none
PCs switching between http and https constantly RRS feed

  • Question

  • OK, I have an odd one here and I hope I can describe it properly.  We have our staff and pupils separated with a one way trust and each has its own web filter.  It's the same product but a different installation of it.  Since Google forced secure search by default we discovered that pupils were getting unfiltered access to Google searches.  The filter kicks in so they don't get access to the sites but they get the results because the filter can't interrogate a secure site to filter the searches.  I'm sure you appreciate the repercussions when it comes to image searches!

    Our proxy (Smoothwall) allows a content modification that forces safe search to force the usual filter level measures and in the staff it works perfectly; staff cannot get to secure searches and the higher security levels are applied.  The problem for the pupils is that this measure works...for everything except Google.  The pupil PCs refuse to use the unsecured site for searching so we've had to block most of Google to protect the pupils.  What happens is when we try to enforce it, it looks like the page constantly refreshes but what's really happening is it's switching between http and https; the proxy switches the secure site on and the browser wants to return to secure, so Google is unusable. 

    We thought it was down to Google but we've checked and the staff PCs definitely work the way we want them to.  We tried using a different search engine for the pupils and it works.  We then tried using Firefox portable and that works too!  So we've got it narrowed down to something in the Internet Explorer settings.  We only support IE though (currently they are all on version 8 but we tried updating one to 10 with the same result) so we can't just do a blanket install of a different browser. We've ruled out the filter too because we can put a staff PC through it and Google searches unsecured. We think it must be something in the Group Policy because they don't apply to other browsers and when we tried a fresh PC image with no policies Google behaves.  It has to be something in policy but we have no idea what.  We're trying to add the policies one at a time but that will take a while so I'm hoping someone may be able to point me in the right direction.

    Has anyone comes across anything like this before or offer any suggestions that could be causing it?  I can find lots of complaints about Google's default setting and other establishments that have had to block Google but nothing pointing to this particular "flashing" issue.

    Any suggestions would be appreciated.

    Monday, January 27, 2014 9:54 AM

Answers

  • Hi,

    We took google out of trusted sites and that alone seems to have done the trick.  That way the setting to disallow navigation away from trusted sites won't take effect and stop the proxy from applying the content modification to disallow secure searching.  We did globally that yesterday and no yelling yet so all appears to be well.  We've also had to block encrypted.google.com to stop the pupils getting in that way.

    Thanks again for the replies.

    C

    Friday, January 31, 2014 8:47 AM

All replies

  • suggestions that could be causing it?

    With IE10 you could at least use its Developer Tools, Network Capture tool to compare what the two cases are being given.  Another option in IE10 which might be relevant would be Tracking Protection.  Unfortunately, neither options would be available for your IE8 installations but at least these diagnostics could help give you a better understanding of the two cases at a deeper level.  The only related diagnostic available for an IE8 instance would be Fiddler2 but you would have to be prepared for possible certificate issues with it because of its proxy status in the middle of a secured connection.



    Robert Aldwinckle
    ---

    Monday, January 27, 2014 4:10 PM
    Answerer
  • Hi,

    Thanks for the advice.  We've tried using Wireshark but that didn't show much so these tools may not either but I'll try anything!  We're trying the group policy route as well and it looks like a fresh image didn't have the problem so it could even be something the pupils have done over the years or something that was installed in the past.  We may be getting closer to an answer now; I'll let you know.

    Ta

    Charlene

    Tuesday, January 28, 2014 11:07 AM
  • Hi CharlenePKC1,
     
    Thanks for posting in Microsoft TechNet forums.

    I will try to involve someone familiar with this topic to further look at this issue. There might be some time delay. Appreciate your patience.

    Thank you for your understanding and support.

    Regards,

    Blair Deng


    Blair Deng
    TechNet Community Support

    Wednesday, January 29, 2014 1:08 AM
    Moderator
  • Hi Blair,

    Thanks for that, much appreciated.  We think we may have found the cause in Group Policy; the pupils had Google as a trusted site for some reason.  There's another setting that that says "Allow navigation away from trusted sites" or something similar and that was disabled so it looks like those settings were clashing with the proxy's attempts to force secure search, even though it was still Google, because technically it's a redirection.  It needs some more testing to confirm but all being well, that's the answer. 

    Thanks again

    Charlene

    Wednesday, January 29, 2014 11:18 AM
  • Hi Charlene,

    How are things going on? How about if we disable Group Policy?

    More information here:

    How to use security zones in Internet Explorer
    http://support.microsoft.com/kb/174360

    How to Use Wild Cards When You Add Web Sites to Security Zones
    http://support.microsoft.com/kb/184456

    How to Add Trust Sites into IE before IE10 through Group Policy
    http://blogs.msdn.com/b/asiatech/archive/2013/01/04/how-to-add-trust-sites-into-ie-before-ie10-through-group-policy.aspx

    Hope it helps.


    Please remember to click “Mark as Answer” on the post that helps you, and to click “Unmark as Answer” if a marked post does not actually answer your question. This can be beneficial to other community members reading the thread. 

    Friday, January 31, 2014 3:11 AM
  • Hi,

    We took google out of trusted sites and that alone seems to have done the trick.  That way the setting to disallow navigation away from trusted sites won't take effect and stop the proxy from applying the content modification to disallow secure searching.  We did globally that yesterday and no yelling yet so all appears to be well.  We've also had to block encrypted.google.com to stop the pupils getting in that way.

    Thanks again for the replies.

    C

    Friday, January 31, 2014 8:47 AM