mrwoberts

Best way would be to allow your safe sites through Chrome GPO Computer \ Administrative Templates \ Google \ Google Chrome \ Content Settings \ Allow the Flash plug-in on these sites Add your bbc.co.uk site and any others that you trust It seems even the 'Ask to allow' option in Chrome doesn't really ask, so we just use this method.

What fileset revision are you using?

Install the Autohotkey tool, then your script can be as basic as the following, which just simulates the (CTRL)+(ESC) keys pressed twice #NoTrayIcon Send ^{Esc} Sleep 50 Send ^{Esc} Convert that to an exe, place it in the (default profile, or programdata) startup folder and you're good to go. Just try it out first.

Caitlin Smith Internal Account Manager Dell EMC | UK Public Sector Direct (UK) : 01344 373026 Email : [email protected]

Do you know how it got disabled in the first place? Was it through GPO, or baked into the initial image? With my initial tweaking around with Windows 10 I stopped the Cortana app being provisioned for each new user, but that rather smug look on my face as the boot time decreased soon disappeared when I had the same 'two click start menu' effect. As a fun little project I actually created a Autohotkey app that would do the double clicking for you as soon as you logged in - the automation was often unnoticeable, but I just lumped with having Cortana provisioned and disabled it through GPO (as above). Shame Microsoft don't give us more granular controls over what is/isn't installed for new users; I'm sure we could half our login times

I'm thinking there is some other registry/GPO setting causing this. This isn't normal behaviour. The fact that the start/stop/config options are greyed out is normal, this is a Trusted Installer privileged process. Anything in the event logs? Take a look at the events for services that start/stop... By the way, a group policy does not undo by selecting 'Not Configured', you have to reverse the change by toggling the opposite first, then later down the line you can select the 'Not configured', this is normal GP behaviour - thanks to MS.

Hmmm, I'm just thinking that most of your list of exceptions are not URLs. How/where are you adding those exceptions? I agree, that list is very broad, and all over the world! Another thing to check is, have you specified anywhere (sorry I'm not a Smoothie user), not to allow direct IP address connections (or something similar)?

Any ideas what 'mirroring360_win.exe' is?? Is that app throwing the error? Edit: Possibly related to a SplashTop (remote control/screen sharing app). Try uninstalling that then see if other software installs work okay.

Have you tried installing it manually within a standard (non-admin) account, and without elevating the install through 'Run as Admin', or Admin command prompt... If you can install it without admin privileges then it should work through the User GPO logon script?

Perhaps it doesn't like the SYSTEM context of the Computer GPO. I'm assuming the software needs to write to privileged folders and thus the User logon script wouldn't work?? Sounds like the portable route is the way forward, or you could look into PDQ deploy.

I imagine that's the problem then. Running the script manually as an admin from a network location vs. running it as a Computer Startup script are not necessarily going to yield the same results. You're comparing an admin account with a computer SYSTEM account; very different security context. Since you've got a working solution with your portable app I won't labour the point, but if you're interested in finding out why this script / MSI didn't work, I'd begin looking at the location of the MSI - try putting the msi in the netlogon folder, which gives access to computer accounts.

That makes me wonder what context it works in/requires. When you ran it manually, were you in an elevated account, command prompt, 'Run-As Admin'...? When you tried your script version, was that under a 'Computer' Startup Script, or 'User' Logon Script? The latter runs in the security context of the logged on user, the former runs as Local System (Admin) context. EDIT: With the above in mind, if you ran the script under the Computer GPO, you'd need to put the MSI file in a location that is accessible from the receiving computers Local System account 'computer$'. The UNC path to the domain Netlogon folder should be fine. Running the script in User GPO just requires that user to have read/execute access to the MSI file.

:laughing: Point taken. I think it was a good exercise to spot this and discuss it with SLT, and now, as you say, record this as part of our risk management - taking any action where appropriate. I was kind of expecting something a bit better from these guys, but in the same way I'm sure I could be pulled up on some ways that I do things. Helpful discussion and made me think more about our setup/methods here. Thanks for contributing.

Just waiting for a clarification on the transfer method, but initial response suggests we just need to secure the folder where the data is dumped - they rely on the SIMS command line exported which dumps in plain text... Okay, I can understand that, but maybe it would be better to delete the data when it has been used?? Next stop was the secure transfer. I have asked if the plain text files are encrypted before being sent to a URL on the internet (using curl). Hope to hear back tomorrow. I see from the curl trace file that a certificate is involved, but nothing of what I see means that this plain text file is being encrypted - even purely on the basis of the plain text file being left behind. Am I missing something here? Should the file be encrypted before being transmitted, or is an SSL connection to a remote server through curl sufficient?

Good question, I shall add it to my list of things to ask them. I've a horrible feeling these XML files are simply pushed to their server via a listening URL, found in the config file.

Can I just run this by someone to make sure I'm not overreacting. We cleaned up old sims users before the start of term and subsequently Clarion Call stopped working. They said their software was using a user that has since been removed. No problem, just pop in the new username and password in a plain text file in the clarion folder!!!! That is a show stopper in and of itself, but when I went into the folder where clarion call is installed there are plain text files of a recent export with tons of personal data in.... plain text (xml) I'm looking for someone to tell me this is all fine and stop worrying, or to back me up and say... "Get on the phone to their support straight away and demand this changes!" They are supposed to be GDPR compliant, but this is just bonkers.

Thanks FishCustard In desperation I ended up using the PowerShell commands to Remove-MsolGroup and it was remarkably easy. However, this morning...... One user has emailed from her private email to say she can no longer login to her outlook account. Odd, because I can see her there, not blocked or anything. I've reset her password and logged in fine. Hoping this is a one-off, or a Microsoft portal temporary issue. Out of interest, what would the Start-ADSyncSyncCycle -Policy Initial command do? I'm looking for something along the lines of, the AD is the master, so remove any 'synced with AD' objects that actually no longer exist in AD, or have been moved to an OU that I don't want to be synced. Kind regards

Latest AAD installed and syncing two on-prem domains. I've deselected containers with security groups in, however, the O365 admin centre continues to include Security Groups, even ones I've deleted (from local AD)!! It won't let me remove them from the cloud, warning, 'You can only manage this group in your on-premises environment. Use 'Active directory users & groups' or 'Exchange Admin Center' tools to edit or delete this group.' How on earth can I make the online directory look like what it should - remove non-existing groups and no longer include security groups. I've done a Full Import from the Synchronisation Service app but it continues to be full of junk. I didn't set this software up, but I'm trying to clean it up. Would it be better to start from scratch? Would it be better to clean things up using PowerShell (that will take some learning). Kind regards

Hi Wu One thing that I would do would be to remove the apps that you do not want in your build, Skype, Tips, Voice Recorder..., that way they won't be visible in the Start Menu. If you want to look into doing that then read through this dedicated thread on Edugeek Thread - http://www.edugeek.net/forums/windows-10/165029-how-get-rid-candy-crush-soda-saga-other-windows-10-start-menu-junk-good.html Regards

It's entirely possible I don't fully understand the scope of IWF, but just a brief look on their website suggests something a but more substantial that you are giving them credit for, "More than 1,000 webpages are assessed and removed each week by our analysis." I'm confused how they could do all that simply by blocking 500-800 urls. Do you have some info regarding those states, I'm genuinely interested. re: wiki article - I support just about every company engaged in this kind of activity will come under criticism, after all, they are essentially 'policing' content on the internet, which I'm happy about.

The IWF is an essential resource for any reputable filtering solution (my opinion). I couldn't see it stipulated in the KCSIE or PREVENT guidance (someone please correct me), and I can't imagine you would have your hands slapped by an Ofsted inspector for not including it, but I personally would just want the peace of mind of having a package that ticks these boxes. Have you taken a look at the Filtering provider responses ? LINK A lot of those filtering solutions will implement a database of millions of domains/URLs. Hard to beat a paid solution when you think of the resources needed to keep ahead of the game in the realm of filtering. Thanks for sharing your solution though, especially the icalert link.

Just wondering if there is a way to change the Solus Settings that are already set within the Deployument UI. I particularly want to change the settings on the, SOLUS3 >> Settings page, from the short name version of the server name to the FQDN. If I attempt this within the UI it throws back a 'no can do' response - The computer has already been selected (blah blah blah) Any config files that you know of, or is this stored within the database?

If they want it to be able to install software, could you show them a better way? (PDQ Deploy??) You can always setup some automation to update the installers for them, then they just have to {click}...and off it goes. Little Knowledge and Much Power are not best friends. In fact, they really don't like each other.

Thanks again. At the moment, I think I'd be smacked down if I suggested shifting MIS. Frustratingly though, the MAT drivers are just a bit passive when it comes to sorting out stuff like this, which is arguably a big money saver if you get it right. Capita know it can be a bit daunting to change and they probably play on that fact. I for one would be happy to move to a true cloud solution. I'd even be happy to give up time to meet with a company who can deliver on it's promises of such a product. On a separate note, it's the LA and their solicitors who are putting every block in the road to delay us moving away from their BT unicorn (recommended) broadband solution, which means our current broadband just couldn't entertain the added pressure of a hosted solution.

Thanks for the info chaps. To make matters more murky, they are still charging us for Census support, so now I'm left wondering whether that in fact still includes the patches required to do the census?? We do pay for SIMS licenses, and I believe the cost was adapted when we moved FMS to hosted, but I'm going to clarify this with the bursar on Friday. In essence, all we want are the patches (maintenance), the rest we have experience within the MAT to deal with, or places to turn to when in need - Capita, Edugeek... Another question... One of the schools opted to keep the Silver service. May the downloaded patches/updates be used within the MAT schools? Seems unlikely, but thought I'd ask.