Install Cloud Filter on Windows 11 SE using Intune

Summary

This article explains how to deploy Smoothwall Cloud Filter to devices running Windows 11 SE.

Please note that Windows 11 SE is different from standard editions of Windows. It is more restrictive, meaning the deployment process and supported options are different.

Currently, the limitations of the OS mean we can only support the Edge browser on Windows 11 SE. Students should be prevented from opening other browsers, such as Chrome and Firefox.

 

Import the ADMX template

An ADMX template will be used to create registry entries which provision the extension. This is how it will know your customer serial (UNCL).

  1. Download our ADMX template from here: https://software.smoothwall.com/unified-client/smoothwall-cloud-filter-winbook-admx-1.0.zip

  2. Unzip the file. You should find an ADMX file directly inside, then a folder containing an ADML file.

  3. Log into your Microsoft Endpoint Manager admin center (aka Intune).

  4. Go to “Devices → Configuration profiles”.

  5. Near the top, select the “Import ADMX” tab.

  6. Click the “Import” button.

  7. When prompted, select the ADMX and ADML files you download above.

  8. Near the bottom, click the “Next” button.

  9. Click the “Create” button.

  10. It may take a few moments to finish processing. You can click the “Refresh” button to update the status.

 

Provision the extension

In this section, you will create a configuration profile which deploys Cloud Filter provisioning information to the device. This does not actually install the extension. That will be done in the next step.

Note: If you are a multi-tenanted customer, you may need to repeat this (i.e. create a new profile) for each Smoothwall tenant ID.

  1. In the Microsoft Endpoint Manager admin center (aka Intune), go to “Devices → Configuration profiles”.

  2. Near the top, select the “Profiles” tab.

  3. Click the “Create profile” button.

  4. Under “Platform”, select “Windows 10 and later”.

  5. Under “Profile type”, select “Templates”.

  6. On the list which appears, select “Imported Administrative templates” (it may also say “(Preview)” as this is a relatively new Intune feature).

  7. Click “Create”.

  8. On the “Basics” tab:

    1. Enter a suitable name for your profile, e.g. “Smoothwall Cloud Filter extension provisioning”. (If you are a multi-tenanted customer, you may want to enter a tenant-specific name here.)

    2. Optionally enter a description.

    3. Click “Next”.

  9. On the “Configuration settings” tab:

    1. In the left pane, select “Computer Configuration”. (The extension provisioning must happen at a computer level, rather than a user level.)

    2. In the main pane, select “Smoothwall → Winbook deployment (Cloud Filter, Edge only) → Cloud Filter (Winbook deployment)”. A panel should appear on the right.

    3. Select “Enabled”.

    4. In the “Serial” box, enter your Smoothwall customer serial for the Cloud Filter product. It will start “UNCL”, and should not contain any spaces.

    5. If you are a multi-tenanted customer, enter the relevant tenant ID in the “TenantId” box. It will be a UUID/GUID, e.g. “00000000-0000-0000-0000-000000000000”. If you are not a multi-tenanted customer, then you can leave the box blank.

    6. Click “OK” at the bottom of the panel.

    7. Click “Next” at the bottom of the main pane.

  10. On the “Scope tags” tab:

    1. Optionally select any scope tags you want to use. These are not required for Cloud Filter to function.

    2. Click “Next”.

  11. On the “Assignments” tab, include any groups or devices you want to deploy the Cloud Filter extension to. You can always change this later.

    1. Click “Next”.

  12. On the “Review + create” tab, click “Create”.

 

Configure the browser

This section will guide you through creating or updating a configuration profile which installs the extension, and applies various other important restrictions to prevent it from being circumvented. If you are a multi-tenanted customer, then you will usually only need to do this once for all tenants. You can optionally also add these settings to an existing Edge profile if you already have one, instead of creating a new profile.

  1. In the Microsoft Endpoint Manager admin center (aka Intune), go to “Devices → Configuration profiles”.

  2. Near the top, select the “Profiles” tab.

  3. Click the “Create profile” button.

  4. Under “Platform”, select “Windows 10 and later”.

  5. Under “Profile type”, select “Templates”.

  6. On the list which appears, select “Administrative templates” and click “Create”.

  7. On the “Basics” tab:

    1. Enter a suitable name for your profile, e.g. “Smoothwall Cloud Filter Edge configuration”.

    2. Optionally enter a description.

    3. Click “Next”.

  8. On the “Configuration settings” tab:

    1. In the left pane, select “Computer Configuration”. (The browser configuration must happen at a computer level, rather than a user level.)

    2. In the main pane, select “Microsoft Edge”.

    3. Refer to the “Edge Configuration” section of this document for a list of the settings you need to apply: Install Cloud Filter on Windows 10 & 11 using Intune (Edge Only)
      Note: It is important to apply all of the settings to ensure students cannot disable the filter.

    4. Click “Next”.

  9. On the “Scope tags” tab:

    1. Optionally select any scope tags you want to use. These are not required for Cloud Filter to function.

    2. Click “Next”.

  10. On the “Assignments” tab, include any groups or devices you want to deploy the Cloud Filter extension to. You can always change this later.
    Note: Ensure devices are assigned both configuration profiles (i.e. this profile for Edge, and the provisioning information profile created above).

    1. Click “Next”.

  11. On the “Review + create” tab, click “Create”.

 

Conclusion

Next time the assigned Windows 11 SE devices sync, they should receive the configuration profiles above. Edge should automatically download and install the Cloud Filter extension, and configure it with your provisioning information.

If you are testing the deployment, then you may want to manually sync the device to ensure the profiles are applied right away. To ensure Edge applies its new policies right away, you can navigate to “edge://policy” in the browser, and click “Reload policies”. You should be able to see the Smoothwall extension listed in the browser extensions page (edge://extensions).