RobD

These are the permissions I've used in the past: Share Permissions Everyone – Change Administrators – Full Control NTFS Permissions CREATOR OWNER (Subfolders and files only) – Full control Authenticated Users (This folder only) – Traverse folder / execute files – List folder / read data – Read attributes – Read extended attributes – Create folders / append data – Read permissions SYSTEM (This folder, subfolders and files) – Full control Administrators (This folder, subfolders and files) – Full control To configure that users only can see the files and folders they have access rights to, enable Access Based Enumeration on the share. I've used this tool to fix it: NTFSFix

Got you, the thing is if it did break and it got to the point where you had to get MS involved all they'd make you do is install the latest update. I'd risk it for a biscuit.

I think the updates are Cumulative so you should be able to go from CU8 to CU18 which will include the fixes for CU15.

If you've got time then I'd suggest a canoe trip down the wye valley on your way down to Cardiff. Canoes have dry stores and there's some brilliant river banks along route for some shoots.

1. We're a fairly large enterpise so went with full and needed the features while we migrated. 2. Its been running for nearly a year, will take us ages to migrate. Have several thousand users across the globe to coordinate. 3. Depends if your journal with Mimecast and/or if you scan outgoing mail with mimecast, if so then you'll need to route your mail out via Mimecast via a send send connectors on 365. As for on prem then I think the hybrid process adds a send connector for 365 traffic.

We do exactly this, here's an example: Hotmail looks up MX record which is to MimeCast which forwards to EX10 OnPrem which forwards to 365. You'll need to add the office 365 to your spf records for users who send out from 365.

I really like LanSweeper but you do have to pay it.

I have used a sync tool but for the life of me I cant remember which. This looking promising though: https://github.com/phw198/OutlookGoogleCalendarSync/releases

You'll either need to federate your exchange with the other company: https://www.allabout365.com/2010/08/federation-onpremise-outlooklive/ Or sync his calendar with a 3rd party tool to a google calender or similar.

In the past I've used the free version of PDQ and downloaded some free packages from this chap: https://www.reddit.com/r/sysadmin/comments/749zit/pdq_deploy_packs_v5200_20171004_includes_jre9jdk9/ There's a bunch of useful stuff and one package is remove Java.

Heard good things about Commercial Ltd (in Cheltenham) who push out Sharps.

I'm sure you've checked but make sure its not under warranty still on the off chance HP will replace it.

Think AMDavit2005 answered most of these but here#s my two pennies worth anyway: This is an edge switch should I keep it on L2 or L3? Depends if you want to route between vlans? If so you can keep it layer two and just set the gateway to a L3 device (or another L2 that routes to a L3) or enable L3 on the switch. Is the dhpc relay needed? Only if you enable L3, I use these switches on the end of a VPN tunnel and relay to a DHCP on another site. Why are all the client ports set to trunk? I couldn't get the phones working on a computer port i.e. I couldn't set the the port as active then add a phone vlan without it being a trunk. if you don't have this problem then leave them as access ports. Why is native vlan for management bad / security issue? (guessing here) if you plug into the switch and the ports are all set to native you could access the management of the switch?? On my other switches I do not have any allow vlan statement all vlans are allowed Do you run: switchport trunk allowed vlan all My device ports are set to access You can set these to access if you like the only ip on my edge switches is the management vlan IP You don't need to set a IP on the vlans. the ip-helper command is set on the vlan interface on the core switch / router. Thats fine, leave it as layer two. If all the ports on this switch need to be the same you could just set the port on the uplink switch to access on what ever vlan you need and just plug this in so it acts as a pure layer two switch.

I work with SG300s every now and again. First thing I like to do is enable layer 3 routing if its needed (it will wipe the config once enabled): set system mode router Then disabled auto macros, as they're mental: macro auto disabled then relays: ip dhcp relay address 192.168.3.3 ip dhcp relay enable As for vlans, I do something like this: interface vlan 10 name Management ip address 192.168.1.1 255.255.255.0 ip dhcp relay enable ! interface vlan 102 name Client-Data ip address 172.16.16.1 255.255.255.0 ip dhcp relay enable ! interface vlan 103 name Client-Voice ip address 172.17.17.1 255.255.255.0 ip dhcp relay enable then the config for the ports: interface gigabitethernet6 description Normal_Computer switchport trunk allowed vlan add 103 switchport trunk native vlan 102 ! interface gigabitethernet27 description Uplink switchport trunk allowed vlan add 10,102,103

Have you added a IP helper address on the switch?

We accomplished this by: Setting up wifi that simply accessed the internet (filtered of course), Setup a Citrix environment with a Netscaler, Give users a URL to the Netscaler and instruction on installing the Citrix receiver, Users then access a school desktop and print to their local printer. Problem with this setup is the Citrix cost.

I implemented Citrix a few years back at a School, main issues were cost of licences vs PCs and installing loads of school applications which really bloated the golden image (I should App-V'd or XenApp'd the applications but didn't). I had varied success with Citrix Desktop lock and ThinKosk to turn PCs into thin clients. Much easier to just buy thin clients if you can.

Hard question really, if its broken then it'll be down until its fixed or until someone has restored backups somewhere. If its planned downtime, then depending on the make and model and the number of controllers then an update for example can take anywhere from an hour to 10 hours.

I havnt tested it but something like this: $PC = Get-WmiObject win32_bios | select serialnumber Rename-Computer -NewName $PC -Restart -DomainCredential domain\adminaccount

Change the host file on a client to point at a new IP.

Is the DHCP setup to point at the correct server or is the vlan missing a gateway or a IP helper?

Check the DCHP settings on the wireless controller then move onto vlans??

That'll do it or via a registry key deployment via GPO. Computer config > Registry > Create the Keys then deploy using Item-Level targeting.

You could do a GPO based on IP address? I.e. if you're in subnet x then get this GPO.

I'd go with domain joined with workfolders and direct access.