psydii

We're also seeing slower than usual logons this term. I had put it down to a lack of recent house keeping following year end and a couple of revisions of the timetable/cycle. I expect our MIS Manager will be runnign house keeping in the next week or so. Will report back if it makes a difference.

To avoid this use the powershell command: Add-Printer -Name "WhatYouWantThePrinterToBeCalled" -DriverName "PrinterDriverName" -PortName "\\serverfqdn\printersharename" Using the GUI calls the point and print system and with Type 3 drivers that will usually triggers Elevation/UAC.

Not at all the feedback I got from this very parish just a few months ago. I couldn't comment on Vestel, but if your teachers are happy with Iiyama, then you will need to get some to try the Vestels before committing, and get 'sign off' from Head of T+L for the change. Messing with their classroom technology can be very disruptive to teaching, and you need to have them on board.

I'm seeing the same on that video. When I check in the admin console, my account is recorded as being 18 or over.

So prior to this we had YouTube restricted, and teachers were able to authorise otherwise restricted videos for Students. With this change (September 2021, not the earlier one where this thread started), if a video is age restricted by google algorithm, is a teacher able to override this with the Approve button?

Set age-based access to Google services Prior to September 1, 2021, you can designate your users’ age level in your Google Admin console. After that, all users without an age designation get the default experience for your institution type. However, you can still make changes after September 1, 2021. Note: Age-based settings that you configure do not take effect until September 1, 2021. Before you begin: To be sure that your institution gets the correct default age designation, check that you set the correct organization type in your Google Admin console. For details, go to Select your organization type for Google Workspace for Education. To set age-based access, sign in to your Google Admin console. From the Admin console Home page, click Account settings and then Age-based access settings. To apply the setting to everyone, leave the top organizational unit selected. Otherwise, select a child organizational unit or a configuration group. For Choose an appropriate age label, choose an option: Some or all users are under 18 years of age All users are 18 or older Click Save. If you configured an organizational unit or group, you might be able to Inherit or Override a parent organizational unit, or Unset a group.

This email has just started to hit our users inboxes. "We’re reaching out because you use YouTube at school with a Google Workspace for Education account. In this type of account, you use your school email address, and your school administrator manages your access to Google products like YouTube. Starting in the coming weeks: Because your school admin has marked you as under 18 years old, you’ll see a new, limited version of YouTube designed for schools when you use your school account. This means you won’t be able to do things like comment, live chat, or receive most notifications. You also won’t be able to create YouTube videos and may not be able to watch certain videos. This new experience is automatically given to students marked as under 18. But this only impacts your YouTube experience on your school account and does not impact the YouTube experience on your personal account. If you have uploaded videos to your school YouTube account, your channel will be hidden. You can download and save your videos using Google Takeout (when turned on by your admin). In the coming months we will also be launching a tool that will allow you to directly move videos from your school account channel to a personal account. We will reach out with more details when the tool opens. For more info on your school YouTube account, please visit our Help Center. Thanks, The YouTube team" Solution is here: https://support.google.com/a/answer/10651918?hl=en#zippy=%2Cservices-not-available-to-users-under%2Cgoogle-maps-and-google-earth%2Cgoogle-search%2Cyoutube

I am working on other things so haven't looked into it, but restarting spooler after updating the reg key might help.

Unless someone comes up with something better, this really feels like its going to be a complete rebuild of the print system here Hoping Papercut universal driver will save us some of the pain, but the transition from GPP deployed and self-service point and print printers to a scripted deployment is going to be rough. Particularly if we need to change drivers... UPDATE: the add-printerport command is superfluous, the add-printer command creates the local port if it doesn't already exist. also I've had trouble tidying up afterwards. After the printer is removed, the spooler seems to requrie restarting before the port can be removed. Guess we'll have to do that with a gpo loopback / machine script triggered at logoff.

Hang on. Something just came back to me from NT/95 days. Lets add some PowerShell to it and see what happens... On the client computer: Having already added the printer driver and knowing its "name" add-printerport -name "\\fqdn of your print server\printersharename" Add-Printer -Name "ShareName" -DriverName "DriverName" -PortName "\\fqdn of your print server\printersharename" Basically we are creating the printer on the client as though it was a local printer, but using the network share on the server as the "local" port. This bypasses point and print. If memory serves this is how we had to do it in days before point and print. I've done it against a couple of different printers / print devices and it seems to work, Papercut also picks up the job and logs it correctly.

Has anyone got this to work when connecting to the Shared Windows Printer rather than direct to the print device? @Mustang reported they can only get it to work for Type 4 drivers - unfortunately we only have type 3 in play To be clear what we are looking for is a way to connect to a shared Windows Printer without the client trying to download and install (therefore demanding administrator credentials) the drivers from the server.

You can do it with AzureAD and conditional access. We use it for external users and governors.

Free stuff as per above. But if your org can muster a couple of hundred pounds, you can get the entire Pluralsight library via their charity/education offer https://www.pluralsightone.org/

In the same boat as you @dubsdj. It seems either we all figure out how to deploy drivers via Group Policy/Endpoiont Manager, or we have to use the registry key that disables the fix and leaves you vulnerable. Thankfully we only need three drivers, and potentially we might be able to move to the papercut Global Print Driver so we only have to deploy one driver for the entire estate. Has anybody had a play/success with the Microsoft print management scripts found in C:\Windows\System32\Printing_Admin_Scripts\en-US or their PowerShell equivalents ( get-command *printer* )?

As per article: "If you set RestrictDriverInstallationToAdministrators as not defined or to 1, (i.e. the default after installing this update) depending on your environment, users must use one of the following methods to install printers: * Provide an administrator username and password when prompted for credentials when attempting to install a printer driver. * Include the necessary printer drivers in the OS image. * Use Microsoft System Center, Microsoft Endpoint Configuration Manager, or an equivalent tool to remotely install printer drivers. * Temporarily set RestrictDriverInstallationToAdministrators to 0 to install printer drivers. Note If you cannot install printer drivers, even with administrator privilege, you must disable the Only use Package Point and Print Group Policy." So yes packaged point and print is impacted. Hoping someone pulls together a guide on how to deploy printer drivers via SCCM so they are used by default when connecting to printer shares.

Not looked into it yet, but I'd say: no. you have to use the reg key as it is officially the only way as per the article.

https://support.microsoft.com/en-gb/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872 http://www.edugeek.net/forums/security/222800-printnightmare-cve-2021-1675-a-5.html#post1911401

http://www.edugeek.net/forums/security/222505-pingcastle-ad-windows-security-evaluation-tool-9.html#post1905799 Might be relevant? The way we have it running (I think) is that we log on to the sims server with an domain user that is a local administrator of the sims server, and then when putting creds into SOLUS for deployment we use an account that has local admin rights to the target machines, but not the servers. This solus push account needs to have read access to the \\simsserver\sims share.

KCL Zoe programme is currently not showing the same trend as govt data, and has previously been either tracking or slightly ahead of trends of the govt/PHE data. There is very much an attitude of 'lets not count the chickens just yet' in certain data/medical circles. Elsewhere, Boris has been sounding a cautious note today It has to peak sometime and quite reasonable for that peak to be now-ish (give or take a couple of weeks), but this seems a little sudden.

This is happening for us again, xml files open in Internet Explorer instead of the appropriate Office App. The original fix is in place, and reinstalling office doesn't cure it. Anyone else had a resurgence of this one? This is really problematic since reports from SIMS linked documents are XML. A quick and dirty work around is to associate the xml with word on a per user basis but that isn't great. Been seeing this more and more since January... paging @Koldov ::edit:: -- wait a moment. disabling the fix, the delagateexecute key reappears and xml associations start to work again (on one computer).

Because it used to work. Feature was disabled after it became trivial to decrypt the passwords stored in SYSVOL It remains because people need to be able to see it if configured - and the GPO system has not received any meaningful development since Vista.

not necessarily helpful to the OP, but I've discovered you can use Defender "Live Response" to run a script that adds users on an ad-hoc basis to the local administrator group. Let them perform the task (typically for us this was for Creative Cloud installs), then run another script to remove their admin access.

I would expect the answer to be "no" it is probably automatically created by the workstation or the server service (along with C$ IPC$ Admin$ etc). If by some chance you are able to remove the share you will likely find yourself in a "not well tested" configuration, possibly even "unsupported".

We just getting a empty page with the template footer back.... " {{$ctrl.selectedLanguage}} {{::$ctrl.companyPolicyDisplayText}}{{::$ctrl.resources.Footer.ContactUs}} {{::$ctrl.resources.Footer.Privacy}} {{::$ctrl.resources.Footer.TermsOfUse}} {{::$ctrl.resources.Footer.ThirdPartyNotices}} {{::$ctrl.resources.Footer.TermsAndConditions}} © {{::$ctrl.copyrightYear}} Microsoft"

Not sure I'm afraid. At a guess, given the context I would interpret that to mean "this doesn't work in the scenarios where a user has an external person in their personal contact in outlook, however that person is not in the global address list in their home tenant (because some orgs split up the address lists for various reasons)"