Web browsers changing URLs in one room only

[Jaan]

This has me stumped.

 

We have an IT suite that when you enter a URL into the address bar and hit enter, we get a this page doesn't exist, or a block page by our web filters saying its block as "none category"

 

The example i'll use is Google.

 

This is allowed to all on our site, so it was odd that our filters said none category. Upon further inspection, the logs show the query is actually "www.Google.comhttp//google.com" this is the same for any URL query on these machines. its always "www.Domain.comhttp//domain.com"

 

I can ping domains via cmd fine, all ip address/gw/dns ips are correct. I've tried different browsers.....

 

any ideas? only one room affected, checked GPOs and classroom management software (impero).... totally odd.

 

EDIT: SOPHOS XG, Web Filter, via proxy with https decode.

 

totally stumped

Edited May 10, 2024 by Jaan

[robintech]

only guessing but reminds me of AV or filtering trying to display a block message but not being able to, going to the http://www.example.com would sometimes load and show "this page is blocked" etc

Edit: as if it was trying to rewrite the URL

Edited May 10, 2024 by ittech2342323

[Wave9_Lee]

Wired or wireless?

 

Have you taken a machine in that's working normally elsewhere (and vise versa)

[mavhc]

If it affects one room, and you're sure it's not software, I'm thinking the switch that only that room uses has a different config

[Jaan]

only guessing but reminds me of AV or filtering trying to display a block message but not being able to, going to the Example Domain would sometimes load and show "this page is blocked" etc

Edit: as if it was trying to rewrite the URL

 

I created a custom rule for a specific domain so it would bypassy all our filters. Just get a this website can not be found as the URL seems to be rewritten.

 

Wired or wireless?

 

Have you taken a machine in that's working normally elsewhere (and vise versa)

 

Wired, Yep dumped our test machine into the same OU as the affected room. Its fine, no issues.

 

If it affects one room, and you're sure it's not software, I'm thinking the switch that only that room uses has a different config

 

This room shares the switch with the it suite next door which are un affected...... i'm also thinking software, Impero has no policies enforce on this machines.

 

Something else i just discovered;

 

If a user already has a local profile on the machine, they are unaffected, if the they onto a machine they haven't logged into before.... they get the errors!

 

We use local profiles with redirection.

[Jaan]

another update:

 

From a student log in, they have to sign into Google before they can use the Browser.... Our SSL certs are all in place and valid.

 

Deleting the certs and re-adding has no affect.

 

IDK feeling cute, might do a quick ssl inspection toggle....Delete a local profile as a test and go to the shop for an Monster energy drink...

 

[Jaan]

Logging on as an Admin i also get the errors.

 

Disabling SSL has no affect also

 

here's another screenshot

 

[bobsmith]

take a PC from another room and plug it into a port in the affected room.

 

Now what happens?

[Jaan]

Update on this.

 

I re-imaged a pc and it worked fine, we deployed our post re-image software package to it and the issue presented itself again.

 

Rolled back the software one by one and determined the problematic software is Contentkeeper.

 

If i remove it from the computers they work fine.........

 

The real confusing thing is, theoretically this should be affecting our whole site...... but it isn't. it just one room!

 

I have booked a support ticket with Contentkeeper this morning.

 

i'll keep you posted.

[Jaan]

Update on this....

 

it was that we had a proxy defined for student computers (but so does the whole site) removing the proxy restored functionally.

 

Moving away from proxy and going to DPI instead (sophos XG)