Installing the DNS-over-HTTPS (User Context) Tool on Windows

The Barracuda SecureEdge DoH Tool is a lightweight Windows service that encrypts a device’s DNS queries. The SecureEdge DNS over HTTPS (DoH) tool is a Windows service that routes all device DNS queries via DoH to enforce your organization's policies transparently. No changes to individual applications or network adapters are required. Once installed, the service (SecureEdgeDoHTool) auto-starts on boot and restarts on failure.

The following installation methods are supported. Choose the option that best matches your deployment scenario.

All three methods install the same LocalSystem service (SecureEdgeDoHTool) and use the same configuration parameters.

• You need administrator privileges because the installer creates a Windows service and intercepts DNS, both of which require Administrator or SYSTEM rights. If you run the installer without elevation, it exits with an error.

• Download the SecureEdge EXE, PowerShell script and Intune package from the Barracuda Networks download portal.

• Identify your DoH endpoint: In SecureEdge Manager, go to Infrastructure > DNS Locations and open the DNS location for your device:

  • Copy the DNS over HTTPS URL value (for a fixed endpoint) or the DNS over HTTPS URL (User Context) value (for a per-user template). Keep the <user_email> placeholder literal, the agent substitutes the signed-in user's email at runtime.

  • Copy the DNS Server IP address. You must supply this as the -DohIp parameter when installing in intercept mode (the default). The agent intercepts all UDP/53 traffic, so the DoH endpoint must be reachable by IP rather than resolved through the interceptor, which can create bootstrap deadlocks for hostname endpoints. Pinning the IP prevents this, while the URL hostname still supports SNI, certificate validation and templates.
    For more information, see How to Add a DNS Location in SecureEdge.

     

    Open

    

     

• List local domains must be bypassed. This is necessary for authentication sites that only the local domain controller can resolve.

• Co-ordinate with your AV/EDR/XDR and VPN teams before a wide rollout. The tool loads a kernel-level DNS interception driver. Endpoint detection tools commonly flag driver-loading services.

Use this method to install the DoH Tool on a single Windows machine. A single self-contained executable that embeds the entire payload: the SecureEdgeDoHTool.exe, the WinDivert driver and the install scripts, and forwards your parameters to the installer.

Download SecureEdgeDoHToolSetup-<version>.exe from the Barracuda download portal and copy it to the target machine.

Right-click PowerShell (or Command Prompt) and select Run as administrator. The exe does not self-elevate. If you run it from a non-elevated session, it prints an error and exits.

Navigate to the folder containing the exe and run one of the following commands. Choose the example that matches your deployment:

Open

Run the following commands to confirm the service is running and resolving queries through DoH:

The service status should show Running.

Open

• After the service starts, run the following command:

Open

• To verify the DNS-over-HTTPS service, open C:\ProgramData\Barracuda\SecureEdge DoH Tool\service.log and confirm the query appears with the [doh] tag.

Open

• To confirm the user's email, the service resolves per-user template substitution. Run the following command:

Open

Successful Validation

Run the command below to verify that DNS queries resolve through the configured DNS-over-HTTPS service and that the SecureEdge DoH Tool works correctly.

Open

Failed Validation

The DNS query times out and no TXT record is returned. This indicates that DNS traffic is not reaching the SecureEdge DoH service and may be redirected, intercepted, or blocked by another component.

Open

Run the same installer with --uninstall as the first argument.

Run from an elevated terminal:

Open

Use this method to deploy the payload fleet-wide as a Win32 app. The DoH template and exemptions are set in the install command, so one app definition provisions every assigned device.

Download the SecureEdge EXE and Intune package from the Barracuda Networks download portal.

1. In the Microsoft Intune admin center, go to Apps > Windows.

2. In the Windows apps tab, click + Create.
   
   

   Open

   

3. The Select app type window opens. Select Windows app (Win 32) from the drop-down menu and click Select.

4. The Add App window opens. Click Select app package file.

5. Upload the “SecureEdgeDoHTool-<version>.intunewin” as the app package file and click Ok.
   
   

   Open

   

6. On the App information tab, specify the values for the following:

   • Name – Enter a name e.g., SecureEdge DoH Tool <version>.

   • Description – Enter a brief description, such as SecureEdge DoH Tool <version>.
     Under Preview, enter SecureEdge DoH Tool <version>.

   • Publisher – Enter your organization e.g., Barracuda Networks.
     
     

     Open

     

7. On the Program tab, specify the values for the following:

   • Install command – Enter install command e.g., powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Install-SecureEdgeDoHTool.ps1 -DohTemplate
"<https://dns.example.com/dns/<tenant-guid>>/user/<user_email>/dns-query" -DohIp "10.20.0.10,10.20.0.11" -ExemptNetworks "10.0.0.0/8,172.16.0.0/12" -BypassDomains "corp.local,internal.example.com"
     Note: In the Install command, enter the “DNS over HTTPS URL (User Context)” template, and DohIP retrieved in DNS location setup after the -DohTemplate parameter.

   • Uninstall command – Enter uninstall command e.g., powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\Uninstall-SecureEdgeDoHTool.ps1

   • Uninstall behavior – Ensure that System is selected.

   • Device restart behavior – Select No specific action from the drop-down menu.
     
     

     Open

     

8. Click Next.

9. On the Requirements tab, specify the values for the following:

   • Check operating system architecture – Select Yes and check the box Install on x64 system.

   • Minimum operating system – Select minimum operating system. E.g., Windows 10 1809 / Windows 11.
     
     

     Open

     

10. Click Next.

11. On the Detection rules tab, specify the values for the following:

    • Rules format – Select Use a custom detection script.

    • Script file – Upload the “Detect-SecureEdgeDoHTool.ps1".

    • Run script as 32-bit Select – Select No. Note: The script reads the service's install path and checks the installed version — running as 32-bit may cause it to read the wrong registry hive. Update the $MinVersion variable in the script each time you deploy a new version. Intune uses this to identify devices that need an upgrade.
      
      

      Open

      

       

12. Click Next.

13. On the Dependencies and Supersedence tab, skip them and click Next.

14. On the Assignments tab, assign the script to the required device group (not a user group). The service runs as LocalSystem and does not require user context to install.

15. Click +Add group, add the group and click Select. Click Next.
    
    

    Open

    

16. On the Review + create tab, review the configuration, and click Create.

17. You can see application “SecureEdge DoH Tool <version>” created successfully.
    
    

    Open

    

After Intune deploys the app to a test device:

• On the device, run the following commands:

  • Run Get-Service SecureEdgeDoHTool to confirm the service is running.

  • Run nslookup example.com.

  • Verify C:\ProgramData\Barracuda\SecureEdge DoH Tool\service.log for the [doh] tag on the query.

• In Intune, the app shows Installed once the detection script exits 0 and outputs confirmation that the service exists at the expected version.

• Per-user identity under SYSTEM: confirm that the per-user DoH endpoint resolved the correct user email by running the following from an elevated terminal:

For an Intune Win32 app deployment, run the scripts from an elevated terminal as:

Use this method to run the install script directly from the extracted zip, without the executable wrapper.

Download SecureEdgeDoHTool-x.x.x-win-x64.zip from the Barracuda Download Portal and extract it to a local folder.

Right-click PowerShell and select Run as administrator. Navigate to the folder where you extracted the zip.

Run Install-SecureEdgeDoHTool.ps1 from the extracted folder. The parameters are identical to the other installation methods replace the placeholder values with your organization's settings:

If you have a pre-built configuration file, you can pass it directly instead:

Note: The -Doh* shaping parameters are ignored.

Confirm the service is running and that DNS queries are being routed through DoH:

The service status should show Running.

A successful result returns a TXT record in the form dns_proxy=x.x.x, confirming the DoH proxy is active.

Use the PowerShell uninstall script to stop and remove the SecureEdgeDoHTool service and delete the installed application files (install and service logs preserved). By default, the script also removes the bundled WinDivert driver. If another application depends on the shared WinDivert service, use the -RemoveWinDivertDriver:$false parameter to retain the driver.

From the extracted folder, run this command in an elevated PowerShell terminal:

All parameters are optional except the DoH endpoint. Provide either -DohTemplate or -DohUrl, or use -AppSettingsFile to supply a complete configuration file. Parameters are identical for all installation methods. They apply to the setup exe, the Intune install command and Install-SecureEdgeDoHTool.ps1.