computer_expert

Anyone found the blue Cisco console cable yet?

NO! please research it properly and plan accordingly. If you do it wrong, it can and will cause problems. More so with the recent Petit Potam vulnerability as an example. Make sure all certs issued are SHA2/SHA256 otherwise web browsers will complain the certs are weak https://social.technet.microsoft.com/wiki/contents/articles/31296.implementing-sha-2-in-active-directory-certificate-services.aspx Make sure you set a server up for just the CA and nothing else (no sticking in on a domain controller - will cause issues if you need to troubleshoot AD and remove a DC) Use a 2 tier PKI setup (even if that means using something like OpenSSL on a linux distribution to create the root CA to save burning a windows server activation). Use the offline root CA (tier 1) to sign a cert for the online (issuing tier 2) subordinate/intermediate CA, that then hands out certs to devices. I used this (now dated) guide but is a pretty good start: https://social.technet.microsoft.com/wiki/contents/articles/15037.ad-cs-step-by-step-guide-two-tier-pki-hierarchy-deployment.aspx Before setting up the subordinate/intermediate CA, I would recommend setting LoadDefaultTemplates=0 in capolicy.inf to prevent the CA from issuing certs until you are ready to issue them. Example for deploying a template for an NPS server cert here Please spin up a few VMs on an isolated domain and run through the guide before doing it to your live system. If the PKI implementation is done well, it shouldn't cause too much grief (apart from the times you forget to renew the non automated renewals!).

Are you not able to use the 10.12 Sierra DMG linked at the bottom of that KB article, then use that to upgrade one mac and then get the 10.13 installer?

I've used Aruba switches along with ubiquiti wifi and switches on the same network. The ubiquiti kit was nice when you eventually find a firmware revision that doesn't break something or other, but I'd much rather go Aruba. Once you start trying to do advanced things (like 802.1x port auth) that's where ubiquiti kit starts to show limitations. Like @Norphy mentioned, Ubiquiti kit would probably be OK if you just need a handful of VLANs and a cheap price (so you can keep a few cold spares on the shelf). The Aruba switches are great workhorses in my experience. Like @slugshead, I've lost confidence in ubiquiti due to a lot of reasons (the breach, the force feeding of the somewhat useless new controller UI, the way they yanked unifi video self hosting, the repeated buggy firmware releases over the last 2 years or so, etc). I ripped out my home unifi AP as I got so fed up with it and replaced it with something has a lot less in the way of issues.

This one any good? https://support.hpe.com/hpesc/public/swd/detail?swItemId=MTX_fc7c95de9b9b462cb621d10275 It's the most recent I can find that I could download without an account, but not the latest release.

I always thought this was perfect timing from Sakhir last year

Unifi routing/security products are not worth the effort as @MatthewL suggests. Had a older USG pro and was ripped out after 6 months as it wasn't up to the job to firewall off a test network. Fortinet fortigates are worth a look too. If you can afford it, Palo Alto might be something else to look at.

Just throwing this out there, but do you have ESET installed on the server? If so, is it endpoint protection or file server security (FSS)? There was a thread on here a while ago and they were having freezing issues due to using endpoint protection on the server rather than file server security. Installing FSS resolved the issue.

I can't remember which but is either a 2920 or 2930 as it was a very small network (400 ish clients inc BYOD). DIY install too.

Stay away from unifi routers like the UDM or USG. While they do the job for a home environment, I wouldn't want to use it in a business/school as I found them lacking to say the least...If you have a fortigate, keep it - it's much much better. Option 3 is the best option if you ask me. We have ubiquiti L2 switches at the edge and a HP L3 switch at the core. It works fine for us and has been solid. Plus from a quick search unifi L3 switches don't yet appear to support things like ACLs.

If you need a SATA SSD for extra storage, amazon currently have the MX500 1tb for ~£67

8GB ram is not much for freenas/truenas (due to ZFS). Have you looked at openmediavault? Based on Debian so less greedy in the hardware resources department and can use MD/mdadm software raid too. The P410 raid card will fit in the G7 microserver but heat will be the problem. I pretty much killed the P410 in mine due to overheating.

I use OSDBuilder with MDT with WDS in larger environments. Very powerful. If you want a GUI, the have a look at WIMWitch. I also use MDT with Offline media in smaller environments (It can be used with USB flash drives too, see the bootable USB section) as you get all the benefits of task sequences as well

Thinking about it, standalone WSUS can download 'express' updates but you'll need a lot of disk space to store said updates. It looks like SCCM supports this too so maybe worth a try?

Would something like option 3 here do the trick?

How many clients connected to the same AP when this happens? Is it possible that there are too many clients and the AP is overloaded?

Adding more confusion to the mix, there's this too (but universal print in intune is currently in preview with possible extra licence fees when it exits preview). This looks like a good option for offsite printing though.

Papercut: https://www.papercut.com/support/resources/manuals/print-deploy/roll-out-print-deploy-client/topics/deploy-intune.html I can't help with network drives as we have everything on onedrive/teams/sharepoint which pretty much made network drives redundant.

Powershell scripts in intune aren't really designed for logon scripts: https://docs.microsoft.com/en-us/mem/intune/apps/intune-management-extension You may be able to bodge it via scheduled tasks or this script here.

Pop it in the deployment share's script folder and add a task sequence step to run %ScriptRoot%\script.ps1

Have you checked the box to force regenerate the images in the update deployment share wizard?

Have you installed the patches for the recent exchange zero day? (2010 had a patch released) Can you telnet to port 25 of your mail server from another internet connection?

By the sounds of things, you lose some functionality if you cloud manage the instant on switches at the moment. Also there's no CLI access on the instant on switches like the proper ArubaOS switches (eg. 2930F).

I tend to use this tool for creating the xml now. It should give you a valid file that you can use. I let it pull directly from the office CDN rather than messing around with downloading it to a share (that way you get the latest version on install, rather than installing it from a possibly outdated version then office updating itself when it eventually checks for updates)

The advice I see and give out is to use a subdomain of a domain name you own. I'd go for the first option as .local can cause issues with MDNS as that also uses .local For example: Forest root: ad.mat.co.uk sub domain: sch1.ad.mat.co.uk sub domain: sch2.ad.mat.co.uk Just be aware if you use mat.co.uk as the FR and have a website on mat.co.uk, then you'll have to do some additional work to get the site working internally (as the doman will resolve to your DCs instead). I'd also take note of @localzuk's post below - it will reduce complexity (less domains, less admin, less DCs (less server licences/cost) etc)