free780

Its a default in Windows Server (not sure about client) even though the vuln is from 2016. This is how to fix in Powershell. If you have MECM you can autoamte a Compliance Baseline # Triple DES 168 Start-Process reg -Wait -ArgumentList "add `"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168`" /v Enabled /t REG_DWORD /d 0 /f" #DES 56/56 Start-Process reg -Wait -ArgumentList "add `"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56`" /v Enabled /t REG_DWORD /d 0 /f" #NULL Start-Process reg -Wait -ArgumentList "add `"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL`" /v Enabled /t REG_DWORD /d 0 /f"

I think Edge and Chrome now choose https over http for URLs typed. Certificate CRL/OCSP uses http. You have to do a detailed audit. I managed to parse the Windows Firewall log a while back with a similar aim.

I thought Win11 wasn’t supported on MDT.

If you pay for P2 you can set the CAP to only allow MFA registration from a low/no risk sign in. Many orgs need remote workers to register for MFA anywhere. It is a risk. Better than no MFA. If an account starts sending a lot of email or triggers Anti Malware then you can take action. MFA isn’t a silver bullet but it does make things a lot harder for threat actors.

Interesting discussion. For some of us Cyber Essentials is a funding requirement. 95% of software gets patch within 14 days which is do able. where I am. Nessus does miss vulnerabilities or has false positives. The areas where updates don’t happen are where there is a mission critical application with dependencies where a lot of testing is required. It seems to come back to lack of a decent budget in Schools and maybe FE. Which affects the whole sector with the amount of networking that takes place.

Looks like MS have resolved it. Follow this account on twitter. It’s the quickest way to be notified of service issues with the notifications turn on.

Ah Cyber Essentials requirement there. You need a vulnerability scanner in place. Or subscribe to alerts from Adobe/Microsoft and be on top of patching. Easier with Patch My PC. Possible Vulnerability Scanners are Nessus, Qualsys etc. Zoho/ManageEngine which may be cheaper. Defender (depending on licensing) can detect vulnerabilities.

This GPO setting should stop driver updates. https://learn.microsoft.com/en-us/windows/deployment/update/waas-configure-wufb#exclude-drivers-from-quality-updates

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-server-update-services-wsus-deprecation/ba-p/4250436 WUfB then? But you have to pay for Log Monitor to get reporting. Just seems like the need to increase Azure spending to me.

Shouldn’t part of being at school be modelling students for the real world of work? Some workplaces ban phones. EG Call centres . But the majority probably permit them. Self Control is required in the work place why not in education? Isn’t it more rational to model self control of technology rather than a blanket ban? MFA should be in place. There are also other benefits of having P1/P2 such as identity protection. Account Compromise can happen on site.

I did it years ago. You have to make your security group a Sharepoint admin for each Onedrive Sharepoint site. You can use Powershell to do it. Would it be too hard for students to just click share?

As far as I know it does not work as SYSTEM. You need Patch My PC to automate applications and updates.

Interesting my LG tv can’t mirror from a Chromebook without a Chromecast. About 2 years old. Miracast and Airplay work fine.

All the Eggs in the same basket.

Did someone install crowdstrike? Or let a certificate expire?