 200.
• Headers includes Content-Type: application/x-ns-proxy-autoconfig (or a valid text/JavaScript MIME type).
• Content displays the function FindProxyForURL(url, host) code block.

Troubleshooting Common PAC Script Failures​

If websites fail to load, internal company portals time out, or updates to the PAC file on the server do not take effect on your PC, match your symptom to the fixes below.

• Symptom: A local PAC file (file://C:/proxy.pac) is ignored by Windows and browsers.
  • Cause: As documented by Microsoft Support, the WinHTTP proxy service in Windows 10 and Windows 11 blocks file:// protocol references for PAC scripts.
  • Fix: Host the PAC file on an HTTP/HTTPS web server on your network or run a local web server on the machine and reference it via [url]http://127.0.0.1/proxy.pac[/url].
• Symptom: The PAC script URL is reachable in a browser, but Windows ignores the proxy rules.
  • Cause: The web server hosting the .pac file is not sending the required MIME type, or Automatically detect settings (WPAD) is overriding or delaying script evaluation.
  • Fix: First, go to Settings > Network & internet > Proxy and toggle Automatically detect settings to Off so Windows relies solely on your explicit setup script. Second, verify with your web server administrator that .pac extensions are mapped to application/x-ns-proxy-autoconfig.
• Symptom: You updated the PAC script on the server, but Windows continues routing traffic using the old proxy rules.
  • Cause: Windows caches automatic proxy results per host for the active session to avoid running the JavaScript evaluation on every single packet.
  • Fix: Open edge://net-internals/#proxy in Microsoft Edge and click both Re-apply settings and Clear bad proxies. To flush DNS and cached network sockets across the OS, open Command Prompt and run ipconfig /flushdns. If you are actively developing a PAC script and need to disable automatic proxy result caching via policy, you can create the REG_DWORD value EnableAutoproxyResultCache set to 0 under HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings.
• Symptom: The "Use setup script" button is grayed out, or the old PAC URL comes back after you change or delete it.
  • Cause: Your device is managed by an organization via Active Directory Group Policy or Microsoft Intune, which enforces AutoConfigURL at policy refresh intervals.
  • Fix: Open an elevated Command Prompt and run gpresult /r or gpresult /h gpreport.html to check whether a domain policy is enforcing the proxy configuration. You must contact your IT administrator to update or remove a policy-enforced PAC script.
• Symptom: Command-line tools or background Windows services ignore the PAC script.
  • Cause: Background services running under LocalSystem or NetworkService use system-wide WinHTTP settings rather than your per-user HKCU profile settings, or a third-party CLI tool (such as Git, Python, or curl) does not natively evaluate JavaScript PAC files.
  • Fix: Checkwhether static WinHTTP proxy settings are conflicting by running netsh winhttp show proxy in Command Prompt. For CLI tools that do not parse PAC scripts, inspect the PAC file contents to find the target proxy IP and port (for example, PROXY 10.10.1.50:8080), and set that address directly in the tool's HTTP_PROXY and HTTPS_PROXY environment variables.

Rollback: How to Safely Disable a PAC Script​

If you leave the corporate network, switch to a different internet connection where the PAC server is unreachable, or experience loss of internet access due to a misconfigured proxy script, disable the setup script using any of the three methods below:

Method 1: Disable via Windows Settings​

• Windows 11: Go to Settings > Network & internet > Proxy. Next to Use setup script, click Edit, toggle Use setup script to Off, and click Save.
• Windows 10: Go to Settings > Network & Internet > Proxy. Under Automatic proxy setup, toggle Use setup script to Off.

Method 2: Disable via Internet Options (inetcpl.cpl)​

1. Press Windows + R, type inetcpl.cpl, and press Enter.
2. Go to the Connections tab and click LAN settings.
3. Uncheck Use automatic configuration script and click OK twice.

Method 3: Remove via Command Prompt​

To immediately remove the user PAC script configuration from the registry, open Command Prompt and run:

reg delete "HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings" /v AutoConfigURL /f

After running the command, close and reopen your web browser to resume direct internet connectivity.