Steve21

You need to do it based on the group policies, but this can take a few hours to apply and then you'd need to re-sync the photos over the top. Get-OwaMailboxPolicy | Set-OwaMailboxPolicy -SetPhotoEnabled $false (That's for all policies, else do the -identity "name" of which policy etc) Steve

Have you done all the "fixes" required since Capita disabled the service over summer? Steve

You can just add attractions to the empty room/wing, mass plant plants! Did the same with the radiator one for temperatures when you get to that. Steve

Money certainly seems to be an issue later in the game Especially when all the patients coming require rooms you have to research etc before building 3 star'd the first dozen or so no problem, and now hit one I've failed to even 1 start it twice, so gone back to an old level to do research first

While I know you want to bypass this issue now, I think you've misunderstood how they systems work. ADMT uses a 16~ length character hash of a password to sync over (Combined with the encryption key imported at the destination), and at no time provides clear-text passwords to the users or system. There is never a good reason to be doing what you're asking, give them an option to reset passwords if you want this, but you shouldn't be effectively stealing any passwords they're creating as it might link to other personal accounts to. Even Microsoft says you should never turn on reversible encryption (let alone clear text...) unless there's no other way around getting an old piece of software to work properly. And on subject, I do feel like others mentioned if you're re-doing another intranet etc it would be better to add on or build some of the original projects rather than doing another one, when many people are already using HAP etc there's really no need to re-do it from scratch again. Even if there's elements you don't like etc, or feel could be done better, you can still add modules onto the project so schools who are using it now don't need to chop/change. Steve

Unless it's changed there will be an .ini file with the settings and config that the exporter uses. If I remember right it used to be in the C:\ drive (either root or windows/system32) called something stupid like nrscatering2000.ini with the details of the servers/tills/sql etc Steve

It's still recommended to use 32bit office by Microsoft unless you specifically need super big files or a complex project There's many bits that won't work in 64bit office especially things like old access files or plugins that aren't supported Take something like Sage that doesn't support it too, there's a lot of programs that don't still Steve

Yep, but I'm assuming in that scenario of say 30 computers, only 1 is a staff one with bitlocker enabled? So you'd only have to keep 1 AD account or copy one set of bitlocker keys off of it. There's always going to be issues with any system, but as mentioned what's likely to cause more issues 100s of staff having to save keys and remember where they are etc, or IT copying one set of bitlocker keys when deleting a machine? Steve

I don't get what you mean, If for arguments sake you have 500 computers and 500 AD accounts there's never a "need" to delete an AD account really, rebuild a machine and it'll link back to that account, rename a computer and the account renames etc. Ok yes if you cut 500 pcs to 250, no doubt you'd delete them sometime, but in reality if that's the case there's probably a bigger story behind it and exporting a few keys isn't the end of the world Steve

It'll give you the option to enable it on the server, but unless you push a GPO to it or something silly it'll just sit there quietly If you rename a computer that's connected to a domain it should rename the AD account automatically for you. But there is an option to just right-click copy the bitlocker details if you want to still do that. Steve

Literally just enable Bitlocker Drive Encryption role (ok and a reboot for any fussy pots ) In regards to the deleting part, it's not often (well at least in my case) that a machine is actually deleted, as renames/reimage doesn't wipe it from AD. But yes in that case you'd either need to make a backup of the key or keep the old AD account somewhere. But that's still going to be less often and more likely to be done properly than relying on a user to do it and save the key somewhere Steve

You need to turn it on as a feature first. (All DCs enable Bitlocker Drive Encryption (no you don't need to use it on DC just need it installed)) The keys get stored in AD when it's encrypted (using that GPO options I set) Then in AD you can do a search by the recovery ID and it finds what machine it was and the key. etc Steve

No, it's set to auto backup to AD all passwords, so removing it just removes the option for the user to do an additional key backup. All passwords get stored against the AD account and can be retrieved through AD. Steve

Are you running Win7 or 10? If 10 there's the option of only encrypting used space rather than the whole drive which makes it a lot quicker, and remember it runs in the background so doesn't seem so bad for an end user who plugs it in to use it Err not sure it'll prompt at all if you remove that GPO, as you aren't forcing it so they'd have to right-click turn on bitlocker etc Steve

You can't do that, it's a computer based GPO so it's applied to computers, not users. (Unless you do the bitlocker per user "workaround" that's in another thread on here) Steve

You missed Explorer out of the path from what you said in your OP. Steve

If you really mean they have local admin rights its pretty pointless doing any of that lockdowns as they can just remove them... That should be priority one to remove really. Can you copy/screenshot your GPO example here as if it works locally no reason it shouldn't be working via GPO Steve

Sorry forgot to do that yesterday! (We don't force the newer bitlocker encryption as still running split site so this is a 7/10 GPO) Steve

Pick one main DC (assuming it's virtual remove the time link to host), point that DC to external time server. Point other HOSTS to that DC, and let VMs use timelink with HOST Bobs your uncle watch dates change! Steve

Deny write access to removable drives not protected by BitLocker Is the GPO to force removable to be encrypted if they're writing to them. (Or did you mean OS drives?) Will try to get a screenshot of ours once home as I've only enabled the basics for them as still using split site. Steve

If you wanted an example of a working shared folder/mapped drive etc this is what we use: http://www.edugeek.net/forums/windows-10/196937-windows-10-start-menu-how-everyone-else-doing-2.html#post1683899 (Screenshot of our layout is two posts up from the above one) Steve

Ah, never used the trial versions. We either used the Express installs (One off activation) or the proper license keys for bits. Steve

What trial are you referring to? You should be using full windows under your license (As you're allowed to run a VM) so can use MAK keys etc within the VM. Steve

Do you mean the groups or the new modern apps? That option only removes the folders like accessories/system tools etc, things like Photos App etc won't be removed by that policy. Steve

But you're taking one scenario rather than the whole overview. If they can access the data at home and get the data onto a USB drive, that drive can be lost anywhere even on route to school for argument sake, or when their home computer is stolen. Blocking of the USBs at school isn't going to stop this happening, therefore you're either saying you need to stop all possible downloads at home or have policies that are used for this. It's not a technology based answer in that regards but an overall process that's put in place. Steve