Duke5A

The classic control panel still has the Language applet, or at least my older Win10 Enterprise install does. Can you allow them access to this? There are GPO settings to only allow specific applets in the classic control panel. Then you can block the modern Settings app using App Locker.

Thanks guys. I'm going to start with this: http://data.iana.org/TLD/tlds-alpha-by-domain.txt I'll just pull out the most commonly used TLDs. I had no idea there were so many now. 95% of them are garbage. I'm going to block TLDs on the proxy servers and do the IP ranges at the firewall.

Just had a student goof on the address to our online learning portal and wound up visiting a squatter site. Said squatter site forwarded to another site with a .PW TLD which spawned one of those fake virus popups prompting you to call an 800 number. The country TLD is for the Republic of Palau; which is located in the south Pacific. The actual server IP is Russian. This seems to be a daily occurrence that happens to both students and staff. Some staff are gullible enough to fall for some of this stuff. The last round of spear fishing email that made it past our spam filter was from an IP located in Africa. I'm giving some real thought to blocking entire IP blocks for Russia, China and Africa in addition to numerous country TLDs. It would seriously cut down on risk. Anyone else take such drastic measures?

What are you using for antivirus? We use SEP 12.x and it did something to wireless in my image last year. It required some registry changes to fix. Memory is a but fuzzy, but it sounds similar.

https://www.lenovosoftware.com/lanschool Looks like they were bought out by Lenovo. We're using version 7.8 right now.

So if you uncheck the validate server certificate option on the client it connects? Make sure the certificate you're using on your Radius server is in fact issued by the CA (not a self generated one) and the subject field contains the host name of the Radius server. Without the subject field filled in properly it won't work. When I did it I used the NPS Server template and setup the Radius servers for auto enrollment. It's been a couple of years, but I can help out if you need. Let me know.

Thanks! This is actually kind of reassuring. I would rather error on the side of being too strict with the filter.

LAN School. I can't sing it's praises loud enough or from a tall enough peak. It's the one piece of software in my life I install and forget. Completely GPO controlled and pushed. Easily traverses subnets as well for teacher who are on laptops. When I told them we were coming from a competitors product the licensing cost dropped significantly too.

I had similar issues with wireless on student notebooks and I never was able to nail it down. I tried all those GPO settings. The original issue was our VB login script wasn't running anymore on wireless devices. In the end I gave up and transitioned everything over to GPP and used item level targeting to filter who gets what. Never looked back.

Anyone using Youtube strict mode in production? I was curious about its effectiveness. I'm trying to convince my director to open Youtube up for students, but in a limited capacity. I have it working, but would like some feedback about its ability to actually filter inappropriate content. I actually wish there was a way to force whitelist browsing on Youtube and have my staff approve videos on their own through our GSuite domain. Oh well... Thanks!

I just recently setup strict mode on a test proxy using the DNS method. Injecting headers was out because I don't have a proxy setup that can peek into an HTTPS stream. I didn't want it setup for teachers either, so my solution to that was have the students on their own proxy and have said proxy point to itself for DNS where I setup the request rewriting. Running Debian 8 with Squid setup for logging against AD (via Kerberos) and DNS being served by Bind. Haven't put it into wide scale production yet.

We're in the middle of legal shenanigans concerning our website and accessibility. This will be handy, thanks.

Left wide open for staff and completely blocked for students.

The Dude is free SNMP poller from Mikrotik. The Windows version was recently discontinued and replaced with a newer one (still free) that only runs on their proprietary Router OS. Even though it was free, it is easily the best network monitor that I have used. Here is the version that has the Windows installable server piece. dude-install-4.0beta3.zip

KMS requires the machine have a SLIC table in the BIOS. Download the SLIC toolkit and take a look.

Schrodinger's search result?

Do you have your image auto logon after reboot when done to run post install scripts? Add these lines to your answer file. false 3 "C:\Program Files (x86)\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPREARM.EXE" Rearm Office false 4 Activate Office cscript "C:\Program Files (x86)\Microsoft Office\Office15\ospp.vbs" /act

I had this exact issue a couple weeks ago. What is wants is the location of the MSI used to install the previous version. I don't know why it wants this and I didn't have a crusty version of Chrome laying around so I deleted its install entry out of the registry and that seemed to fix it. It'll be one of two places: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\{Software GUID} or HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{Software GUID} This depends if it is the 64bit version of Chrome and if Windows is 64bit. I'm on Win7 x64 and using the 32bit version of Chrome, so my entry was under the first key. GUIDs will look like: {BED0D2F3-7407-3B43-A48F-6C33BC3D5DAD} These change for the installed version of software you have. Just search for Chrome and delete the entire key at the GUID level. The new installer should install just fine.

Another user of Essentials on pre-Win10 computers and Defender on anything Win10 in the house.

I have an Optiplex 620 with an SSD in my garage that does the same thing. Baffles the crap out of me. There is no auto power on configured in the BIOS, and no WOL setup as it isn't plugged in to network. I just turn the plug strip off now. My ambition to figure nagging problems out is apparently not as much as yours.

Now why in the hell couldn't I find this when scouring the net? I need to work on my Google-Fu.

I just started running Win10 on a computer lab this school year and ended up disabling UAC altogether. Had issues with mapped drives being mapped under user credentials, go to run an installer off that drive, get prompted for UAC elevation and then the installer can't find its source files. Have had other problems with printer drivers as well - especially printers with built-in control apps like multifunction copiers. No adverse affects yet with the exception that Edge won't work. If you try and run it it'll explicitly say that it needs UAC enabled in order to function. Nothing of value lost... Chrome is our default browser and if you really need to you can drop an icon on the desktop pointing to IE11 (yes, it's still there).

Same thing happened to us and we already have a lockout policy, so the user's credentials must have been skimmed somewhere. You can set throttling policies via Power Shell: Limit the number of Internet messages a user can send We actually were blacklisted. I'm still fighting with MS after two months to stop rate limiting us.

The SequoiaView Homepage This will give a graphical representation of the largest files/folders on the drive.

We moved printer deployment last year to GPP from VBS. I also noticed initial printer installation taking forever to install the drivers and this was really a pain because we use Deep Freeze on our student computers. Solution was to pre-install the printer drivers (exact same ones that are on the printer server) into the base image.