sonofsanta

This strikes me as utter stinking cowpats, but wiser heads than mine live here, so I want to see if this is as ridiculous as I think it is. The company we use to take online payments from parents and communicate via text/email (I'll keep them nameless for now) are claiming they can no longer automatically update their data from our MIS: Surely, surely this is absolute nonsense? Data Protection regulation has always required us to ensure data is kept up-to-date and accurate, and that must take precedence over any concerns they might have about processing. Because their only concern can be in the processing: they do have the data (just out of date), and we're now having to update manually, so their only objection can be that they themselves don't want to do the processing, even though we have either legitimate basis or consent for any data they'd be taking. Our DPO is phoning them to ask what their logic is, but: what the dickens, EduGeek? Can anyone fathom this? Has anyone else come across this? This is something they did do before May 2018, so it's not using GDPR as an excuse for a bad product; they've taken this functionality out as a result. I am mystified and irritated in equal measure.

After 6 years our assistant IT tech has been headhunted for pastures new, and given that both I and my senior tech are here for the long haul, he's accepted it as his only potential job and pay progression. Alas! Our office is now in mourning, and requires a new victim to maintain the asset register colleague. Full details on our Vacancies page, but anything you want to know about the job or the school, do ask! It really is a lovely place to work--I only intended to be here 2 years, and I'm coming up on 10 now--and we have air conditioning and ACTUAL DAYLIGHT in our office. Old tech will leave on the last day of Feb half term, and the hope is that if the right candidate applies we might interview early and appoint in time for a handover week, so do throw your CV in now rather than waiting for the deadline, if you fancy it. Tell your friends!

I added a shortcut to this VBScript in a shared area as a tile on the Start Menu with a custom icon. Just need to make sure the shortcut exists in C:\ProgramData\Microsoft\Windows\Start Menu\Programs as well as your redirected Start Menu, else it won't pin.

Way to ruin the entire point of the story, @DJ-1701 going to go and change my vote on @LeMarchand's poll now!

So I kept promising Dave I'd write an actual story for the thread, what with being an actual writer and all, but real work kept getting in the way (we have not had this many power cuts in years, seriously, what the hell). Four weeks I've been trying to do this. Four weeks! But tomorrow is the last day. 6 of the top 10 domains on our Smoothwall are Netflix CDNs. There is no job worth starting. So today, I thought, I shall make time. I only want to write 500 words or so, something short. I can do that! I've sold stories as short as 350 words! I've got half a dozen publications under a thousand words! I'm a good flash writer, this'll only take me a couple of hours working around incoming emails! Best laid plans and all that. So here, have a 2000 word piece of @ICTDirect_Dave fan fiction, swooping in at the last minute to take the title of Weirdest Thing I've Written All Year. Apologies for it being a rough-as-bumholes first draft, with all the colons and semi-colons that involves from me. I've spent long enough on this already without doing an editing pass. ### The Technician Dust fills the air, spat out in fits and starts by failing server fans. Sunlight cuts through the room like knives, slicing through the gaps in the server rack where equipment once hung. Each of those gaps is a memory, is a grieving: loyal friends fallen, with naught to replace them. On the floor, the Technician works furiously, hunched over a netbook. They lift a tiny black screw out, hanging on the tip of the screwdriver like a drop of dew on a blade of grass; they place it reverentially in an envelope, so as not to be lost. Every screw is precious. There can be no replacements. For now, there is only what there is, and no more. Unless the netbook can be resurrected, and a signal can be sent. The Technician hopes there is someone out there to receive the signal. There are words that are almost lost to the Technician, that they chant in their thoughts like prayers till they lose all meaning: Supplier. Budget. Purchase order. These words held meaning once. Would that they will again. Screw removed, the Technician turns the netbook over. They start to slide a flathead screwdriver around the edges of the keyboard, when a furious clamour and banging at the door makes them jolt. The screwdriver slips, and a key pops off: Pause/Break, skittering across the tiles and coming to rest beneath a cupboard. A gift to the cockroaches that lurk there. "ARE YOU IN THERE," bellows a voice, arrogant and impatient. "I NEED A NEW LAPTOP, I CAN'T GET ON THE INTERNET." A raider, here to take precious equipment. They could be sent away with something now, fobbed off with something that looks impressive regardless of actual specification or condition, but they would be back. They always come back. There is no sating them. The Technician closes their eyes and takes a steadying breath. There isn't enough time. There aren't enough resources. They have to prioritise. They have to get the signal out. They set about the keyboard again, lifting it from the chassis to reveal the circuitry beneath. With reference to the service manual--a faded laser print out, paper yellow and crumbling, old support case numbers scribbled in the margins--the Technician identifies the power board, and begins to lift it out for transplant. The shouting at the door increases. More voices have joined it. The word "BLOCKER" is yelled, and taken up like a chant. Carrying the now-removed power board on finger tips, the Technician carries it to the desk where another netbook lies in pieces, components splayed out like an autopsy. This is, in truth, not one netbook, but all the netbooks: it is the working motherboard from one, the display from another, the hard drive from a third and a keyboard reconstituted from keys kept tucked away in a secret pot, hidden in a drawer beneath a pile of silica gel. Ribbon cables wind across the desk like intestines, thinner wires like nerves. It is desperate. It is unlikely. But it may be salvation, for netbook and technician both. Trying their best to ignore the tumult outside the office, the Technician takes up their tools, and connects the power board. There is hardly any solder left for the iron. There will be no room for mistakes. The door begins to shake with the pounding of fists. "TEACHING AND LEARNING" comes a cry. The Technician finishes their task and puts down their tools. They reach for the power brick and connect it. With a prayer to Gilmore, Barlow and Kapor on their lips, they touch a screwdriver to the motherboard, connecting two headers in lieu of a working power button. Miracle of miracles, the patient lives. The netbook boots. A login screen appears, grey on blue: Windows XP. No mind. It will be enough for this task. The Technician enters a near forgotten password, passed down from their predecessor like a rumour: "if you need an old laptop, the local admin password should be g3tm30ut0fh3r3." The door handle rattles. The raiders grow bold. Did the Technician lock the door, or is it just the handle sticking? The Technician mutters thanks that the Site Team are as impoverished as IT, and have not been able to replace it. Regardless, time grows short. No barrier will stop the raiders, not physicial or technical or social. They are relentless. They will come. The screen lights up with green rolling hills. Green: a forgotten colour. It feels like everything has been dust for as long as the Technician can remember. On the desktop, a golden square: Outlook 2003. The Technician tries to close their ears against the haranguing of the crowd outside the door. They remember what else their predecessor told them, not in words but in a haunted look: this place will wear your soul down. You will give and give and it will not be enough. You will empty yourself of everything that works, going without so they can have. But when you have no more to give, they will not understand, never understand, no matter how much you explain, because they do not want to understand. There is only one hope. The signal must be sent: a hero must be summoned. Outlook loads in blocks, rectangles overlaying rectangles as if it is assembling itself, like the fragments of consciousness reconstituting after sleep. With no working trackpad, the Technician navigates with Tab, Space, Enter. New email. The hinges start to creak. Screws are coming loose in the doorframe. One shout briefly surfaces above the stormy sea of sound: "I'VE FORGOTTEN MY PASSWORD." I've attached a purchase order, types the Technician, tears stinging their eyes as they realise just how short their time has grown. Please could you deliver as soon as possible? They hit Send. There was an error connecting to the network. Your message will be sent when a connection is restored. No! How could it fail? Everything was fixed, everything was set up! The mailbox still exists, Exchange still wheezes on from the rack. It should have worked! The wireless couldn't be resurrected, but the Technician had connected a Cat5e cable. It should have worked, it should have worked! The Technician paws at the Cat5e cable, pulling it through their hands, desperate now, small sobs escaping their lips. There is a crack in the door behind them, splinters falling from the break like tears. The raiders have almost broken through. The Technician is certain the shelves will be stripped bare by them this time. They will take everything, and the Technician will be left with nothing. There! A break in the cable. It looks like a computer chair has rolled over it, no doubt from some unannounced, unreported moving of classroom furniture that left it exposed and vulnerable. There is a broken green wire inside the sheath, the copper glinting like treasure beneath long grass. There is a creak, and a crack, and a clatter. The door has fallen. The raiders are in. Only their own eagerness holds them back now, as they all try to squeeze through the door at once. The Technician touches the frayed copper ends together, twisting them, pinching them tight. They are just turning back to the netbook to check the connection when the crowd overwhelms them. The Technician recognises the raider at the front. They're Senior Leadership: those who have risen to the top through ruthlessness, or through self-aggrandizement, or sometimes just through sheer time. Regardless of the path of their ascension, one thing unites them: that certain flavour of confidence that acknowledges no objection, brooks no barriers to demands. "CAN YOU LOOK AT MY LAPTOP I CAN'T GET ON THE INTERNET" I hope the signal got through, prays the Technician, taking the proffered laptop. It is a near-pristine Surface Pro, its screen mirror black. The Technician remembers it passing through their office, like a visitation from a divine angel. Would that they could have such equipment. The technician tries to unlock it, but the screen remains dark. The Technician connects a power cable. The screen glows, letters of the POST glowing like holy scripture upon a tablet. "It was out of battery," the Technician says, trying to balance deference and helpfulness in their voice, fighting to avoid any implication of user fault. "You need to plug it in when it warns--" "I CAN'T BE EXPECTED TO KNOW THIS TECHNICAL STUFF," the raider bellows. "CAN'T YOU JUST GIVE ME A NEW ONE." Another raider pulls them back by the shoulder and towers over the technician themselves. "I'VE BEEN APPOINTED MANAGEMENT LEAD FOR THE COST-EFFECTIVE DISTRIBUTION OF PAPERCLIPS, I NEED A NEW LAPTOP TO ADMINISTER THE SPREADSHEET." More pile in behind them. "NONE OF THE KEYBOARDS IN V5 WORK, THEY WERE FINE WHEN THE LESSON STARTED BUT WHEN I CAME BACK FROM THE STAFFROOM THEY WERE ALL BROKEN." The Technician strains their neck, tries to see the netbook screen. Tries to see the network icon. Tries to see if the signal got out. But there are too many bodies in the way. Too many raiders. Some are helping themselves to printer toners; they're almost certainly taking the wrong ones, and will almost certainly try and jam them in anyway. Something in the Technician snaps. They can't help these people. They won't help themselves! They take no responsibility for their own actions. They have been here too long. Nietzsche: Beware that, when teaching children, you yourself do not become a child. A new pounding of feet sounds in the corridor. The Technician stops fighting. Stops trying to answer questions, stops trying to keep hold of equipment. Take even the flesh from my bones, if you must. "DELIVERY!" booms a new voice. There is something different in that voice, though the Technician struggles to place it at first. Something in the tone, something missing... Entitlement. There is no entitlement in the voice. The raiders part, brought to heel instinctively by a tone of authority. Become a child, the Technician thinks, and respond as a child. The newcomer carries a large box, but their face is hidden by a helmet. Hair cascades from the back of it in a ponytail. None recognise the intruder, and the whole room falls to silence in anticipation, only the grind of old server fans struggling to expel dust in the background. The newcomer places the box down calmly, and reaches up to remove the helmet. "'ello," he says, "I'm Dave!" The signal got out. "Got those laptops you ordered," continues Dave. "Lovely bits of kit these Dell Latitudes. We found some bigger RAM sticks lying around too, so we've upgraded them for you. You sounded like you could do with a little bonus." The Technician finds their feet. They go to the box, and fold back the opening like an archaeologist with a crate, like a priest with a relic, like a parent with a newborn's blankets. They pull one slim box out from the inside. They open the lid. They lift out the laptop. It is--it is whole. Unbroken. Working. It may not be pristine, but it is tested, blooded, proven. It is such good value for money. The Technician looks inside the box, and counts the smaller boxes within. They look at the crowd of raiders who stand, still shocked into silence, uncertain of what is going on. "There's enough," says the Technician. "There's enough for everyone." And they count the raiders again, and count the boxes again, and tears spring to their eyes as realisation springs to their mind. They look to Dave. Dave looks back on the Technician, kind and benevolent, knowing full well what rigours the Technician has suffered. He has seen the netbook on the desk. He knows the horrors. "There's enough for everyone," he says, laying a hand on the Technician's shoulder. "Everyone."

If ever there were a deserved winner--both for the Christmas Carol contributions to the thread and inhumanely poor workstation spec--it is surely @LeMarchand. Congratulations! And thank you, @ICTDirect_Dave and everyone else at ICT Direct for giving us a larf and some fun goodies [/sucking up in the hopes of getting a good quote next month] Isn't that referencing Kim Jong Un though?

Well before I've even had time to post in thread about what a gentleman @ICTDirect_Dave is, in that he found me a 750W PSU to go with the GTX580, it's blooming well arrived! In gratitude for such kindly treatment, I have wasted far too long this afternoon rendering an image of the ICT Direct team in the House of Commons, as requested by Dave in my Inbox: Jack really does make the most handsome woman, doesn't he?

I, also, have been kept busy by actual work, which has upset me greatly, and I've decided I've had enough of it, so: hurrah! To celebrate, here is a picture of Foulkes the Phoenix You'll all sleep sweetly tonight! As to what I win, uh, well, the Geforce 580 that Dave offered me sounds nice, but turns out my PSU is only a 380W Antec, so maybe not! I shall have a think and a ponder

The US-CERT email list has sent out details on the SamSam ransomware overnight. Based on the contents therein (click through to the 4 technical details pages for full info), I've added the following entries to our cryptolocker file screen group this morning: HELP_DECRYPT_YOUR_FILES.html *.nike2018 proteusdlll.dll SORRY-FOR-FILES.html ss2.stubbin sdgasfse.dll g04inst.bat ClassLibrary1.dll SORRY-FOR-FILES indeed. Not sorry enough. (Well worth signing up for that mailing list, btw; very useful)

Wait wait wait ...does he wear bright red cowboy boots? (EDIT: video embed doesn't seem to be working for me. If it's not working for you either, this is the video that should be above)

Me, I'm still looking forward to the gender-flipped Splash with Channing Tatum as the mermaid.

I have seen Teen Titans Go! To The Movies about 8 times since the weekend after getting it for little 'un. My head is filled with a relentless parade of the songs in the film ( ! ) and I can probably quote half the film back at you already. And yet... I kinda like it. It's surprisingly funny, and has a lot of references for adults and nerds. It's honestly worth a watch. Also watched Geostorm starring Gerard Butler at the weekend and that film is everything you'd expect from that title/actor combo. It exceeded my cheese expectations tbh, and may have surpassed The Core as my favourite complete-scientific-bobbins-but-strangely-compelling-and-satisfying-sci-fi film. The sheer delirious nonsense in having a countdown to a GEOSTORM, the point at which there is too much energy in the climate system from the satellite network and it all tips over into a permanent and destructive storm that will shatter humanity... but if you shut the satellites down with 3 seconds left, the 99.9997% of energy you'd already pumped in just dissipates and everything is alright, actually, all the flood water literally just drains away and the sun comes out and a bird probably sings somewhere. I have to admire the sheer brass balls it takes to spend millions of dollars employing hundreds of people for months on end to create something so nonsensical.

Amazon have the Logitech K400 wireless keyboard+trackpad for only £15. We use one of these in our meetings room so people can connect their laptop by the TV and then control it from the meetings table, and it works a charm. Perfect if you have a PC in your front room.

Don't set the GPO on Removable Data Drives--that's what the RDVDenyWriteAccess key is (the GPO literally sets that key). It sounds like the reg key isn't working. Are you definitely setting that last key under CurrentControlSet, in a different place to the others? The full path is HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE and the keyname is RDVDenyWriteAccess. There's no need for two groups, btw--Item Level Targeting can do "is not a member of group" as well, so with one group you set it if someone is a member, unset it if they're not.

Ugh cheques -_- my bank won't take international cheques anymore, yet half of publishing still insists on them. I just sold a story to one of the main three magazines (i.e. it is still running the way it has always run, dammit, if it was good enough in the Golden Age it is good enough for today!), and their payment options are cheque (which I'd thus have to open a new account to cash) or bank-wire, for which they deduct a $30 fee (off an $81 payment, in this case). Waiting to hear back on whether they will send the cheque to a friend, who can cash it and PayPal me the money. I cannot wait for cheques to die.

I just caught up to ep5 last night (watched Arachnids and Tsuranga) and, I dunno... it feels like it has the same problem as Star Trek: Discovery to me, this series, in that the production is wonderful, the acting is great, the interplay between characters is brilliant (the three companions are working really well for me), but... the actual story is rubbish. I mean, "giant spiders mutated by toxic waste!" was a tired plotline when I was watching it on 90s Saturday morning cartoons. Every episode so far has been predictable, rehashing old tropes uncritically, and not had any greater sense of meaning and import. I'd hoped for better from the writer of Broadchurch, honestly.

Well this is exciting. I was a big fan of Kubica first time round, and reckon he could have been a world champion at Ferrari if things had gone another path. https://www.motorsport.com/f1/news/kubica-williams-race-deal-2019/4301134/

Amendment/clarification to the above: running the batch file to enable BitLocker as a logoff script meant logoff took ten minutes, God alone knows why, recreated it as a Scheduled Task by copying the ...OnLock scheduled task and setting it to fire on event System: Microsoft-Windows-Winlogon: 7002. That works, and works without slowing everything down. IDK, and I'm fed up of trying to work out why when it comes to Win10 ¯\_(ツ)_/¯

oh god Black Widow cannot unsee cANNOT UNSEE

We do, yeah--we enabled auto-locking after 15 minutes, so it seemed only sensible to enable fast user switching alongside it, after years of putting it off!

Oh man I just got this on Monday night and I have been so exhausted all week at work as a result. It is, in every which way, just a perfect update of Theme Hospital. I was instinctively dragging out GPs' offices as 6x4 with windows everywhere until someone else in my office said you should just plaster every wall you can with the Silver Star award to get the prestige up. 3x3 rooms covered in ego-stroking certificates it is, then It's very easy so far--first two hospitals 3*--but I gather it gets much more frenetic later on, and suspect part of the ease for me is I already know exactly how to play the game. I can tell I am getting old when my favourite new game is one that acts exactly like an old game I already know. None of the new innovation for me, lad! Just a nice warm comfort blanket of nostalgia!

Sorted! Right. Further to the above, then: * Running a startup script to grant permissions to the reg key (SetACL.exe is sat in the Startup scripts folder for the GPO alongside this batch file): SetACL.exe -on "HKEY_LOCAL_MACHINE\System\CurrentControlSet\Policies\Microsoft\FVE" -ot reg -actn ace -ace "n:Authenticated Users;p:full" That's not necessary for the GPP, because those run in the system context, but are necessary for the scheduled tasks that run on lock/unlock. There are two scheduled tasks set up. One of them just runs a simple batch file to enable the reg key when a workstation is locked; otherwise a user could connect their device just after an unprotected user has locked the machine, then log on, and have write access to an unencrypted device. This scheduled task ensures that any locked device has BitLocker enabled. .reg file: Windows Registry Editor Version 5.00 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE] "RDVDenyWriteAccess"=dword:00000001 .bat file: regedit.exe /s enableBitlockerRequirement.reg Both those files are in a folder with all the other scripts that computers/users need to run. Scheduled task set up (make sure you untick the box to only run on AC power!): The same script & regkey is also set as a logoff script through GPO, for the same reason as it's being set on Lock (i.e. devices connected before login) The harder problem was the other scheduled task, for Unlock. Having made sure that the computer always has BitLocker enabled if it's currently on a login screen, I need to make sure the group membership is re-evaluated on Unlock. I need to do that without having the ActiveDirectory module imported in PowerShell, otherwise I have to install RSAT everywhere. And so, my inelegant and kludged together PowerShell script! # $group below should be set to the Group Name as shown in AD, without domain prefix, e.g. $group = "BitLocker Required for Removable Drives" # have to get username below through this method, not $env:username, because latter returns COMPUTER$ (which is the account running the scheduled task). Interrogating Win32_ComputerSystem returns logged on user. # username is returned in format DOMAIN\username though, and domain needs stripping out--hence Substring(5) used later. Adjust the 5 to match the length of your domain name + 1 (to account for the \ ) e.g. to remove DOMAIN\ use .Substring(7) $user = Get-CimInstance –ClassName Win32_ComputerSystem | Select-Object -expand UserName $RegistryPath = "HKLM:\SYSTEM\CurrentControlSet\Policies\Microsoft\FVE" $Name = "RDVDenyWriteAccess" $on = "1" $off = "0" # group membership code below taken from https://social.technet.microsoft.com/Forums/scriptcenter/en-US/1aac9c7f-a6e6-4f25-93bc-e39c2ee50535/powershell-login-script-to-map-a-drive-if-a-user-is-a-member-of-a-ad-group?forum=ITCG # does NOT require RSAT and ActiveDirectory module, so works on normal Win10 workstation $memberOf = ([ADSISEARCHER]"samaccountname=$($user.Substring(5))").Findone().Properties.memberof -replace '^CN=([^,]+).+$','$1' if($memberOf -contains $group) { New-ItemProperty -Path $RegistryPath -Name $Name -Value $on -PropertyType DWORD -Force | Out-Null } else { New-ItemProperty -Path $RegistryPath -Name $Name -Value $off -PropertyType DWORD -Force | Out-Null } The Scheduled Task is pretty much the same; the trigger is on Unlock instead (obvs) and the program started is PowerShell, not just a batch file: With all that done, in this post and the one above, BitLocker is now enabled: at startup at logoff when locked whenever a user in the relevant group logs on or unlocks a machine The only remaining loophole--and it's impossible to close--is if a user who is not protected is logged on, a removable drive is connected, that user locks/logs off and a protected user logs on... then they can still write to the unencrypted removable media. But you can't protect against that unless you just enable BitLocker for everyone (in which case none of this faffing about is necessary and you can just set it all in the Computer GPO); I've spoken with the Head and the DPO here and they're happy to accept this edge case, as it's so unlikely (and involves all sorts of behaviour that is otherwise terrible anyway). Now I just have to write up the guide and explain it to everyone. Wish me luck with that part...

My understanding was that because you had to circumvent the DRM to record an on-demand programme, that was in breach of the Computer Misuse Act, and so even though you end up with the same end product (a recorded programme) the method by which you obtained it is relevant, and only the version recorded from the OTA broadcast is legal. This is ridiculous and I resent having to explain it to staff so often. I'd happily rip from iPlayer etc. and never bat an eyelid morally, given our ERA+ licence and the nature of our institution. But copyright law is ridiculous, and desperate for reform in so many ways.

So I've been working through this, because just setting removable media to read-only has brought me naught but complaints, even though HAP+ and OneDrive are both there and both much better (they have actual back ups! IMAGINE) I've so very almost got it working, with a couple of holes I've not seen mentioned above patched (or almost); thanks especially to @gshaw for all your posts. SO RIGHT NOW I have a load of settings just set in the GPO, because it's easier and more self-documenting than registry settings: Default folder for recovery password Encryption method & cipher strength Unique ID for org Store recovery info in AD (require, passwords & key packages Removable Data Drives\Disable Smart Cards Removable Data Drives\Enforce Encryption Type to Used Space Only Removable Data Drives\Configure use of passwords (to set requirements) Removable Data Drives\How RDD can be recovered (save to AD, do not encrypt until saved to AD) Then all of that can, essentially, be turned on with the single regkey HKLM\System\CurrentControlSet\Policies\Microsoft\FVE\RDVDenyWriteAccess. That's being set to 1 with GPP if a user is a member of a group, and turned to 0 if they're not, as others have described above. That works really well! But there were two holes: 1) if a user connected a removable drive in before logging on, it opened normally, without requiring encryption, because it was plugged in before BitLocker was required. I'm now running a start up script to import the above regkey set to 1 to make sure it is enabled when a computer is first booted; I'm explicitly doing it as a startup script because if I set it as a computer GPP, then it'd end up being set for everyone at policy refresh (and so many problems would be solved if policy refresh went Computer -> User the same as logon, not the other way round) 2) if a user locks the workstation, and someone not in the group logs on, that resets the regkey to 0, disabling BitLocker. When the staff member comes back and unlocks, the logon policy doesn't run, the regkey isn't reset to 1, the user can now write to unencrypted media. That last one is where I'm almost at a solution. I've pushed out a scheduled task that runs a script to reset the reg key to 1 on workstation unlock, and that does fix the hole, but it applies to everyone, and will slowly get on my nerves (I don't want the restriction for IT staff, and we're forever locking/unlocking). When I'm setting up the task on the server it offers me the ability to set a security group i.e. only when users belonging to DL - Require Bitlocker unlock a workstation, but for whatever reason my 1803 Win10 machine doesn't offer that option when setting up a Scheduled Task, and if I try and use that option it fails with a complaint that the XML is invalid. It's exactly what I need and I can't have it. I'm not setting up 130 individual tasks for specific staff users! I can't apply the scheduled task as a user GPP filtered by group, because then it just overwrites in the same way as the reg key i.e. an unprotected user logs on, that disables the scheduled task, they log off and the protected user unlocks, the script doesn't run because the scheduled task wasn't re-enabled by logon. I've tried triggering a gpupdate /force on unlock, but that doesn't seem to set the registry--it obviously only does that at logon, not refresh (I've confirmed this by watching event viewer--the refresh does happen, it's not a problem with the scheduled task). Any ideas on how to fix the latter hole? Is there a way of workstation-based PowerShell/command scripts checking the membership and only updating the reg key if true, perhaps?

Honestly, between the storytelling and the specification (*shudder*), @LeMarchand has won me over, and gets the prize from me if I win. I confess I am not much of a horror writer, but this is surely the most terrifying climax to a tale in recent memory.