Install Cloud Filter on Windows 10 using Intune (Edge Only)

Summary

This article explains how to deploy Smoothwall Cloud Filter in the following environment:

  • Windows 10 machines
  • Managed with Intune
  • Users log into their PCs with their email address (authenticated by AzureAD)
  • Edge as the only allowed browser
  • Machine users automatically forced signed-in to Edge

NOTE: This deployment is also called 'Winbook", read more about it: What is a WinBook, and why do we like it?

In order to protect Windows 10 devices in this environment, Cloud Filter simply requires the deployment of a browser extension.

A number of steps need to be taken to ensure the Cloud Filter client is deployed and licensed correctly. The short-hand deployment path is:

  1. Provisioning
  2. Edge Configuration
  3. Post Deployment Checks

Prerequisites

NOTE: The zip package (smoothwall-unified-client-x-windows.zip) contains some provisioning tools. For WinBook deployment, only 1 powershell script is required.

Provisioning

NOTE: If you are a multitenant organization, tenant IDs can be found in the on-premise appliance admin UI. Leave the tenant variable empty if you are not a multitenant organization. For more details: What's a Tenant ID?

  • Edit the file named smoothwall-provisioning-winbook.ps1 and add your provisioning information.

    For example, if your serial number is UNCL123456789 and you want to provision tenant   d77b701d-d1ca-4c8d-b4b9-a9b576167d92:
     
    ######################################
    # CONFIGURE CUSTOMER PROVIONING HERE #
    # LEAVE TENANT EMPTY IF NOT RELEVANT #
    ######################################
    $serial = "UNCL123456789"
    $tenant = "d77b701d-d1ca-4c8d-b4b9-a9b576167d92"
    ######################################

  • In Intune, create a new script and upload your edited smoothwall-provisioning-winbook.ps1 file

  • Target the script to users and/or machines which require Cloud Filter

Alternative Method

If executing a PowerShell script is not possible or convenient, the following Registry values should be deployed using the preferred method. Note that all registry values must be created under the following registry path: Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Edge\3rdparty\extensions\dlcaglefdlidioooijnigjhfcndlncfp\policy\Smoothwall\

Type Key Value
REG_SZ ForceOS chromeos
REG_SZ Serial <Your UNCL serial>
REG_SZ TenantId <Tenant ID>
For untenanted organizations, this key can be missing or empty.

 

Edge Configuration

In Intune, using an Administrative Template Profile, configure Edge with the following properties and target the Cloud Filter devices:

Settings Name State Value
Control which extensions are installed silently Enabled 
dlcaglefdlidioooijnigjhfcndlncfp;https://edge.microsoft.com/extensionwebstorebase/v1/crx
Control where developer tools can be used Enabled 
Don’t allow using the developer tools
Configure InPrivate mode availability Enabled 
InPrivate mode disabled
Enable guest mode Disabled N/A
Enable profile creation from the Identity flyout menu or the Settings page Disabled N/A
Enable ending processes in the Browser task manager Disabled N/A
Configure whether a user always has a default profile automatically signed in with their work or school account Enabled N/A

 

Post Deployment Checks