The Rogue Network Configuration
In corporate environments, IT departments frequently use Proxy Auto-Configuration (PAC) scripts to tell employee laptops how to route their internet traffic. Windows 10 facilitates this via a setting called “Use setup script.” When enabled, Windows will attempt to download a small JavaScript file from a specified URL every time you connect to a network, and use the rules within that script to determine which proxy servers to use for specific websites.
However, if you are not on a corporate network, this setting is a significant security risk. Malicious software, or even a compromised public Wi-Fi network, can secretly inject a URL into this field. If Windows downloads a malicious PAC script, attackers can silently redirect your web traffic through their own servers, allowing them to spy on your browsing or inject advertisements into webpages. If you are a home user or simply do not require a complex proxy configuration, you must ensure this setting is disabled.
How to Turn Off the Proxy Setup Script
You can remove the PAC script URL via the Windows Network settings.
- Click the Start button and select the Settings gear icon (or press
Windows Key + I). - In the Settings menu, click on Network & Internet.
- In the left-hand navigation pane, scroll down to the bottom and click on Proxy.
- Look at the top section of the right-hand pane, labelled Automatic proxy setup.
- Locate the toggle switch for Use setup script.
- Toggle the switch to the Off position.
- The “Script address” text box below it will grey out. (If there was an unfamiliar URL in that box, it is a good idea to run a full antivirus scan).
Your Windows 10 machine will now route traffic directly to the internet (or through your router), ignoring any hidden scripts attempting to hijack your proxy settings.