Google Chrome and System Centre Enpoint Protection

[denon101]

I have a weird problem, we have recently started moving over from Sophos AV to SCCM and System Centre Endpoint Protection. The problem is that every once in a while google chrome gets stuck at connecting. Eventually it times out, try refreshing the page and still nothing. However start up internet explorer and it loads up fine. Close internet explorer and then re try chrome and everything works as it should. We have made no other changes other than changing from Sophos to SCEP.

 

I have tried rebuilding the machines in question and created a fresh image and still the problem exists.... Got me a bit stumped actually!

 

Anyone have any ideas?

 

Thanks

 

Anthony

Edited July 7, 2014 by denon101

[FN-GM]

We have used SCEP with Chrome for years without those kind of issues. Is Chrome upto date?

[denon101]

Yes. Currently Running 35.0.1916.153 m

 

I have to say that it does seem to be affecting one type of machine a dell optiplex 760.

[Arthur]

Like @FN-GM, we don't have any issues with Chrome and SCEP.

 

The problem is that every once in a while google chrome gets stuck at connecting. Eventually it times out, try refreshing the page and still nothing.

The next time it happens try visiting chrome://net-internals/#tests, enter a URL which fails to load and it may tell you what's wrong.

 

I have to say that it does seem to be affecting one type of machine a dell optiplex 760.

Do you have the latest NIC drivers installed?

[denon101]

I have downloaded the latest versions from the dell website and installed them just to be sure. So that rules that out. Will try the url suggestion and report back.

 

Thanks

[denon101]

I have tried rolling out SCEP to a different set of machines and they are now having the same problem (DELL Optiplex 755's). So I guess we can rule out anything machine specific. I am thinking it's has to be something to do with the install of SCCM client and SCEP. One thing I have noticed, it does not seem to effect admin users. Just normal users...

 

Got me puzzled, not the end of the world to open IE then Chrome. But you shouldn't have to.

 

Anyone any ideas?

[TG_MI]

I guess I'd look at the SCEP config within SCCM for clues on why Chrome might be effected. Maybe create a new client configuration within SCCM where the SCEP settings are left to absolute defaults, apply it to a test system and see if Chrome behaves. If it does, look more closely at the SCEP related setting previously applied in the SCCM client settings.

[sven]

We have used SCEP with Chrome for years without those kind of issues. Is Chrome upto date?

 

I'm in exactly the same boat. Had no issues running the 2 side-by-side.

[FoxDeploy]

in case anyone else runs into this problem, the issue is caused by Forefront's Network Inspection System.

 

You know how WireShark makes your system miserably slow while caching packets and analyzing them? Think the same thing, constantly running in the background. crappy metaphor but it gets the point across.

 

You can disable this feature within the Configmgr console here.

 

Launch SCCM\Assets\Endpoint Protection\Antimalware Policies. Pick the policy you'd like to change.

 

Next, go to Real-time Protection, and here you have a few options.

 

Enable Behavior Monitoring is a general heuristics engine. If your end user systems are slow when launching files, change this setting.

Monitor file and program activity is a background monitor. if you've got ancient hardware and general slowness, change this setting (but make sure you've got download and USB protection turned on, or else you're effectively disabling SCEP/FEP)

Enable Protection against network based exploits. This setting controls the Network Inspection Service of Forefront. If you're having internet issues especially, turn this off.

 

Hope this helps you guys!

[agibson]

I've seen this before, it isn't SCEP that is causing it to my knowledge, it was the proxy settings which are not applying until after you have loaded IE.

[SwedishChef]

I've seen this before, it isn't SCEP that is causing it to my knowledge, it was the proxy settings which are not applying until after you have loaded IE.

 

Yup we had this when we rolled out a custom build of IE, new user profiles had no proxy settings as the first initial branding overwrote the GPO settings, and as Chrome was set to follow

it had no proxy.

 

This is a handy info tool (same as listed above)

 

chrome://net-internals/#proxy