Users access internet via CLoud SWG using WSS Agent.
Certain users try to download files on URL below from Chrome running in the system and not user context. This psexec command was used to launch chrome in system context:
.\psexec.exe -s -i "C:\Program Files\Google\Chrome\Application\chrome.exe"
Running Chrome in standard user mode downloads the file successfully.
The download does appear to start but stops immediately with the network error shown below:
Issues with older versions of Chrome running in the system context.
Upgrade to newer version of Chrome, or try another browser.
The HAR file showed that the response to the download request is valid (200 OK with a 136MB file), which explains why the download started.
HTTP/1.1 200 OK
Server: Windows-Azure-Blob/1.0 Microsoft-HTTPAPI/2.0
Last-Modified: Tue, 22 Aug 2023 07:03:19 GMT
Date: Tue, 22 Aug 2023 14:11:29 GMT
The corresponding PCAP from Symdiag however shows that the client sends a TCP FIN very soon after the download starts.
We then tested with another browser (Edge) running in the system context and this worked fine.
Looking at the Chrome versions in more detail, it was running a very old (99) version. After upgrading to the 116 version, the problem went away.