Sheridan

We've got a cctv system hosted on a server which is accesible externally through our TMG2010 firewall - both servers have a domain wildcard certificate (Globalsign) on them for secure access. The TMG publishes the cctv 'site' and is accessible from web clients/ios and android apps - or rather it was! Since updating the cctv system and ios we can no longer connect from ios devices as it says 'cannot verify the identify of server.domain. Invalid certificate', whereas the android devices ask if you want to continue (if you accept it then works) So basically the IOS apps no longer work at all, and the android ones still think the certificate is invalid. Our wildcard (*.domain.com) is assigned to the HTTPS listener on the TMG, and also on the cctv publishing site (Milestone) - and is valid for another 2 years. The cctv server name is a valid domain name for the certificate as well, so I'm a bit stumped as to what it is objecting to! Oddly, on the IOS devices if you browse to the web version, it show the certificate as valid!

Not looking good. Gmail + iOS + Smoothwall = game over! Docs/Sheets/Drive all work fine. I guess Gmail is another one to add to the list of things that ignore a proxy.

We've got some iPad Airs running IOS 9.02 configured with Apple Configurator to connect to our wifi and install a few Apps. One app is Gmail - which goes through the normal authentication process and on the first screen, where you have the two options for Go to Inbox or Start Tour, it simply says 'An unexpected error has occured. Please try later' Its happening on all of them, and looking at the unauthenticated proxy logs I can see normal access to mail.google.com, accounts.google.com etc going through. I'm baffled as to what else would be blocking this, or what is causing the error? I'm open to any suggestions!

Its not urgent now, I've moved everyone back onto IE! I got sick of the complaints and its taken a fair while to sort out a pretty major bug.

Still waiting for ours to update. Once they're updated I think disabling the auto update is my next job!

To be fair, we've never had an issue with NTLM on our smoothwall,until they released a buggy version of chrome!

Brilliant, thanks. I'd been looking in the Chrome policy settings themselves, didn't realise it was a seperate policy set!

Still no sign of a fix, I've had to change shortcuts to force usage of IE. Is there a way to block chrome from auto updating? I know its a bit late now, but it stop them breaking it across the network again in the future.

Its pretty frustrating as its out of our hands, I notice the chrome developers have locked the issue forum now, they're getting huffy about the amount of comments! It might work out for the best, we've directed people back to IE - they might realise it was as good as chrome all along anyway.

Its quite widespread here, had to move everyone back onto IE. Just like the good old days when you just used one browser!

I did have a quick look at this earlier, but non of my clients seem to have the old_chrome.exe anywhere. I've told everyone to use IE in the short term.

'Or so' - I'll just tell the staff here that! Its a pain as our VLE depends on Chrome - so we use a shortcut that automatically takes them to it using Chrome.

Same here, intermittent and random NTLM authentication errors. As Chrome updates itself this is going to start causing a major headache! Anyone got a copy of version 46 I can use to downgrade!?

Same as me, although the Start Menu is not blank, but it only shows some of the tiles. For example, I configured (as an admin) a layout that had tiles for the office suite, Internet Explorer, File Explorer, Calculator (just for testing!) and SIMS. Deployed the layout, and when the user logs in, they got the office suite and File Explorer only. Buggy as hell.

I had a try of one of those in Currys, really nice screen for the price and nice and light as well.

I might use that myself!

It is a valid point though - if staff were sent an email with confidential information about your child at school - and that email was left on a phone that was unlocked, you would be furious that this wasn't controlled in some way? Obviously using policies and staff's own common sense is 99% of the equation, but its nice to have a backup plan!

I went off topic there really - I think enforcing password/pin protection on personal devices that use school email is important, to protect against confidential emails being read by the wrong person! The original point was staff bringing in their own devices to use in school - like you say they would only have internet access that equates to what they would have on a networked computer.

True, I can put the restrictions onto mobile devices with GAFE without any further intervention. Once we upgrade our wifi to BYOD we may allow access as well - the issue we've had is when our primary schools bought wifi and used it for their ipads and laptops - but then every staff member and their dog hooked their phones to it as well, and it did impact the performance!

This is sort of my point of view - they have access to equipment in school and can use any device at home for email - so why do they also need to be hooked onto our wifi?

I like the idea of using mobile management to make sure they have a password/pin on their phone etc to make sure that confidential emails aren't easily read.

Hmm I wonder if enrolment would be popular as staff would worry we'd be wiping their devices for the fun of it!

That would mean they have to enroll their personal devices though? Do you restrict the BYOD access just to email/calendars etc?

No, we're using GAFE integrated into our VLE.

This is where is gets a bit messy - staff are already using their phones to get their school emails, using their own 3g/4g but they now seem to think that the school should provide internet access on those devices as well!