mrbios

Domain owned or BYOD devices? The former is easy: Do you have a CA issuing certificates to your devices already? If so you want to setup an NPS rule that has "certificate or smart card" as the authentication type, with a server certificate assigned, and deploy a wireless profile to match. Just make sure you use "Key Storage Provider" as the cryptography type rather than legacy for Win10/11 devices. Lots of guides for all that. EAP-TLS is what you're going for basically. The latter: No idea, services like clearpass can be used to onboard certificates as far as I'm aware but i've not looked into moving people off MSCHAP for BYOD yet personally.

Has anyone had any luck with these and issuing certs from an on-prem two tier PKI to devices? I can get the google one working perfectly, issuing user certificates to devices which then allows them to move to EAP-TLS for WiFi, and subsequently radius accounting pushed per-user to my firewall. However the google option uses the challenge password in NDES. When you install the InTune cloud certificate connector, it changes the way MSCEP works and the challenge password no longer works, so google devices stop receiving certificates. Tearing my hair out with this one. Even with the InTune connector installed, and ignoring the fact it breaks the Google one, i can't get it to issue certificates like i do with the Google one. Event logs have a bunch of 4003 information events, followed by 4005 error events which contain a "500 (Internal Server Error)." in them.... and i can't find a solution to this. Information online often relates to an older version of the intune cloud connector too. I've run a powershell script from microsoft called "Validate-NDESConfiguration.ps1" and that seems clear, all bar one error saying "Cannot find path 'HKLM:\SOFTWARE\Microsoft\Cryptography\MSCEP\Modules\NDESPolicy' because it does not exist." but i can't find any information as to why that would be, or what should be there. So two separate issues really, any suggestions?

Just updated this. None of this seems to be documented by Sophos in a "best practice" way of setting up STAS. The Sophos guide has to granting far too many permissions to the service accounts involved, or just doesn't give any description of what permissions are needed..... Changed the stascollector account to remove from local admins, it only needs to be in "remote management users" in order to read WMI. I think this is the minimal permissions possible for everything to work correctly.

A lot of variables depending on your setup as above. Personally we have the following options which all work really well: Always on VPN for school staff devices that go home Foldr - Web based access to on site and cloud storage in one UI, this is setup behind Cloudflare tunnel (previously had it behind application proxy, but it breaks some functionality that way) HTML5 RDP access - For any staff who don't have a school laptop on AoVPN, or as a fallback. Primarily used for accessing SIMS, and is behind Microsoft application proxy, requiring 2FA.

I had quite a few problems with STAS when i first moved to Sophos, spent a while troubleshooting and i've now got it working perfectly. I'm still not happy with the permissions it requires but i think i've limited it about as much as i can really. I really didn't like Sophos documentation or lack of advice when it came to setting up STAS when it came to what access it needed, so i've worked on that a bit. I've got STAS installed on my DCs for the agent and then I've made a dedicated VM for the collector. Configuration in the firewall (172.18.66.8 is the collector server): DCs have a service account of svc_sophosfirewall which has no special permissions for reading AD. In the collector and agent on the General tab, make sure NetBIOS name is in full caps. Collector configuration: Agent configuration on my DC's: Listed each subnet/vlan clients login to individually rather than one large range, found this more reliable. Key part though, I've made a service account for the agent and a service account for the collector. The collector I've made a service account called svc_sophoscollector and needs to be able to read information from clients, so it needs permissions relevant to that level of capability...I've begrudgingly put that in a security group which is added to clients with local admin rights. The agent i've currently got set as a domain admin, but it's only used on the DC. Further added the sophoscollector account to deny local login among a few other bits. There's a bit more on service accounts here: https://community.sophos.com/sophos-xg-firewall/f/discussions/117357/lua-for-stas-service-account I've not tried going down the link at the bottom to start sorting out permissions in a more specific way for WMI access (On the to-do list, but it's been there a while) by default Sophos documentation seems to have people installing the STAS service with domain admin, then that domain admin is reading from the DC security log and remote clients, but i didn't like that. I've not had any issues with STAS in the past 6+ months of doing this. EDIT: So in terms of accounts svc_sophosfirewall - Generic account on firewall svc_sophosagent - STAS Agent on DCs which is a member of domain admins svc_sophoscollector - STAS collector service account on the collector VM, no special permissions assigned, but local admin given to domain clients for WMI access - This can potentially be replaced by specifying WMI specific permissions. EDIT2: Obviously make sure you've enabled all the right Audit logging events in group policy for your DCs too, for the Agent to read from.

Active/Passive. Xstream protection, if im understanding right, is their name for their newer non-proxy style packet inspection right? If so, I'm still using the old web proxy method for the time being. I did see a guide about using both in tandem, fully intend to set it up at some point (but you know how these things can be....at some point turns into never very easily) we do have the zero day protection license though. That seems pretty good, it ticks over in the background scanning executables and zip files, seems to do some sort of sandbox testing of each one, then blocks or allows it based on what that sandbox experiences. Biggest negative compared to smoothwall though, is the dynamic content modification. Smoothwall has a whole section for it with some cool stuff you can do, whereas Sophos doesn't really have anything similar.

I moved from Smoothwall a year and a half ago to a pair of Sophos XGS3300 appliances in HA. Both appliances and 3 year contract, plus they threw in the secondary power supplies for both units for free, were cheaper than just the license renewal alone for Smoothwall. I "DIY'd" it and set everything up myself, then had a sanity check by a Sophos engineer to ensure everything was setup right. However Wave9 do a managed and supported install, which i would recommend if you go down the Sophos route....as it was quite a big learning curve coming from Smoothwall. Fortunately for me localzuk and bkgarry were both big helps and put up with my many questions on discord as i got to grips with the STAS setup.

We use Civica. Hate them, hate the product, hate the prices, hate the service and support (on-site engineers not included in that, they're the only ones that know what they're doing). I've even had an argument with a salesman, and I'm not normally the arguing type. Useless company basically. Was fine...ish when it was Nationwide, but like capita or EA, Civica have a habit of ruining everything they touch.

I had this issue but only when both DCs were restarting at the same time for windows updates each month. Splitting them into updating on a separate rota so that one was always up resolved it, do my updates via SCCM so i just put each DC in to a separate collection with a separate update deployment.....as i couldn't get orchestration groups to work lol. Not sure if the detail of DNS mattered as much, but they use each other for DNS primary and local secondary.

See my edit above, if im right it's just that AD Connect has been renamed. Retiring is just V1.0 which has been known about for a while (V1.0 last update was 2021, so people should have really moved up to 2.0 by now anyway)

Go here: https://aka.ms/M365Wizard And look at the cloud sync tool, it'll ask you about your setup, tick what applies to you and down the bottom it tells you which it recommends. Personally sticking with Connect rather than Cloud sync. EDIT: Worth noting that if you're already up to date on a newer version of 2.0 then it's just a rename of Azure AD connect and there's nothing to do until they next release an update. Only v1 is retired from October. (assuming i've read it right..)

Paxton's nice and easy to move. Take a backup of the database in net2 configuration utility, shut it down. Install fresh on a new server, restore the database backup to that machine, job done essentially. The database knows the IPs/details of the doors, so it should pick those up, it brings all the users over in the database and so on. You can install just the client back on the admin PC and tell it to connect to the server so they can still manage it. Only thing i had to do when i moved ours, as we pay for the pro license, was give them a ring because the online activation wouldn't work, but they sorted out the license activation very quickly for me. Alternatively you could just run a P2V move of the admin PCs setup to a server VM, but that's not as nice and tidy.

That's an understandable concern, however my experience has been the opposite. Last year we had a class searching for sensitive information, I think it was either for the PD lessons or for something they were doing in Drama. DSL got lots of notifications, went to the room and spoke to the teacher and a student overheard that conversation. She was quite open in saying that it made her feel really protected and safe knowing that these things were actively looked into. Also bare in mind that you can make exceptions to the rules. Childline might be one you want to add as an exception if you want to keep confidentiality. For example if we had it monitoring staff we would have CPOMS and SIMS as exceptions as otherwise we'd get tons of false positives from those windows.

Oh that's one area that is consistently atrocious .... screen broadcast. That's a module that doesn't and hasn't ever really worked properly at all, especially if your teachers have multiple monitors. It does seem interesting that so many have the same problems with senso control and locking etc.... I wonder if there's something i've done that Senso hasn't put in their tech docs. I know that i've taken all their IP addresses and DNs and put them all in a firewall rule that whitelists them all, even though you shouldn't have to grab all the IPs like that, i felt it helped negate some issues. You can grab them all from here: https://monitoring.senso.cloud/ also even though i shouldn't need to. Not sure if this would help either of you, this is based on a Sophos XGS firewall but i've chucked all this in (the latter might not be needed at all, but went for a "sod it, make sure it's 100% unblocked" approach": EDIT: Oh i also have a senso web category with the DNs in to match the above IPs in the exceptions, and then that is a web category exception to filtering too.

I've been using Senso for remote control, monitoring etc for some years now. It started off atrocious but for the past 12 months it's been really solid and responsive. Making sure it's properly unfiltered, webRTC is setup properly and its made an exception from any antivirus is essential to having a good time with it. (Recommend looking through the prerequisites on their support site) The only issue i ever see with it anymore is HP laptops display drivers sometimes lead to the screen not displaying properly.... never looked into why that is though as it's such a rare use case for us. On topic: Senso monitoring is brilliant.

Take a look at StarWind VSAN. It's more flexible than S2D. There's a paid support avenue if you want it, or you can just use the free version (up to 3 nodes). Essentially the same thing as S2D, vmware vsan etc but with more wiggle room and a cheaper support option if you want it vs the other two's support options. https://www.starwindsoftware.com/starwind-virtual-san I use the paid version at the moment with two nodes.

Try tweaking the these two registry values: https://ccmexec.com/2016/09/tweaking-pxe-boot-times-in-configuration-manager-1606/ - old version they're talking about, but i think the settings are still relevant. I found in the past some NICs didn't like certain settings and wouldn't download the boot image.

The last two times i had to renew Coconnect were my cheapest option, and they've been fantastic throughout. The rare occasions i've had to communicate with their support or sales have all been really easy and helpful: https://coconnect.co.uk/

Retaining the same IPs is simple enough but retaining names has an extra step as renaming an active DC isn't a good idea (to the best of my knowledge anyway, unless guidance has changed since i last did it...) In which case: Create one new 2022 DC, name it something new, give it a new IP, promote it and make sure any roles are setup correctly so that it can stand on its own easily enough to serve the network. Demote one of the old ones. Then make the second DC and reuse the name and IP of that old one you demoted, then do the same again, demote the other old one, promote a new one using same name and IP. You end up with 3 DCs, but you can get rid of the one that doesn't match your old names and IPs if you want to at the end, it's just there as a cut over really. Obviously make sure you give each promotion and demotion a good deal of replication time, double and triple check roles like DNS are setup correctly to match the old DCs. There might be any easier way to do this without needing the third DC but the above is how i've done it before and it's always seemed like the simplest process in my mind.

I know you're saying you're not looking to upgrade the OS on those DCs, but given they go EOL in October, is there a specific reason as to why you're not wanting to do that? Personally i would build a two new VMs on 2022 on Hyper-V, promote it as a DC, move FSMO roles and then demote the ones on VMware, rather than even bother migrating anything or upgrading OS's. Two birds, one stone as it were and a much cleaner transition.

I was really disappointed to miss those floods... well, kind of, as i lived at the top of a big hill where the bottom of said hill had turned into a lake that people were apparently jet skiing on. Sounded fun and cool to see........Though i was in 40 degree heat in Greece at the time, so i wasn't super bothered

Another APC only here, though the last one i bought was a Smart-UPS OnLine one, rather than the standard line interactive Smart-UPS models. Our newer servers were more sensitive and had the odd reboot on power change when we tested our generator, the online models rectified that.

Cloudflare would be my recommendation Though i don't know if they can do BACS, it says ACH payments for enterprise on their site, but i don't understand that enough to know if that translates to BACS for british as i'd not heard of ACH until now, and google just talks about US. Worth asking their support though.

Probably varies by provider, but in FreePBX I'm guessing it'd be "announcements"

I jinxed myself lol massive lightning strike right near my house, power spike and my broadband router died.