Win10 LTSC2019 Mandatory Profile issue when browsing - TLS HANDSHAKE

[timbo343]

We have a working mandatory profile however when we try to browse the net we randomly get an error which is:

 

tls handshake with server failed unable to fallback to lower version and we cannot work out where the issue is.

 

This mainly happens on google searches and we have been testing this against the BBC.

 

If we use a roaming profile or a local profile we dont get the error.

 

We are configuring the mandatory profile using the Default Profile on the machines.

 

I was wondering if anyone out there might be having the same issue.

[timbo343]

An update to this:

 

We first thought it was the smoothwall as when we turned off the HTTPS decrypt and inspect everything policy tiings worked as they should until it hung with the TLS handshake issue. At that point i knew it wasn't the Smoothwall. We looked at local profiles on the domain, mandatory profiles, proxy settings, near enough everything until we looked at Group Policy and found 4 settings in group policy that were having a effect on this. We don't why but the settings were to do with UAC on windows:

 

Computer Config > Policies > Windows Settings > Security Settings > Local Policies > Security Options

 

User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode

- Elevate without prompting

 

User Account Control: Detect application installations and prompt for elevation

- Disabled

 

User Account Control: Only elevate UIAccess applications that are installed in secure locations

- Disabled

 

User Account Control: Run all administrators in Admin Approval Mode

- Disabled