CHiLL

My settings are identical to yours. Scavenging and Ageing are set to 7 days.

I've been experiencing an annoying issue for a while now. Lets say I re-image a PC using SCCM and give it the same name. This new image will receive a new IP address from DHCP. I have found that our reverse DNS zones are updating their records to the new IP address fine, however the forward lookup zones aren't. It isn't the end of the world, because I can just delete the records manually and run ipconfig /registerdns. I just don't understand why this is happening. DHCP and DNS are installed on our 2x Server 2012 R2 domain controllers (2012 R2 PDC and 2019 DC...same issue has been experienced for years when they were both on 2012 R2).

It's amazing how much binge watching has taken over my preferred style of consuming TV. At the moment I have The Grand Tour and Top Gear on the go and I've queued up Star Trek Discover Season 2. I have a bunch of stuff waiting to be watched on both Sky and Netflix. It's just getting the time!

I absolutely loved playing games, but I've been finding it hard to get myself playing in the past couple of years. Outside of personal circumstances, I've found that my consumption has moved mainly from games to a hell of a lot of TV and cinema. That said, I have just completed the single player campaigns of Battlefield V from my PC in 4K HDR. Visually good and a fun waste of time, but as a game...it's the usual visual over substance from EA. Next on my list is probably We Happy Few. I absolutely loved the premise of this game when I saw the first trailer - it seemed very Bioshocky. However at release, it got slammed hard with all it's bugs and rushed/lazy development. Now that some of that has been (hopefully) ironed out, I'm going to give it a go.

Seems a bit sensationalist. I know schools have taken different stances on their interpretation of these. We have taken a bit from each side - we have disabled USB access for students (who have access to OneDrive and HAP), but kept it for staff. However we are using BitLocker to enforce all removable media to be encrypted before data can be saved to them.

We have enabled MFA only on the AD/O365 accounts we use ourselves to log in. Salamander is using it's own AD domain admin service account. We're using Salamander to automatically provision AD accounts when staff/students are entered in SIMS with start dates (as well as disabling the account when an end date is entered, and account modification if a change to the name has been made, etc). It will also provision the user's Office 365 account with licenses and setup OneDrive. It also manage AD security/distribution groups based on forms/lessons from SIMS.

Strange. We have just received a reply from Salamander who outright said no, Salamander does not support using MFA for any accounts.

We're considering enabling MFA using an authenticator app on our mobiles for all of our Office 365 admin accounts. However we use services such as Salamander AD, which has it's own admin account to automate account provisioning. How are services like this affected by MFA? I'm assuming they won't work, is that correct?

Looks like it isn't just you. I only have access to 1709 and 1803 too. I did previously have (and did download) 1809, but now it isn't there. Strange.

Since you use SCCM, so you have it configured as a Software Update Point in conjunction with WSUS? If so, this is how I managed Office 365 updates: (Though we no longer deploy Office 365 because of a whole load of issues we had with it - we're using 2019 instead). In SCCM, I had an ADR configured for each branch of Office 365 we were using, with the following criteria: Date released or revised: Last 1 month Product: Office 365 Client Superseded: No Title: Update - Semi-Annual Channel I had three Office 365 deployments in SCCM; Monthly, Semi-Annual, Semi-Annual (Targeted). I created an ADR for each with the above configuration, just changed the Title field to match the channel. The schedule of the ADR was to run automatically every second Wednesday of the month (to coincide with Patch Tuesday). Those ADRs were then deployed to a specific collection that had the matching Office 365 channel deployed to it. I hope that makes sense.

We are also using SCCM's SCEP/Defender/Forefront. It takes over management of Windows 10's Defender and so far, has been working great.

This is how we do it: Desktop icons - Staff and students are pointed to their respective redirected desktop held on a network share. Start Menu - Staff and students are pointed to their respective redirected start menu, held on a network share. Start Menu Tiles - Staff and students are configured with separate XML files to configure the tile layouts. (Note: These XML files can be an absolute bugger to get right)

Which version of Windows 10 are you using? Are the printers attached to local machines and shared out? Or are they network printers, controlled by a print server? Are you using Active Directory? If so, have you published the printers to AD? How are you searching for the printers? Using Windows Explorer or searching via AD?

Have you tried placing the machine & user in OUs that definitely have no GPOs applied?

I was having issues accessing a lot of Windows resources, such as msiexec, control panel, etc. It seemed to be specifically when File Explorer or the Settings applet was calling them that it had issues. For example, if I loaded Apps & Features - I couldn't uninstall applications because it said I don't have permissions to run msiexec. I couldn't even uninstall an application manually using msiexec from an elevated command line or Powershell. Or if I'm in the Settings applet and search for Control Panel and select it, I would also get an Access Denied error. If I browse to C:\Windows\System32 and launched control.exe, it would launch fine. It was very bizzare. There were also no entries in the Event Log about it either. As soon as I enabled that GPO setting and rebooted the server - the issue resolved.

I've upgraded my non-PDC DC from 2012 R2 to 2019 via an in-place upgrade, as well as some other non-DC servers. The process went smoothly at the time, but I later found some issues with permissions. Specifically my domain admin accounts could not access a lot of resources. I had to enable the following GPO for all of the servers: Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options > User Account Control: Use Admin Approval Mode for the built-in Administrator account: Enabled Other than that, I've upgraded our students file server, SCCM, Print, RDS/GW servers without an issue. I still have our PDC, SIMS, staff file server and a couple of other less essential servers to do.

Those commands can be ran as a computer startup script can't they? I thought those commands removed the apps from the machine, not the user. Wouldn't that script just delay the logon times for each user whilst it's being processed?

Sorry, I think I've made things a bit more confusing than it ought to be! Existing/old configuration (contract soon to expire): Client > Core Switch > Smoothwall Filtering > Router (Juniper) > Gateway > ISP (RM) The Juniper is not ours, it is owned and configured/managed by RM. It will be removed when the contract expires at the end of this month. New configuration (currently active alongside the RM connection, but not used by our users/clients...only when we are happy with the configuration of the Cisco ASA device will it be used by our users): Client > Core Switch > Smoothwall Filtering > Router (Cisco ASA) > Gateway > ISP (Virgin) I hope that makes more sense!

Is that 200Mbps combined, or can it process 200Mbsps in and 200Mbps out simultaneously (400Mbps combined)?

Virgin have provided a small Cisco gateway device that sits between their media converter and our ASA. We have been given 5 usable IP addresses from Virgin on a /29 subnet. I have configured the ASA with the Gateway IP provided from Virgin and set the routers external/outside port to the first usable IP from the provided range. That leaves us with 4 IP addresses that we can use for say, FED, RDS, HAP, etc. Our new line is 200/200. I believe the ports on the ASA are 1Gb ports, which I think should be able to manage the throughput we need. The new Virgin line and the ASA will be the new solution required to be up and running at the end of March. Our current ISP and provided Juniper router will be terminated/removed at that date.

We have just switched to Virgin as our ISP and found out that they don't provide a router as part of their service. Thankfully we are still in contact with our existing ISP, so we still have Internet access behind their Juniper firewall. We also have Smoothwall acting as our filtering and part firewall. However this is only a virtual appliance and sits within our internal network. Not ideal IMHO. We have just approved the purchase of the Smoothwall S4 that will sit between our core switch and our ISP's firewall, but that won't be coming until Easter. We have a spare Cisco ASA 5512-X that hasn't been used in a couple of years (since we left our previous ISP) back in 2016. Since that was last configured, our network has completely changed as part of a revamp. I have taken a backup of the config anyway and performed a factory reset on the device. I have configured the device to what appears to be the correct configuration. As the new Virgin line is a separate new line, it can be used separately without disrupting our existing ISP connection or users. The ASA is currently connected to the new ISP line and also hooked up to a laptop via Ethernet. I have confirmed that the laptop can access the Internet perfectly fine and receive the full 200Mb we're expecting. It is not connected to our live network in any way. The reason for this thread is that I am certainly no expert when it comes to configuring a router. I've done what I think needs to be done, but would like some advice or clarification (or even someone to look over the configuration) if possible. The last thing I want to do is hook this up to our live network and potentially expose us to the Internet. I've used Nmap as a penetration test and all appears OK. Though it did detect the following open ports: 7443 - Protocol: TCP - State: Open - Service: Oracleas-https - Version: 8000 - Protocol: TCP - State: Open - Service: http-alt - Version: squid 8080 - Protocol: TCP - State: Open - Service: http-proxy - Version: squid 8443 - Protocol: TCP - State: Open - Service: https-alt - Version: I haven't opened any of these ports and cannot see them listed in my config at all. Is this normal?

Is is possible to perform an on-demand scan on a collection that only scans a specific folder? We've been noticing some suspicious activity from C:\User\\ntuser.pol on the local (non-roaming) profile across multiple machines and multiple users. I have a feeling that this may be a false positive being reported by SCCM, but I'd like to be sure and run a scan for that specific location on a collection. We have real-time protection enabled and have ran both a quick scan and full scan on a collection. The Quick Scan doesn't appear to detect it, whereas a full scan and real-time does. The detection is being reported as: Trojan:Win32/Bearfoos.A!ml. It was only added in December 2018's detection lists and ntuser.pol relates to the user's GPO settings from what I understand. These are what makes me wonder whether it is a false positive.

We will be looking to refresh a lot of our desktops across the site in summer 2020 and since the multi-core CPU generation, Intel has always been the goto for performance. However I have seen in the past several months that the new AMD Ryzen CPUs are blowing Intel's CPUs out of the water in productivity benchmarks. Since the majority of our ICT is used for Office based applications, browser based activities and some photo/video editing and website building, it seems that AMD is the way to go. What does anyone else think regarding replacing Intel with AMD in schools?

We are a small secondary school with only two techies on-site. We have found that having a support contract with an external company has been an extremely useful aid that can help to relieve pressure on us with complex issues. We currently have a SLA with a large supplier/support company based in Birmginham. They certainly have the expertise and have helped us out a number of times, however there can be a number of hoops or procedures that they have to follow that can hold up a process or make it more complicated from our end. Does anyone have any recommendations for local (so that an on-site engineer visit can be easier to organise) technical support companies that can provide expertise should the need arise?

I use SCCM & MDT to deploy out our Windows 10 image. Once I have the ISO from VLSC and installed the latest ADK tools, I can extract the WIM from the ISO and use that when creating a new MDT Task Sequence in SCCM. Once the MDT TS has been created, I can take modifications/steps from my previous Task Sequences and use them in this new TS. Some of these steps include; installing drivers based on the detected make/model of the machine, setting the time zone to London (defaults at Pacific time), installing Windows Updates, installing essential software (such as Office, Adobe Reader, Chrome, 7-Zip, etc), setting default file associations (doesn't work properly, PITA) to name some. That TS can then be PXE booted or deployed via USB if required. Note: The TS image can be quite large if lot of machines/drivers are defined. For example, I have ~100 Ergo/surface style tablets that have no LAN and only one USB 3.0 port. As I cannot PXE boot them, I need to use a USB drive...but the complete image can be approximately 15GB. These tablets have a tendancy to corrupt USB drives on a regular basis and repeatedly waiting for a 15GB image to be created is a nightmare. So I copied the existing TS and disabled all drivers except the ones for these devices. Now the image to transfer is only about 8GB. Note II: I have since been able to get a PXE solution working for these using a USB to Ethernet adapter (and a lot of investigation with WinPE!)