Windows 10 Intune Sync, Senso and Smoothwall

[_techie_]

Hi.

 

I have just moved schools to a new job, and have inherited Smoothwall, Windows 10 Intune devices and Senso.

The Intune devices are running the Smoothwall cloud filter and are successfully performing the Secret Knock (I can see this from the Smoothwall Diagnostics for the browser extension).

 

We seem to have some odd issues where Senso is blocking Intune devices from syncing correctly, once the devices have been renamed, and get auto-assigned to a group.

I am thinking that this is some kind of policy in place here, but having gone through there support twice now, I can still see the same issue. They have advised that we add a number of exceptions into the mix, and on the second time, added another.

These exceptions are added to a web filter policy in Senso. Tbh, I would rather turn off the Senso web filtering completely, as it just seems to be causing issues, but what problems could this give me? We also have sufficient filtering in place with Smoothwall, both on-premise and in the cloud.

 

Diagnosis as follows:

Syncing is fine, until devices are renamed, and get auto-assigned in Senso, then we get a dreaded sync could not be initiated error (the error always ends in 194, so I know its Senso).

Stopping the Senso service, performing a O365 sync (under Settings, Accounts, Access Work or School) then successfully completes.

Subsequent syncs then work fine, even when the Senso service is running however. You can see there are issues occurring, as some apps are not reporting as being installed in O365, even when they are installed correctly.

 

A few days later, the issue seems to return on devices we have had successful Device syncing on, then return the same error.

Anyone experiencing the same issue? We are on version 2021.11.15.0 of the Senso client.

 

Thanks

[slugshead]

Not heard of senso.

 

Smoothwalls filtering is pretty good, been using it for years now and not had issues. Had to disable web filtering in Sophos as that caused some confusion as they're two separate lists of sites that get blocked.

[jslate1980]

Hi.

 

I have just moved schools to a new job, and have inherited Smoothwall, Windows 10 Intune devices and Senso.

The Intune devices are running the Smoothwall cloud filter and are successfully performing the Secret Knock (I can see this from the Smoothwall Diagnostics for the browser extension).

 

We seem to have some odd issues where Senso is blocking Intune devices from syncing correctly, once the devices have been renamed, and get auto-assigned to a group.

I am thinking that this is some kind of policy in place here, but having gone through there support twice now, I can still see the same issue. They have advised that we add a number of exceptions into the mix, and on the second time, added another.

These exceptions are added to a web filter policy in Senso. Tbh, I would rather turn off the Senso web filtering completely, as it just seems to be causing issues, but what problems could this give me? We also have sufficient filtering in place with Smoothwall, both on-premise and in the cloud.

 

Diagnosis as follows:

Syncing is fine, until devices are renamed, and get auto-assigned in Senso, then we get a dreaded sync could not be initiated error (the error always ends in 194, so I know its Senso).

Stopping the Senso service, performing a O365 sync (under Settings, Accounts, Access Work or School) then successfully completes.

Subsequent syncs then work fine, even when the Senso service is running however. You can see there are issues occurring, as some apps are not reporting as being installed in O365, even when they are installed correctly.

 

A few days later, the issue seems to return on devices we have had successful Device syncing on, then return the same error.

Anyone experiencing the same issue? We are on version 2021.11.15.0 of the Senso client.

 

Thanks

We have had the same issue. Not had the time to work out what's causing it.

[mrbios]

The only thing i could think Senso would be doing to effect it would come from the logging and blocking policy. Try disabling that policy, or setting it to log only. It does to MITM on the client otherwise which might be causing an issue.

[_techie_]

Thanks mrbios, that's exactly what was happening.

 

We did as the instant chat recommended, adding in a large number of O365 URLS into the whitelisting policy and SSL inspection policy.

What made the difference was that the issues still continued to happen, until we added in the internal network IP range, and the OMADMCLIENT.exe as URL/IP and Application exceptions respectively.

Since then, fresh image builds have worked much quicker, logons happen faster and there are far less glitches. Apps also install more reliably from the Microsoft store too, as well as things like Papercut client and print mapping.

I think some of the issues were related to the Delivery Optimisation feature in Windows 10, since Senso 3rd line support identified internal client IP's using the DO firewall port. This then meant we added in the internal IP range to the IP whitelist.

 

Any stuck PC's that I really don't want to re-image, we are simply stopping the senso cloud service, performing a sync, then starting again, then rebooting. Whilst its waiting the updated Senso settings come down.

Much happier now I must say with Intune, its not perfect, but far less troublesome!

 

Cheers

Mark

[gumbygaz]

Thanks for that @_techie_ been scratching our heads at why our intune has been failing, and yep Senso was the cause... Didn't even think that would affect it, but stopped the senso service and everything syncing normally. Cheers