Olliedawg

Relaxing last few days here. Windows 11 everywhere where possible. Vast majority of jobs done.

We use a login script that uses the bootstrapper, and installs it for each user.

EasyBadge here, it can pull photos from MIS

We've just migrated to the new outlook. however we're seeing this issue on quite a few staff PC's using a test staff account. Clicking outlook (new) prompts to update the app via the store. We don't block the store, however what they can/cant install is determined by AppLocker rules. All Microsoft apps are allowed by default, so I'm not sure why this isn't auto-updating? Edit : solved it with a group policy change!

From what I've read it does, you can just use the "instant restore" feature & it does all the work for you. Following from everyone's advice on here, I'll spin up some new DC's & just backup/restore all other VM's🙂

Yes two DC's. I would have thought that with the DC's both being powered off, restoring from a fresh offline backup would be ok? I suppose the safer option is to rebuild though, easy enough to transfer roles.

Hello all - Hope your summer projects are going well! Next week I am planning to migrate our two on prem hosts from ESXi v8.0.3 to Server 2022 Datacentre with HyperV roles. Broadcom can stuff it. I am planning on using Veeam to move the virtual machines across. This is the first time I've done such a migration. My plan is as follows Remove VMware Tools from all VM's, power off VM's Take fresh incremental backup of all powered off VM's Install Server2022 on both hosts, setup & configure HyperV role Use Veeam instant recovery to fire the VM's back up from the latest incremental backup Re-configure/check backup jobs If you have done such a task before, I would greatly appreciate any pointers/caveats.. TIA!

Big up the 5406ZL! Still going strong here too

We don't use Intune so I can't help with that side of things, we're all local domain still here. GPO will only apply if you still have a local domain, and your devices are hybrid joined? We use AppLocker to block all non Microsoft signed software by default, and create rules to allow specific things where required.

I don't believe anything is blocked by default in the Edu(enterprise) version. I'm fairly sure AppLocker works with the Pro versions

either rapid expansion/growth, or the *proverbial* hit the fan.

I'm not an expert with RDP, but I do know that 24H2 introduced a lot of changes. One of which being that NTLMv1 is restricted/blocked by default, RDP now uses Kerberos. I think it's supposed to fallback to NTLM if Kerberos fails, so this may be part of your issue? I cant offer any more help than that I'm afraid if you've already combed through group policies

diskpart clean will definitely do the trick, you can then install a fresh copy of windows

I thought 2016 was the maxiumum functional level?

Delprof2 does work but it leaves a few registry keys behind i believe.

I would go with iPads, and look at an MDM solution. The popular ones are JamF, Mosyle & Intune. You can setup iPads in "shared" mode, where they sign in with their apple account ( from apple school manager ). You can also setup SSO for this with a Microsoft/Google account

Yea the vending machine ports are untagged & PVID set to the IOT VLAN ID, no other VLANs are tagged on those ports. Me neither but i guess every manufacturer does things a bit different. I'll have to do some regarding VLANs for our switches, there must be some sort of misconfiguration somewhere. AP ports have VLANs tagged yes

No, all being done on the Sophos box our core is basically being used as a giant L2 switch with loads of ports

We have an add-in which is only easily visible when using the full classic ribbon. On the simplified ribbon its a tiny button on the right

That looks to be ok then, as the vending machine is an endpoint & needs to be on that specific VLAN CPU usage is sub 10% on that switch & also sub 10% on the core, so I don't think there is a loop. Our VLANs originate from our Firewall (Sophos XGS2300), then are tagged from that point on to the core, through to the edge switches hmmmmm

Looking on a mikrotik switch (routerOS) which 2 of our vending machines sit on, it's setup like this Singluar bridge, bridge is set to "admit all" VLAN frame types, VLAN filtering is turned on VLANs (student, public & staff) are tagged on Bridge, SFP-1 & then any ether port which is required is also tagged (these ports go to AP's to broadcast the various networks), about 7 ports tagged The 2 ports which the vending machines sit on are both not tagged on any of the VLANs, and they have a PVID set to the VLAN ID of the IoT VLAN Shouldn't the PVID just permit the traffic which is tagged with that VLAN ID?

Me neither. There shouldn't be a cable looping ( i cant say for sure though without going through each cab ), all of our switches are individually linked via SFP Fibre back to the core, no switches are plugged into other switches at the edge. Unless you mean a loop on a switch it's self, but surely STP would prevent this? Mix of Netgear 48 Port PoE GS752TP (edge) Mikrotik CRS354-48P-4S+2Q+RM (edge) HP 5406ZL (core) I think this has most likely been happening for a while - but it's never caused an issue before up until now Yea I'm going to have a read through the configs. I can't imagine this being an issue on the core, trunk ports are supposed to have all required VLANs tagged anyway to tag the packets?

Consulting the hivemind here - Networking isn't my biggest strength, I know enough to get by... We have 4 VLANS - (staff, student, IoT & public) I'm troubleshooting some issues with vending machines on our IoT VLAN getting a buffer overflow, which causes them to stop working. Happens early every day, I can temporarily fix the issue by performing daily reboots of the vending machines... not ideal. During a Wireshark capture on this VLAN, I am noticing quite a lot of ARP traffic and broadcasts from other VLANs. Is this normal? I would imagine all of this extra traffic will be what is causing the overflow? We have STP setup on all of our switches in RSTP configuration. Edge switches are all Priority 8, core is priority 0. To my understanding, ARP & VLANs both sit at layer 2, so is this expected behaviour?

As per title - is it possible to force the classic larger ribbon instead of the newer simplified one? We force the classic ribbon on classic outlook via a reg key, but some staff use outlook on the web & obviously this is different. We don't have Intune, all machines are domain managed & are hybrid entra joined

eDiscovery content search does the job - in the Purview admin center