Install Cloud Filter on Windows 10 using Intune (Multiple Browsers)

Is this deployment right for me?

You may be able to use a simpler deployment method if your environment meets these criteria:
  • Windows 10 machines
  • Managed with Intune
  • Users log into their PCs with their email address (authenticated by AzureAD)
  • Edge as the only allowed browser
  • Machine users automatically forced signed-in to Edge

In that case, your environment is eligible to our 'Winbook' deployment which only requires our browser extension. Find out more: Install Cloud Filter on Windows 10 using Intune (Edge Only).

 

Summary

In order to protect Windows 10 devices enrolled in Intune, Cloud Filter requires the deployment of a system service along with a browser extension.

A number of steps need to be taken to ensure the Cloud Filter client is deployed and licensed correctly. The short-hand deployment path is:

  1. Software Installation
  2. Provisioning
  3. Browsers Configuration
  4. Post Deployment Checks

Prerequisites

NOTE: The zip package (smoothwall-unified-client-x-windows.zip) contains a intunewin installer and some provisioning tools.

 

Note about Anti-viruses
You need to prevent any antivirus that you have from quarantining the Smoothwall client thinking it is  malware. To do this you need to add some exceptions or exclusions to the antivirus software on the student devices. The exception paths are:
  • C:\Program Files\Smoothwall
  • C:\ProgramData\Smoothwall
In some cases, the antivirus might require to put the full path of each program. In that case, the exceptions are:
  • C:\Program Files\Smoothwall\Unified Client\bin\sw-uc-desktop-client.exe
  • C:\Program Files\Smoothwall\Unified Client\bin\sw-uc-browser-bridge.exe

 

Software Installation

  • In Intune, add the Smoothwall Intune installer (sw-uc-desktop-client-<version>.intunewin)

  • Target the software installation to users and/or machines which require Cloud Filter

Note: this document assumes that Chrome and/or Edge browsers are force installed on all relevant machines.

Provisioning

  • Edit the file named smoothwall-provisioning-intune.ps1 and add your provisioning information.
    Note: leave the tenant variable empty if you are not multi-tenanted. For more details: What's a Tenant ID?
    For example, if your serial number is UNCL123456789 and you want to provision tenant d77b701d-d1ca-4c8d-b4b9-a9b576167d92:
     
    ######################################
    # CONFIGURE CUSTOMER PROVIONING HERE #
    # LEAVE TENANT EMPTY IF NOT RELEVANT #
    ######################################
    $serial = "UNCL123456789"
    $tenant = "d77b701d-d1ca-4c8d-b4b9-a9b576167d92"
    ######################################
  • In Intune, create a new script and upload your edited smoothwall-provisioning-intune.ps1 file
  • Target the script to users and/or machines which require Cloud Filter

Browsers Configuration

Chrome and Edge require some configuration to force install the Smoothwall extension along with locking them down to ensure safe usage.

Edge

In Intune, using an Administrative Template Profile, configure Edge with the following properties and target the Cloud Filter devices:

Settings Name State Value
Control which extensions are installed silently Enabled 
dlcaglefdlidioooijnigjhfcndlncfp;https://edge.microsoft.com/extensionwebstorebase/v1/crx
Control where developer tools can be used Enabled 
Don’t allow using the developer tools
Configure InPrivate mode availability Enabled 
InPrivate mode disabled
Enable guest mode Disabled N/A
Enable profile creation from the Identity flyout menu or the Settings page Disabled N/A
Enable ending processes in the Browser task manager Disabled N/A
Browser sign-in settings* Enabled 
Disable browser sign-in

*We recommend that Browser Sign-ins are completely disabled. However if sign-in is needed (for instance to allow bookmark sync), we recommend restricting it to the managed domain. Restricting it to the customer’s domain prevents conflicting policies from being pushed which potentially compromise the filtering protection. The Intune setting for configuring Browser Sign-in allowed domains is called "Restrict which accounts can be used as Microsoft Edge primary accounts"

Chrome

Instructions to configure Chrome with Intune: https://support.google.com/chrome/a/answer/9102677?hl=en

Once the ADMX template has been imported in Intune, add the following OMA-URI properties:

Feature OMA-URI
Force install the Smoothwall extension.
This configuration might already exists and should be amended in that case.		 
./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome~Extensions/ExtensionInstallForcelist
Type 
String
Value 
<enabled/> 
<data id="ExtensionInstallForcelistDesc" 
value="1&#xF000;jbldkhfglmgeihlcaeliadhipokhocnm;https://clients2.google.com/service/update2/crx"/>

 
Disable Developer Tools 
./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome/DeveloperToolsAvailability
Type 
String
Value 
<enabled/> 
<data id="DeveloperToolsAvailability" value="2"/>

Disable Incognito Mode 
./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome/IncognitoModeAvailability
Type 
String
Value 
<enabled/> 
<data id="IncognitoModeAvailability" value="1"/>
Disable Guest Mode 
./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome/BrowserGuestModeEnabled

Type 
String
Value 
<disabled/>

Disable Browser Profiles 
./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome/BrowserAddPersonEnabled
Type 
String
Value 
<disabled/>

Disable Task Manager Actions 
./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome/TaskManagerEndProcessEnabled
Type 
String
Value 
<disabled/>

Disable Browser Sign-in* 
./Device/Vendor/MSFT/Policy/Config/Chrome~Policy~googlechrome/BrowserSignin
Type 
String
Value 
<enabled/> 
<data id="BrowserSignin" value="0"/>

*We recommend that Browser Sign-ins are completely disabled. However if sign-in is needed (for instance to allow bookmark sync), we recommend restricting it to the managed domain. Restricting it to the customer’s domain prevents conflicting policies from being pushed which potentially compromise the filtering protection. The Chrome setting for configuring Browser Sign-in allowed domains is called "RestrictSigninToPattern".

Post Deployment Checks