Has anyone got Smoothwall Cloud working on a Windows device, running Google Credential provider?

[TwistedHelixis]

Hi all, Just wondering if anyone has ever used Smoothwall Cloud on a Windows device, that is using Google Credential provider?

 

I don't have any access to the Smoothwall systems we go though, so have no way to test, but have been informed that it doesn't work.

 

I am not sure how much testing went on, perhaps it doesn't work, but would love to have a second opinion if possible, just to stop my OCD going into overdrive over sometime I cant actual test.

[Primus]

Yeah we do.

[TwistedHelixis]

5 minutes ago, Primus said:

Yeah we do.

Brilliant news, thanks for posting back.

[TwistedHelixis]

12 minutes ago, Primus said:

Yeah we do.

Out of interest, are you a school? The more info I can pass back to the local authority, the better 👍

[Primus]

22 minutes ago, TwistedHelixis said:

Out of interest, are you a school? The more info I can pass back to the local authority, the better 👍

Yes a MAT

[TwistedHelixis]

Would be very handy if another school has manged to get his working, as the MAT above are also using MS AD Domain, which is a very different setup to our non-AD setup.

[Joeloman]

In order to help you as best as possible, you need to describe your setup in a little more detail.

 

How does the login look like for both the computer and your Google domain?
If you are not using MS-AD, do you mean you are using Entra ID (Azure AD)

How do you manage your PCs?
What permissions does the student have on the computer?

[TwistedHelixis]

Quote

In order to help you as best as possible, you need to describe your setup in a little more detail.

 

How does the login look like for both the computer and your Google domain?
If you are not using MS-AD, do you mean you are using Entra ID (Azure AD)

How do you manage your PCs?
What permissions does the student have on the computer?

 

Hi, Based on your questions I am going to guess you have not used GCPW, perhaps you have, but will explain how that works first, just in case.

 

GCPW is (can be) a complete replacement to Active directory or Entra ID, it can also run along side either. After installing the GCPW on the client, when you next reboot the Windows device, you will now have the option of logging into Windows using a Google Account. Behind the scenes, in the Google admin GUI, you can control lots of the same settings like similar to Group Policy or InTune, but everything (logins & settings) are now controlled from Google and not Microsoft.

We are in the final final testing stages of using GCPW (Google credential provider). I have had a couple of teachers testing it for the past month in the classroom and it has worked very well. All the previous settings we had deployed from our DC are now being deployed from Google, our final issue is getting GCPW devices to work with Smoothwall Cloud, rather than the local  Smoothwall system, which does work with GCPW, but I really wanted our filtering to be cloud based.

 

Anyway, to answer your questions....

How does the login look like for both the computer and your Google domain?

The user logs in to the device using their [email protected] Google creds

If you are not using MS-AD, do you mean you are using Entra ID (Azure AD)

No, We are not going to be using either, GCPW can be a complete replacement.

 

How do you manage your PCs?

The PCs are going to be managed from GCPW

What permissions does the student have on the computer?

Staff and students are standard users, and will have very similar permissions to the Windows domain system they currently use.

[paulkerton]

2 minutes ago, TwistedHelixis said:

How does the login look like for both the computer and your Google domain?

The user logs in to the device using their [email protected] Google creds

Yes, but on device, that takes a slightly different shape. By default it will create a local user on the device, that's 20 letters long at most (Windows limit)
So if you have [email protected] and [email protected] for example, it will create a user based on the format username_domain

Unless you specify in the registry settings to only user the shorter account name, those two users would end up having local users created called:
bob_schoolname_sch_u and kevin_schoolname_sch

If you set:
Path: HKEY_LOCAL_MACHINE\Software\Google\GCPW
Value Name: use_shorter_account_name
Type Type: DWORD
Value : 1

It would then create the local users on the Windows device called:
bob and kevin

We had to find a way with our filtering provider (not Smoothwall in this instance) for their software to pick up the email address from the GCPW login, rather than trying to use the local user name. I believe they found a way via GCPW's registry entries upon login. Don't ask me how, though!

[Joeloman]

We have helped many schools with different setups..

The most common thing in Sweden when it comes to GCPW is that you only use GCPW for auth. and then also sync with Entra ID and that you then use Intune for the actual management of the devices..

 

It's been a while since we saw an installation with GCPW including device management.
There were initially quite large limitations in the lockdown with GCPW but that may have changed.. At the time it was not suitable for a school environment and web filters.

 

With that said, before you choose to test Cloud Filter, you should make sure that it is possible to lock down the client as Microsoft and Smoothwall describe that you should do in a school environment.

That's right, local accounts are created in your PC and these are what Smoothwall will read.

To verify that it works, you could contact support because there is a new upcoming product Smoothwall Endpoint Manager that reads your devices and shows logged in users.
They may be able to turn it on for you, so you can see it works before you move on.

[TwistedHelixis]

Quote

There were initially quite large limitations in the lockdown with GCPW but that may have changed.

 

I cant comment on what it was like previously, but I can deploy the same policies that InTune uses. Perhaps that wasn't the case before?

 

 

Quote

you should make sure that it is possible to lock down the client as Microsoft and Smoothwall describe that you should do in a school environment

As far as I can tell, GCPW clients are locked down as much as an inTune client is. I have deployed similar security policies to the ones on our current DC (locking down app installs, Bitlocker, removing settings access from pupils), the list goes on, and now I also have 2 step authentication during Windows logon. Before I even started down this path, I looked into the security aspects and also found a good number of schools that are already fully GCPW setup, its just none of them seem to be using Smoothall Cloud, hence this post.

 

 

Thanks for the input, but I really don't want this going off topic too much. 👍

[TwistedHelixis]

Quote

you could contact support because there is a new upcoming product Smoothwall Endpoint Manager

Will do, thanks 🙂

[ThatBoringBloke]

Sorry to resurrect an old topic but I'm curious if you ever got this to work? 

[TwistedHelixis]

They did have a quick look, but said they would look into getting it working, if they had a few more support / feature requests. Apparently I was one of the first to report this, although I now know a few other schools have also requested this.

 

Contact Smoothwall please 🙂

[tom_newton]

And feel free to put your support ticket here and I'll see if I can help coordinate responses 

[tom_newton]

I'm at the ietf in Montreal this week tho, so I will be a bit slow 

[TwistedHelixis]

@tom_newton

 

Sorry for the delay, I started following a different post, thinking it was about Smoothwall Cloud, but it wasn't.

 

Just wondering if Smoothwall are looking into Smoothwall Cloud working with GCPW windows devices?

 

Is this something that might happen at some point?

 

 

On 04/11/2025 at 11:35, tom_newton said:

And feel free to put your support ticket here and I'll see if I can help coordinate responses 

it was our local authority that contacted support on behalf of all the schools in our county, so I don't have this, sorry.

[TwistedHelixis]

@tom_newton

 

Did this ever get looked into?

[tom_newton]

Its with the dev team in build - let me chase.

[tom_newton]

Looks like we are looking for a customer to help prove this out - drop me an email [email protected] and I will put you in touch with the team. They want to verify the changes work in the real world

 

[TwistedHelixis]

2 hours ago, tom_newton said:

Looks like we are looking for a customer to help prove this out - drop me an email [email protected] and I will put you in touch with the team. They want to verify the changes work in the real world

 

I would be more than happy to help, but our connection and filtering is maintained by the Local authority, so would need their agreement and involvement.

Ill contact them and see what they say.

[tom_newton]

Feel free to cc me if that would help