Mustang

I guessing if your adding a TCP-IP Printer then your printing directly to the printer and not via a print server? The print will still map if Windows already has a driver for that printer that it trusts or its using a generic Type4 driver. So the user is not installing any new drivers. You can check the printer driver running the following Powershell command get-printerdriver

I think there seems to be a bit of confusion around this. Setting the “Users can only point and print to these servers” and “Package Point and Print - Approved servers” group polices will not stop the UAC prompt when mapping a printer and allow non admins to map network printers that require drivers to be installed. This does not matter if the Printers are deployed by group policy, group policy preferences, script or mapping the manually, setting these polices have no effect and just define the list of servers where users are allowed to map printers from. These group polices should be used to help mitigate some of the security risk if you decide to set the RestrictDriverInstallationToAdministrators registry value to 0 (BAD IDEA) and protect against the newly announced CVE-2021-36958 for which there is currently no patch. I have tried installing our current Type 3 printer drivers locally using pnputil or add-printerdriver as recommend by Microsoft but this did not work for me, non admins still can’t map network printers that use Type 3 drivers. The only way I can allow non admins to map a network printer is by updating to the newer Type 4, in the case of the HP Universal driver I had to stop using it as I can’t find a Type 4 driver and switch to model specific driver.

We have been running a small pilot of about 40pcs and 60Macs for about 2 years but never got chance to expand on it. Haven't had a single issue with it but we don't use WOL All the machines are dumped in an unauthorised vlan but once the OS starts and they authenticate they moved into the normal data vlan. Biggest issued we faced were Our IP phones only support Mac authentication and the radius server doesn't, it can also only put devices in an untagged vlan, so the phones ended up in the data vlan with no QOS. You also need to tell the switch that multiple device can be connected to a port if the phone has a pass through port. Windows Depoyment with MDT, you need your pxe server, DNS available on the unauthorised vlan. you have to build a custom pe with 802.1x support and a custom script that authenticates the PE. Once that has happened you can deploy your OS/image to the machine but when the machine reboots you will need another script that runs during the OOBE to authenticate again so you can carry on the deployment and access the MDT share. HP Printers, never bothered as it looked a right mess and they are already on a restrictive vlan. We also currently use peap authentication which means you can't run credential guard and other newer security features on windows 10, so the plan is to swap it to eap-tls before we update to 20H2

This might have worked in terminal networksetup -setwebproxy "Wi-Fi" proxy1.domain.com 8080 networksetup -setsecurewebproxy "Wi-Fi" proxy1.domain.com 8080 networksetup -setwebproxystate "Wi-Fi" on networksetup -setsecurewebproxystate "Wi-Fi" on

Don't you need any data points with your room redesign? For a brand new IT room I would expect to pay between 2K and 6K depending on requirements Number of electrical sockets Number of data outlets New/extra trunking and trunking type Modifications to the distribution board New electrical ring Distance from data cabinet Time scale

I would highly recommend JPR Engineering Security Contractors Staffordshire They are based in stoke but will travel all over the country, they can do power, data, alarms, cctv, aircon etc. A number of Universities, Colleges and Schools without any issues.

you said when you do it manually it only works via DFS, has that changed or do you mean something different than using CMD+K ?? What version of macOS are you using?

What are your share permissions and acls?

What are you using the recovery partition for?

Can you do basic things like ping your file server, look it up in DNS, manually mount the file share via the netbios name or the fqdn, mount another file share on a different server etc

This is bad advise do not use DeployStudio for deploying High Sierra, Apple does not support imaging APFS volumes and any Mac with a T2 chip cannot be net booted. As @Arthur said Imaging is Dead and you need to look into thin imaging/MDM (basically application and settings deployment)

You haven't said if students can access there user area in the Mac suite? What happens if you disconnect the mixing desk and give the studio Mac no option but to use your network.

Curious to know how this would help?

As you have found out there is clearly something wrong with how you had your ACLs configured. Have you checked your staff users shares and shared areas too? chances are if one was configured wrong then others might be as well. Also redirecting Appdata to your network storage is definitely going to slow down all application that use the redirected appdata, especially Adobe applications. Lastly what are you trying to achieve by blocking access to these folders?? as you have seen even builtin windows applications can bypass the restrictions you have in place and I know of a number of applications you can download which will do the same without being installed. As long as your ACLs are correct you shouldn't have anything to worry about.

if you're allowed you could post the config of the switches and we can try and help?