sparkeh

If, like me, you have a pathological avoidance of reading instructions (Except when playing board games, where, strangely, the instructions must be read, in full, and explained to everyone, in detail, before we can begin. Thinking about it I haven't been invited to Games Evening is a while...) and prefer to 'have a go' you can find SCCM a bewildering place to be. Thus is was when I tried to deploy SCEP to Windows 10 and found it didn't work as expected. So, in an effort to save other people the hassle of searching for this info here are a couple of things I learnt and my notes on how I deployed SCEP in the first place. Of course this is for my environment but can be easily adapted for yours. This is best way I could come up to structure everything in SCCM. Feel free correct any idiocies contained within. Stuff I learnt: Pre-Win10 machines use the full FEP client installed as a separate application, with post-Win 10 machines a layer is added to Windows Defender to control settings, def updates and AV policy Hence from 1. its not a good idea to have Defender disabled by GPO People having a Games Evening don't like to be lectured on the finer points of why can't play *that* particular card that that point in the game and don't respond to huffs, tuts and arm crossing How I deployed SCEP The elements of my AV setup in SCCM are: 1) Client Groups 2) Definition updates 3) AV policy 4) Client settings Client groups (\Assets and Compliance\Device Collections\Endpoint protection groups) My clients are organised into following groups based on product installed and location: - FEP - onsite devices - FEP - laptops - Defender - onsite devices - Defender - laptops - Servers Groups were then created to apply def updates and AV policies: - Def updates - All FEP clients - All Defender clients - AV Policy - Groups for each type of machine that need a different policy (e.g. laptops are allowed to update defs from the Internet, different server types have different exclusions) - Client settings - A group containing all the AV clients to apply the global settings to Def updates (\Software Library\Overview\Software Updates) - Two Auto Deployment rules: - ADR: FEP definition updates - ADR: Windows Defender definition updates - ADRs run every night after WSUS sync and add updates to appropriate Software Update Group and Deployment Package - Software Deployment Groups are targeted at appropriate def update client group above AV Policy (\Assets and Compliance\Overview\Endpoint Protection\Antimalware Policies) - AV policies have been created for different types of machine - Policies are targeted at appropriate AV Policy client group above Client Settings (\Administration\Overview\Client Settings) - Endpoint Protection management settings contain the settings the apply to the AV Client - this package is deployed to the Client Settings client group above (and hence to all machines with FEP to WD AV protection)

The Old Guard have had they day in the VeryPC sun, its the turn of the New Blood to swim the cool pools of Socktober prizes like a robotic Scrooge McDuck. Or something.

Well, the BBC article above does say that "The contract is subject to review every three years", I would imagine that the deal is revised every three years depending on how many schools are using it? I can't believe that the deal wouldn't have some kind of provision for schools leaving.

Awesome work guys See you at Madvent

Well its only fair to let him get some NUCy on his birthday.

I had to phone an insurance company last night, I think the guy on the phone was super bored as he was taking in a robot voice which has me in fits. He was also called Alan. "He-llo, thank you for call-ing e-sure, my name is Al-an..."

You've won enough sunshine

Sorry to dash your hopes people but the NUC is actually mine... or else the 'pictures' get released @VeryPC

Wow that video is creepy :S

Mmm me too, however I understand the decision not to run SIMS and FMS on an unsupported OS. I can imagine the conversation with our LA SIMS Support Unit if we have a problem and they see we are running Win 10 (i.e. we are not going to support that).

Details emerge of what the EU wants from a revised Safe Harbour agreement. Highlights are a move away from self regulation to Judicial oversight and annual review. Talks to be held next month. Wonder how the US will react to that? Safe Harbor 2.0: Judges to keep NSA spying in check – EU justice boss • The Register

Good enough for a prize....? *hint* *hint*

[h=1]Languedoc Roussillon Cassoulet?[/h] EDIT: Arrrrghghghghghg! *ahem* Well played sir, well played

[h=1]POT-AU-FEU[/h]

[h=3]Boeuf Bourguignon?[/h]

Ok, so I got costings, I grabbed the relevant people, laid out the benefits (again) of an OVS-ES agreement for Windows...and it was agreed Perhaps they got fed up me banging on about it

I use Evernote to document the Network, every note is tagged so that if anyone looking at it fresh needs to know about, say, AV, they can click the AV tag to get all the info. I think it works really well. Sensitive stuff is encrypted.

Ok pop fans, here are the answers: 1 Boomtown Rats - Banana Republic 2 Classix Nouveaux - Is It A Dream 3 Young at Heart - THE BLUEBELLS 4 DJ Fast Eddie - Yo Yo Get Funky 5 Howard Jones - New Song 6 Bow Wow Wow - I Want_Candy 7 Calling all the Heroes-IT-BITES 8 Through the barricades-(SPANDAU_BALLET) 9 Hue and Cry - Labour of Love 10 Can you handel it (SHARON REDD) Well done to @Seb1780 and @StevieM for a quality effort

I think @GrumbleDook has very sensible advice. We use GAFE with the model clauses, it isn't entirely clear how the modal clauses are affected. There's no point in running around like Corporal Jones while the official advice is to still tight and wait for the repercussions of the ruling to be worked out (and any revised Safe Harbour that might be hammered out). However we won't be signing up for anything new until we have further guidance.

I am in the process of getting quotes again. I have managed to add something on every year so fingers crossed at renewal time I can sneak on the Windows part

You mean this:http://www.pure80spop.co.uk/soundquizzes/bits1.mp3 Quiz included. Props to anyone who gets all the answers right.

Congrats! I've haven't won anything for so long in a VeryPC combo for so long I am doing this ->

If you want to keep cost down then Spiceworks is a really good option. I know that you dismissed this in your first post but I am not sure that you will find anything that does what you want, and does it so well, for a low cost. The mapping is actually something I really miss after moving from Spiceworks to Lansweeper.

Joking? No. They will accept the argument for an EES agreement for Office, Server and SCCM but not Windows. Go figure. Also, all the machines have OEM keys, so I though the idea was that if you performed an upgrade then the current licence/key is used to activate Win 10? After that you can perform clean install using the OEM key. Not ideal I grant you but a way forward. Just to throw something else into the mix, with Windows 7 you could buy a minimum number of volume licences which gave you imaging rights on all your machines with a qualifying licence. Is this still an option that is offered?

For Macs?