Roberto

I don’t have the reference handy on the train but air traffic can interfere with WiFi (note my carefully chosen order of precedence here). We’ve had issues in the London office where our high-rise office is on the flight path for traffic going into London airport. It doesn’t stop you installing WiFi but it does mean you may have issues on certain channels.

Oh I would, and feather them afterward if they’re looking like touching the network cabling.

Yes, this is what I was talking about with my “kit vs. ‘Best of breed’” reply, except that list had lots of problem components that aren’t best of breed. The 920 cam is one work gave me for home use when the lockdown started and it’s appalling really, only just adequate for home use with the approximate reliability and picture quality of a potato. The 4K TV is a higher resolution than the aforementioned camera so unless you know you’re meeting with people who are going to be sending you a 4K picture stream while being happy to receive a 1080p stream back, I’d question that. The keyboard will go missing, they always do, which will cause frustration, the “PC of your choice” - needs to be the right choice for an always on room solution so not that easy a choice… I know budgets in education are squeezed but this is a real “buy cheap buy twice” thing for fixed meeting room setups.

We use the Teams Room System, where the room is managed by its own device. This can be an android device or a NUC-style device running a managed build of Windows IoT Enterprise. I’ve not come across the term “camera in Appliance mode” to describe any part of the Teams Rooms setup so not sure how to answer that part, sorry.

Yup, the whole thing works around the room having a teams meeting room licence, which includes exchange mailbox, teams itself, phone system (if you need that, it’s there) and Intune so it’s good to go. Essentially it’s then a room resource in exchange online. You invite it as you would any other person or resource, and it “understands” teams invites (as you’d expect!) but also zoom and webex ones. But you can also use proximity join, which is awesome, e.g. you go into the meeting room and it knows your laptop, tablet or phone is there via Bluetooth beaconing and lets you seamlessly transfer an ongoing meeting to the room or start one in the room that’s scheduled on your personal device/ calendar

Zoom and WebEx are supported natively and there’s also a facility to plug a laptop into the Logitech TAP (desktop meeting controller) to present whatever you like from the laptop screen. I can’t over emphasise enough how much user stress and service desk resources this has already saved, and we’ve not completed the rollout yet.

In the middle of rolling out 100+ of the Logitech Teams meeting room kits at work myself and thoroughly recommend the kits Paul has linked to. You can buy different sized “kits” for different sizes of rooms, so you shouldn’t need to worry about buying something over or under powered for your meeting space. You know everything in one of these kits is certified to work with Teams and will work together flawlessly, can be managed with the Logi Sync tool to handle firmware updates, etc. The reason I’m rolling out 100+ of these is that the previous attempt 2 years ago used mixed and matched “best of breed” individual components, so a top of the range camera from whoever that was, an amazing mic, superb speakers, etc. But they just didn’t play nicely together, required a ludicrous amount of “management overhead” as they all had their own interface, and were not certified to work with Teams. As such, I’d never recommend buying your own individual components. No matter how good they look on paper, or how much money it looks like you might save by buying this way.

This allows users write access to that field on every single computer object? Including servers and other objects that masquerade as compute account objects. A mischievous student could have a lot of fun with this. If you must use this hack, I’d strongly suggest you apply this change to specific workstation OUs, not the whole domain.

The person who brings a personal device in to work that they use for personal use only and never mingles this device and work is a blessing. They have cracked the one weird trick to not flushing their career down the tubes and resulting with the head/governors having to go on local news to talk about a staff member’s questionable university party impression of an elephant or “experiment” with black face being shown to the students because a friend linked it to them on Facebook. The person who uses their personal device instead of a work-provided device is begging for the above, or for you or the head to have to phone the ICO to report a data breach because of their stupidity. I’ve got no problem with personal devices, but it protects everyone if users are prevented from using them for work.

I am employed in a senior role by a global financial organisation, almost entirely with cloud products these days, and work in the way you describe. Literally 99.9% of everything I do is a template or a script under change and source control. But I still think that a solution to the OP’s current problem is a perfectly fine answer. There’s nothing wrong with solving today’s problems today and doing so is the quickest route to getting the OP able to backup their switch configs to something. Steve and I supplied that, and I’m perfectly happy with my answer. I actually agree with your overall point but I think you’re letting perfection be the enemy of good here.

You're not wrong but (without wishing to be disrespectful to the OP) I suspect that someone who's struggling to get a TFTP backup working at all needs to master the basics before going down this road. If we're talking about a more structured approach then HP/Aruba actually have a product available that will handle all this, allow you to schedule changes, collect monitoring data and remediate issues, install firmware out of hours, all that good stuff and that's probably where I'd be pointing people in an ideal world.

Agree with Steve. The command you present here will copy *to* running config, not backup your config. The command should look more like this template: copy < startup-config | running-config > tftp < ip-addr > < remote-file > For example, copy startup-config tftp 10.28.227.105 d:\configs\sw8200 will backup startup-config to a tftp server on 10.28.227.105, saving it to the path d:\configs\sw8200

A ransomware attack will probably encrypt all the attached disks so this won’t help you. You should be doing full backups of the server *and* SQL backups of the database to a proper backup device that isn’t attached/writeable directly from the server.

Re-imaging isn’t really a thing for Macs any more (I’d argue it shouldn’t be for Windows either, but you can at least make it work if you have to). Macs are designed to be restored to a fresh image if necessary, and then have software installed using MDM tools such as JAMF. You can absolutely deploy App Store apps with MDM tools, this is exactly what they are for. Ideally you’d be using Supervised devices and pushing VPP apps to them.

You need to do this part from the Office 365 exchange online portal. Hopefully you've set up the migration endpoint there, as you may need to do that too?

So is it failing to block this one site, or is it failing to block any sites and this just happens to be the only site you’ve tried to block so far.

Good. It’s about time that died.

As Free780 says, it really is a gamechanger. You're publishing your sites via Azure instead of directly to the internet and this greatly changes the amount of work you have to do and reduces the threat profile, compared to publishing a site to the world traditionally.

From the firewall perspective, you’re simply publishing a TLS-protected website over port 443. For the RDS gateway, if you’re going to isolate it in a DMZ, consider its needs to communicate with backend services and how that will work. However, you mention MFA. My preference for this is Azure MFA, which makes a lot of sense if you use Office 365. In that case you should use the Azure App Proxy to publish your RD Gateway website. Have a read of this: https://parveensingh.com/publish-rds-environment-with-azure-ad-application-proxy/. This will greatly simplify things imo.

It's very common in enterprise software and hardware. For the last big refresh I led for a college, the only thing the list price and the price we paid per AP had in common was the £ sign at the front of the quote. For a job I'm currently working on, we're several months into negotiations with suppliers and I don't think we've even talked about costs yet. On another project, cost of the software and hardware were very much a movable feast depending on what other services we purchased from the vendor. As @Norphy says above, you don't have to like it, but it's way things are. If you accept that you can start to use it the way I do now where I work, as just one more lever to pull when negotiating what my employer wants out of a deal.

I’m not sure why it would be blocked in the first place.

I can't believe people are ragging on intune for iOS while I'm sitting here managing literally thousands of iDevices globally for a financial institution without any issues of note being logged in the past 18 months. Guess I must just be lucky. JAMF is a better MDM in isolation and while it's expensive, it's money well spent if you need its features. Intune's strength is in its integration with Azure Conditional Access and Office 365. I'd argue that if you're using O365 this puts intune squarely in the picture. Where it does have weaknesses in the Apple world is its management of MacOS devices which is pretty weak. It is however perfectly possible to use JAMF to manage your MacOS devices, intune to manage your iOS devices (while saving money on JAMF licences for iOS) and integrate JAMF with intune to give your JAMF-managed devices the same integration with Azure and O365 that the intune-managed devices enjoy.

That’s strange - not had that experience myself. Not doubting your experience, just not seen it myself. I do think some apps that have not yet been converted to work natively on the M1 will struggle and not perform as well. Perhaps you have a lot of these apps in your workflow, where I definitely do not.

EnableMSStandardBlockedWords was deprecated in 2018. You can't find any documentation for it in Google because it's no longer a valid approach as far as MS are concerned.

Protecting it with a RD Gateway protected with https and a MFA token effectively puts the Remote Desktop session inside a SSL VPN protected with a hardware token and that’s close enough to a gold standard. If you can lock the MFA token to one you already use, hence why I suggest Azure Web Proxy if O365 is being used and is already protected by MFA, but I’ve also done this with Citrix and Okta, the users will find the experience relatively easy to use and it will be cost neutral as you already have the MFA infrastructure in place. I’d cheerfully recommend Citrix + Okta as a user friendly ‘alternative solution’ but it’s probably not within most educational establishments’ budgets right now.