Why is the proxy removed on computers on the subnet?

Question

System administration

For several days now, several users have been losing internet on my network. And after I looked, I saw that the Http proxy was removed, and so for several days in a row. So here's an example:

1. The user found out in the morning that there is no Internet.
   
2. I re-entered the Http proxy for him.
   
3. Internet earned
   
4. The next day, such a problem is repeated with several other users, not just with him, but it will definitely happen to him, if not tomorrow, then the day after tomorrow. Antivirus databases seem to be updated, I screwed the firewall.
   

Can you suggest what is the problem? Just for example, maybe it's a virus, but then I'll have to check all computers ps. Everything is fine with the host file.

Answer 1

I did guess that we are talking about windows as an operating system and internet explorer as a browser, despite the fact that you did not mention this either in the question itself or in the tags.
On windows, the "system-wide" proxy settings that ie usually follows when working (other browsers are not required to look into these settings, each may / may not have their own proxies) are stored in the registry in the branch

HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings

in the corresponding keys with names containing the word Proxy. Since the windows registry supports ACLs , a simple and obvious solution to your problem would be to remove all write permissions to these keys for all users and SYSTEM without exception. This is easily done with regedit . I dug up several screenshots on the net illustrating the process:
.
This shows how to restrict read-only permissions for a certain "RESTRICTED". You just have to do a similar operation for all users/groups without exception (including SYSTEM) that have access to these keys.

Answer 2

Domain politicians do not demolish proxy settings, purely by chance?