RM's guidance for schools following the recent Ransomware attack (wannacry)

[Chris_RM]

Hello,

 

You will likely be aware of the Ransomware attack that affected the NHS and many other organisations worldwide over the last couple of days. Given the prevalence of this Ransomware attack the below guidance has been created by our technical teams to help you understand whether you are protected or not and what actions to take.

 

Guidance: https://support.rm.com/NewsAndAlerts.asp?cref=NWS5696059

 

Suggested actions to take:

 

1. Check to ensure that critical Microsoft patch MS17-010 has been deployed (see above guidance for help)

2. Check to ensure your backups have completed successfully

3. Remind staff and students about safe internet usage

 

If you have been affected by Ransomware, this article will provide some steps to help you recover: https://support.rm.com/newsandalerts.asp?cref=nws5073225

 

If you are a support customer and have any queries please log a call online, via webchat or over the phone.

 

Best wishes,

Chris Burgess

[FN-GM]

I would also Disable SMB 1 as a vulnerability in this is used to spread it to other machines.

[Domino]

I would also Disable SMB 1 as a vulnerability in this is used to spread it to other machines.

 

The patch listed above mitigates that...

[Danp]

None of our RM servers have MS17-010 installed already yet our non-RM servers installed it in March

[6Foot2]

None of our RM servers have MS17-010 installed already yet our non-RM servers installed it in March

I understand that March updates dealt with this threat where those operating systems are still supported.

[FN-GM]

@Domino Microsoft advise is to disable it anyway.

[Danp]

I understand that March updates dealt with this threat where those operating systems are still supported.

 

Yes, most of our 2012R2 servers installed this in or around mid-end March, but not our RM servers.

[steven_layton_sl]

Can I confirm, are both of the downloads in RMs Support article new? They look they they were published yesterday?

 

Also, I have a mixed environment of about 90% 1511 stations and 10% running 1607. What is the best way to manage both of these updates, once installed to the network?

 

Thanks

 

Package OS build version DWN article Status

Windows 10 Version 1511 Cumulative Update KB4019473 64-bit * Windows 10 Build 1511 DWN5696045 Released

Windows 10 v1607 Cumulative Update KB4015217 64-bit * Windows 10 Build 1607 DWN5696074 Released

[DarrenBaberRM]

Steven,

 

In PowerShell you can distinguish the level of Windows 10 on your network and we've written this TEC article (TEC5658429) on how to do it. The other alternative is to assign both packages as it will only assign the correct one.

 

Regards,

Darren

[steven_layton_sl]

Darren

Thanks, I'm just working through that PowerShell script now - I remembered about it earlier.

However, banging out the updates at main site location level might be the easiest way to get them pushed out!

[Danp]

Darren

Thanks, I'm just working through that PowerShell script now - I remembered about it earlier.

However, banging out the updates at main site location level might be the easiest way to get them pushed out!

 

Don't forget it will ask the user to log out though to restart the machine