Push the CleanBrowsing Windows app to any number of managed devices silently — no user interaction required. Pre-configure the DNS filter, PIN lock, browser hardening, and more from your Intune deployment policy.
The CleanBrowsing Windows installer is built with Inno Setup and supports fully silent deployment via command-line parameters. When you push the installer through Intune (or any RMM tool), you pass parameters alongside the standard /VERYSILENT flag.
During the install itself, the app applies your configuration (the correct DNS filter, PIN lock, browser hardening, and any management restrictions), activates DNS filtering, and then verifies that filtering is actually running. This runs in the system (SYSTEM) context that Intune installs under, with no user logged in and no interaction required. Only once filtering is confirmed active does the installer report success to Intune; if any step fails, it returns a non-zero exit code so the device shows as failed rather than falsely compliant.
The provisioning details (including the PIN, if you set one) are written to a temporary file that is locked to SYSTEM and Administrators, then securely deleted once filtering is verified. If provisioning fails, that file is retained (still access-restricted) so a later Intune retry can re-apply it.
/account= parameter is required). Microsoft Intune or any MDM/RMM that supports Win32 app deployment.
All parameters are passed after the standard Inno Setup silent flags. /account= is required; the rest are optional, so include only the lockdown options you want. Omitting an optional parameter leaves that setting at its default (unchanged). If /account= is missing or invalid, the install fails and applies nothing rather than leaving an unfiltered client on the device.
| Flag | Description |
|---|---|
/VERYSILENT | Suppresses all installer dialogs and progress windows. Required for unattended deployment. |
/SUPPRESSMSGBOXES | Suppresses any message boxes that would otherwise require user interaction. |
/NORESTART | Prevents the installer from rebooting the machine after install. |
| Parameter | Values | Description |
|---|---|---|
/account= required |
Your profile code | Required. Activates the custom DNS filter for your CleanBrowsing account. The installer retrieves the correct DNS stamp for the device using this profile code. If it is missing or invalid, the install fails and nothing is applied. |
/pin= |
Numeric PIN | Sets the PIN code that end users must enter to change settings. Use this to prevent users from disabling filtering or modifying the filter level. |
/protect=1 |
0 or 1 | Enables uninstall protection. Removes the app from Programs & Features so users cannot uninstall it through standard Windows interfaces. |
/blocknet=1 |
0 or 1 | Hides network settings pages (Network & Sharing Center, Internet Options, Windows 11 network settings) so users cannot change DNS manually. |
/harden=1 |
0 or 1 | Browser hardening for Chrome, Edge, Brave, and Firefox: forces browsers to use system DNS instead of built-in DoH, which would otherwise bypass CleanBrowsing. As of v1.7.14 this is applied automatically whenever the filter activates (an un-hardened browser can bypass DNS filtering), so this flag is retained mainly for compatibility. |
/noupdate=1 |
0 or 1 | Suppresses the in-app update checker. Use this when you manage updates through Intune so users are not prompted to install new versions independently. |
/corpnet=1 |
0 or 1 | Enables corporate network detection. When the device is on the corporate network (detected via /corpnetmethod), CleanBrowsing DNS is paused and the network's own DNS takes over. Filtering resumes automatically when the device leaves. Requires v1.7.8+. |
/corpnetmethod= |
dns_suffixsubnetgateway |
Detection method. Defaults to dns_suffix (recommended for Active Directory environments).dns_suffix — matches the DHCP connection-specific DNS suffix (e.g. corp.contoso.com). Find it with ipconfig /all → "Connection-specific DNS Suffix".subnet — checks if the device IP is within a CIDR range (e.g. 10.10.0.0/22). Find your range with ipconfig → "IPv4 Address".gateway — matches the default gateway IP (e.g. 10.10.0.1). Find it with ipconfig → "Default Gateway".
|
/corpnetval= |
Suffix, CIDR, or IP | The value to match against the chosen detection method. Examples: corp.contoso.com for dns_suffix, 10.10.0.0/22 for subnet, 10.10.0.1 for gateway. |
/reset=1 |
0 or 1 | Emergency undo. Reverses all provisioning flags (restores uninstall access, re-enables network settings, clears browser policy). Cannot be used together with provisioning parameters — see Emergency Reset below. |
The CleanBrowsing installer is a standard .exe file. Intune deploys it as a Win32 app using the Intune Win32 Content Prep Tool to wrap it into a .intunewin package.
IntuneWinAppUtil.exe).IntuneWinAppUtil.exe -c C:\deploy\ -s CleanBrowsingClient_1.7.14_x64.exe -o C:\deploy\output\CleanBrowsingClient_1.7.14_x64.intunewin in your output folder..intunewin file you created in Step 1.Enter your install command with the parameters you need. Example for a full MSP deployment:
CleanBrowsingClient_1.7.14_x64.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /account=YOUR_PROFILE_CODE /pin=1234 /protect=1 /blocknet=1 /harden=1 /noupdate=1Replace YOUR_PROFILE_CODE with your CleanBrowsing profile code (found in your account dashboard) and 1234 with your chosen PIN.
The installer returns exit code 0 only when filtering is applied and verified active. Any other outcome (a missing or invalid account, a filter-service failure, or a verification failure) returns a distinct non-zero exit code and writes no success marker, so Intune reports the device as failed instead of falsely compliant. The reason is recorded in the provisioning log under %ProgramFiles%\CleanBrowsingClient\logs.
If you did not use /protect=1, Intune can uninstall using the standard Inno Setup uninstall string. Use the Emergency Reset procedure instead for protected deployments.
CleanBrowsingClient_1.7.14_x64.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /reset=1Use a registry detection rule keyed on the marker the installer writes only after DNS filtering is verified active. This way Intune reports a device compliant only when filtering is genuinely running, not merely when the files are present:
HKEY_LOCAL_MACHINE\SOFTWARE\CleanBrowsing\ProvisionedProtected1
The installer writes Protected = 1 only on a verified-active provision, so this marker doubles as your "filtering is really on" signal. A simple File rule on %ProgramFiles%\CleanBrowsingClient\CleanBrowsingClient.exe (file exists) also works, but it reports a device as installed even if provisioning did not complete, so the registry rule is recommended.
Assign the app to your target device groups under Assignments. Set the assignment type to Required to force installation without user interaction.
Because provisioning is verified, a device that does not come up filtered reports a specific exit code and writes a log you can send us. You do not have to guess where it stopped.
0 is the only success. Any non-zero code means no filtering was activated and no detection marker was written, so the device shows as failed in Intune. The code tells you (and us) exactly where it stopped.
| Code | Meaning | What to check |
|---|---|---|
0 | Success. Filtering applied and verified active. | Nothing. |
10 | No account. /account= was missing. | Add a valid /account= to the install command. |
11 | Could not reach the CleanBrowsing API to fetch the filter. | Device internet, firewall, or proxy at install time. Allow HTTPS to my.cleanbrowsing.org. |
12 | The profile code returned no usable filter. | Confirm the /account= profile code is correct and active. |
13 | Local filter configuration could not be written. | Disk or permissions on the install directory. Send us the log. |
14 | The dnscrypt-proxy filtering service did not start. | Another DNS or security tool holding port 53, or a blocked service install. Send us the log. |
15 | Interface DNS could not be pointed at the local resolver. | A conflicting network-management agent. Send us the log. |
16 | Applied, but filtering could not be verified active (for example, no network at install time). | Retry once the device is online. Provisioning is retained for the retry. |
17 | The provisioning data was missing or unreadable. | Re-check the install command parameters. |
19 | Filtering is active, but one lockdown option (for example /protect) failed to apply. | The device IS filtered. Send us the log so we can see which setting failed. |
20 | Unexpected error. | Send us the log. |
Every install writes a step-by-step log on the device (retained 14 days). If a device fails, grab this file and send it to support and we can pinpoint exactly where it stopped:
%ProgramFiles%\CleanBrowsingClient\logs\provision_*.logPull it manually from the device, or collect it fleet-wide with an Intune device-diagnostics collection or a proactive-remediation script. The Intune app install status also records the exit code per device, so you can spot the failing code without touching the machine.
Sets the custom DNS filter for your account. No lockdown, no PIN. Suitable for trusted staff devices where you want filtering without restrictions.
CleanBrowsingClient_1.7.14_x64.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /account=YOUR_PROFILE_CODEActivates filtering and sets a PIN so users cannot change settings. No uninstall protection — users can still remove the app if they want.
CleanBrowsingClient_1.7.14_x64.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /account=YOUR_PROFILE_CODE /pin=5678Maximum enforcement. Activates filtering, locks settings with a PIN, prevents uninstall, blocks DNS bypass via browser or network settings, and disables independent updates.
CleanBrowsingClient_1.7.14_x64.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /account=YOUR_PROFILE_CODE /pin=5678 /protect=1 /blocknet=1 /harden=1 /noupdate=1Designed for school environments where students should have no ability to disable filtering. Combine with the Family filter (set via account) for full CIPA coverage.
CleanBrowsingClient_1.7.14_x64.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /account=YOUR_PROFILE_CODE /pin=ADMIN_PIN /protect=1 /blocknet=1 /harden=1 /noupdate=1For managed laptops that travel between the office and remote locations. CleanBrowsing filters when the device is off the corporate network (home, hotel, public Wi-Fi) and pauses automatically when it detects the office. Replace corp.contoso.com with your actual connection-specific DNS suffix (find it with ipconfig /all). Requires v1.7.8+.
CleanBrowsingClient_1.7.14_x64.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /account=YOUR_PROFILE_CODE /pin=5678 /protect=1 /harden=1 /noupdate=1 /corpnet=1 /corpnetmethod=dns_suffix /corpnetval=corp.contoso.comCorporate network detection lets the CleanBrowsing app pause DNS filtering automatically when a managed device connects to your internal network — so your corporate DNS (Active Directory, internal resolvers) takes over — and resume filtering as soon as the device leaves (roaming, home, public Wi-Fi). No user action required.
Detection runs on a 5-second timer alongside the existing network monitor. It reads network adapter metadata — DNS suffix, IP address, or default gateway — directly from the Windows network stack. No DNS queries are made during detection, so there is no conflict with dnscrypt-proxy and no dependency on filtering being active.
When the device enters the corporate network, CleanBrowsing pauses DNS filtering and shows a notification. When it leaves, filtering resumes automatically.
Choose the method that best fits your network environment:
| Method | How to Find the Value | Best For |
|---|---|---|
dns_suffix(recommended) |
Run ipconfig /all on a domain-joined machine. Look for Connection-specific DNS Suffix under your active adapter (e.g. corp.contoso.com). |
Active Directory environments. The DHCP-assigned DNS suffix is unique to your domain and changes when the device leaves the network. |
subnet |
Run ipconfig. Note the IPv4 Address of your corporate adapters. Express the range as CIDR notation (e.g. 10.10.0.0/22 covers 10.10.0.1–10.10.3.254). |
Networks with a fixed IP range that does not appear on home or public networks. Avoid overly broad ranges like 192.168.0.0/16. |
gateway |
Run ipconfig. Look for Default Gateway under your active adapter (e.g. 10.10.0.1). |
Networks with a fixed, unique gateway IP that does not match home routers (avoid common defaults like 192.168.1.1). |
Run these commands on a domain-joined device while connected to your corporate network:
# DNS suffix (recommended)
ipconfig /all
# → Look for "Connection-specific DNS Suffix" under the active adapter
# Subnet (CIDR range)
ipconfig
# → Look for "IPv4 Address", determine your network range and prefix length
# Gateway
ipconfig
# → Look for "Default Gateway" under the active adapter
For most AD environments, dns_suffix is the right choice. When a device is joined to the domain and connected to the corporate network (physically or via VPN), DHCP assigns the domain's DNS suffix to the active adapter. When the device disconnects or moves to a public network, the suffix is removed — detection automatically clears and CleanBrowsing resumes.
If your devices use split-tunnel VPN, the DNS suffix will still be assigned on the VPN adapter when connected remotely — corp network detection will also trigger during VPN sessions. This is the expected behavior: when on VPN, your corporate DNS should be resolving, not CleanBrowsing. If you want filtering to apply on VPN but pause only for on-site connections, use subnet or gateway instead.
CleanBrowsingClient_1.7.14_x64.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART ^
/account=YOUR_PROFILE_CODE /pin=5678 /protect=1 /harden=1 /noupdate=1 ^
/corpnet=1 /corpnetmethod=dns_suffix /corpnetval=corp.contoso.comAdmins can also configure corporate network detection directly in the app: open Settings → Corporate Network Detection, check the enable box, choose a detection method, enter the value, and click Test Now to verify detection works before saving.
If you need to undo all provisioning — for example, if you need to reconfigure a fleet, transfer devices, or respond to a misconfiguration — you can push a reset through Intune using the /reset=1 parameter.
/protect=1 was applied, the standard Windows uninstall path no longer works for those devices. Use the reset procedure below first, then uninstall if needed.
Re-push the installer to the affected devices with /reset=1. The /reset=1 parameter is mutually exclusive with all provisioning parameters — do not combine them.
CleanBrowsingClient_1.7.14_x64.exe /VERYSILENT /SUPPRESSMSGBOXES /NORESTART /reset=1NoRemove / NoModify registry flags)SettingsPageVisibility policy)DNS restore and browser hardening removal are handled automatically as part of the reset, which runs headless during the install. No additional action is needed on your end.
After a reset, the app remains installed but in an unlocked state with no active filter. You can then re-provision with new parameters or uninstall through the standard Intune uninstall flow.
/protect=1 not used)Intune can uninstall using the standard Inno Setup uninstall string. The uninstall command is automatically registered in the Windows registry when the app is installed. You can also push an uninstall via Intune using the Uninstall assignment type in your Win32 app configuration.
/protect=1 was used)/protect=1, document your emergency reset procedure before deploying. Test the full install → reset → uninstall cycle on a test device before rolling out to production.
MSP and enterprise pricing available. Manage all client accounts from a single dashboard.
View MSP Pricing
