[1909, ou] Upgraded to 1909 now showing no internet (but there is) and cert errors

[caffrey]

I've upgraded our PC's to 1909 from 1809 and now I'm getting the old no internet icon even though we have internet - this worked before. It's not filtering as I can ping and I've tried settings under Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NlaSvc\Parameters\Internet

 

Also some PC's can't access the internet with a NET::ERR_CERT_AUTHORITY_INVALID using chrome

 

We use netsweeper and again it worked beforehand

 

Seems to be happening to random PCs too majority are fine - just means I'm going to have to go round and check them all

 

Oh windows 10 - why

Edited October 27, 2020 by caffrey

[RLR]

Have a look through this thread to see if any of the solutions help:

http://www.edugeek.net/forums/windows-10/216550-windows-10-random-no-internet-issue.html

[Guest Guest]

Are you using SSL inspection? That sounds like the certificate used by the filter is not installed

[caffrey]

Certificate is installed, it's weird as I've just flattened the PC and put 1809 back on and it's still not working...

PC next door works fine

[caffrey]

Fixed it,

 

I've no idea why it's working now, but looks like the process order for the Machine GPO's and the update sequence

 

Thought it might be GPO so - by process of elimination I dropped the offending PC into a No Policy Machine OU and gpupdated, - internet starts working

Take said PC out of OU and put it back into the original OU and gpupdated- it's still working

 

What on earth that was I've no idea

 

It's never ever been a problem before - must be some PC's just don't process the GPO's correctly after the MDT Upgrade Task Sequence ?

Edited October 27, 2020 by caffrey

[caffrey]

Finally triaged this,

 

I think it was to do with my recent WSUS issues,

Under Software\Policies\Microsoft\System\Internet Communication Management I enabled Restrict Internet communication not realising that it disables everything under Software\Policies\Microsoft\System\Internet Communication Management\Internet Communication Settings.

 

Under Software\Policies\Microsoft\System\Internet Communication Management\Internet Communication Settings, there where two items disabled that caused things to break I think :-

 

Software\Policies\Microsoft\System\Internet Communication Management\Internet Communication Settings\Turn off Automatic Root Certificate Update

Software\Policies\Microsoft\System\Internet Communication Management\Internet Communication Settings\Turn off Windows Network Connectivity Status Indicator active tests

 

Enabling those seems to have fixed things.