ChrisMiles

Can they create one if they choose a local path like C:\Users\itstudent ? Also, anything in File Server Resource Manager blocking it?

It is most likely forced on via group policy. You normally can't override group policy settings in the GUI.

Can't you just block internet at your firewall/filter?

Should hopefully work for you.

The deletion is done by windows, if it leaves a folder it'll be because theres open file locks. Do profile cleaning after a fresh reboot (in the startup script ideally) to avoid this.

That could happen if you are not running PowerShell or the ISE as Administrator, deleting profiles requires elevated permissions. It may also be trying to delete a profile that is in use (yours for example) so you may want to add a check for that: Get-WMIObject -Class Win32_UserProfile | Where-Object { $_.Loaded -ine "True" -and $_.Special -ine "True" -and $_.LocalPath -ine "C:\Users\Administrator" -and $_.LocalPath -ine "C:\Users\Public" -and $_.LocalPath -ine "C:\Users\Default"} | ForEach-Object { $_.Delete() }

I know this isn't helpful but DPM is a nightmare, we struggled with it for 2 years before biting the dust and getting Veeam. Never looked back. The other backups may have been removed from the catalog but you should still be able to reimport them. You want to check your retention settings also.

Some problems here, you can't delete profiles using Remove-WmiObject, you need to call the delete method. Get-WMIObject -Class Win32_UserProfile | Where-Object { $_.Special -ine "True" -and $_.LocalPath -ine "C:\Users\Administrator" -and $_.LocalPath -ine "C:\Users\Public" -and $_.LocalPath -ine "C:\Users\Default"} | ForEach-Object { $_.Delete() } If you want something more complete, I wrote a profile management routine in our startup script that removes student profiles, mandatory, corrupt and temporary profiles, but leaves staff profiles intact. It also uses a AD variable to allow you to purge specific profiles across the network for when roaming profiles need resetting. You can find it here: http://www.edugeek.net/forums/windows-10/204731-script-deleting-user-profiles-folders.html#post1748036

We deploy trust-e using RemoteApp so we don't have to bother with their ridiculous charges. If I was you though I'd do a security review of it as soon as possible. Nationwide's default setup is some of the least secure installs I've ever come across. Assuming you don't have anything brand new I wouldn't mind a small wager I can tell you the username/password used to connect to your cashless database, the vnc password for all your tills, at least 1 login and password for trust-e. The sort of thing any enterprising student could use to edit balances etc.

This exert from our powershell startup script takes care of this. We also have a field in AD that we can set with a data to force delete a user's profile before a certain date when their profile needs resetting for any reason. You won't probably be able to copy and paste this as is but you could adapt it to your uses. It's very reliable, has run here with no issues for 2 years. ###################################################################################################################################################### ## PERFORM USER PROFILE CLEANUP ## ###################################################################################################################################################### ## Clean up user profiles, remove expired profiles and invalid directories. ## ###################################################################################################################################################### Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Performing user profile cleanup..." # Read user profiles from WMI Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Reading user profile information from WMI..." [array]$profiles = Get-WmiObject -Class Win32_UserProfile Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - $($profiles.Count) user profiles found." # Loop through each profile foreach ($profile in $profiles) { try { # If the profile is loaded and currently in use or a special # profile used by windows we should skip it. if ($profile.Loaded -ieq "True" -or $profile.Special -ieq "True" -or $profile.LocalPath.EndsWith("\\User")) { continue; } # If the profile has status 1 it is a temporary profile created # when a roaming profile was not available and should be deleted if ($profile.Status -eq 1) { Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Purging profile at '$($profile.LocalPath)' because the value of Status is 1 (Temporary)..." $profile.Delete() continue; } # If the profile has status 4 it is a mandatory profile and # can be deleted to free up space if ($profile.Status -eq 4) { Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Purging profile at '$($profile.LocalPath)' because the value of Status is 4 (Mandatory)..." $profile.Delete() continue; } # If the profile has status 8 windows believes it to be # corrupt and should be deleted if ($profile.Status -eq 8) { Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Purging profile at '$($profile.LocalPath)' because the value of Status is 8 (Corrupted)..." $profile.Delete() continue; } # Search Active Directory for the owner of this profile $user = ([adsisearcher]"(objectSid=$($profile.SID))").FindOne() # If the owner no longer exists the profile should be deleted if ($user -eq $null) { Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Purging profile at '$($profile.LocalPath)' because the user with SID '$($profile.SID)' no longer exists..." $profile.Delete() continue; } # If the profile has status 0 it is most likely a local profile created # when a user logs in without a roaming profile. We should check if this # profile belongs to a student user, and if so delete it. if ($profile.Status -eq 0 -and $user.Properties.description -ne $null -and $user.Properties.description[0].Contains("Students")) { Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Purging profile at '$($profile.LocalPath)' because the value of Status is 0 (Local) and the owner '$($user.Properties.samaccountname)' is a student..." $profile.Delete() continue; } # If the profile's folder has a domain suffix it should be deleted if ((Split-Path -Leaf $profile.LocalPath) -ine $user.Properties.samaccountname) { Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Purging profile at '$($profile.LocalPath)' because the folder name '$(Split-Path -Leaf $profile.LocalPath)' does not match the value of SamAccountName '$($user.Properties.samaccountname)'..." $profile.Delete() continue; } # Get the date and time the profile was last used if ($profile.LastUseTime -ne $null) { $lastUsedDateTime = $profile.ConvertToDateTime($profile.LastUseTime) } elseif ($profile.LastUseUploadTime -ne $null) { $lastUsedDateTime = $profile.ConvertToDateTime($profile.LastUploadTime) } else { $lastUsedDateTime = [DateTime]::MinValue } # Parse the expiration date from the owner user's Active Directory # Account and if it is after the time the profile was last used # the profile should be deleted [long]$profileExpiryTime = 0 if ([long]::TryParse($user.Properties.info, [ref] $profileExpiryTime) -and $lastUsedDateTime -le [datetime]$profileExpiryTime) { Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Purging profile at '$($profile.LocalPath)' because the value of LastUploadTime '$lastUsedDateTime' is less than the value of ProfileExpiryTime '$([datetime]$profileExpiryTime)'..." $profile.Delete() continue; } [datetime]$nowDateTime = Get-Date [timespan]$profileExpiryAge = [timespan]::FromDays(14) if (($nowDateTime - $lastUsedDateTime) -gt $profileExpiryAge) { Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Purging profile at '$($profile.LocalPath)' because the time difference between now '$nowDateTime' and the value of LastUploadTime '$lastUsedDateTime' is greater than the value of ProfileExpiryAge '$($profileExpiryAge)'..." $profile.Delete() continue; } } catch { Write-Error "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Error: $_" } } # Get a list of folders in the profile directory excluding those # known to be a normal part of Windows Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Reading profile folder information..." [array]$folders = Get-ChildItem -Path C:\Users -Exclude Public, "All Users", Default, "Default User" | Where-Object { $_.PSIsContainer } Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - $($folders.Count) profile folders found." # Loop through each folder foreach ($folder in $folders) { try { # If the folder is not associated with a user profile # then the folder should be deleted. if (($profiles | Select-Object -ExpandProperty LocalPath) -inotcontains $folder.FullName) { Write-Output "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Purging folder at '$($folder.FullName)' because it is not associated with any user profiles..." $folder.Delete($true) } } catch { Write-Error "$(Get-Date -Format "yyyy-MM-dd HH:mm:ss") - Error: $_" } }

Shut down is by far the safest option. Windows will safely close open files, stop services and save your data. Save state can cause so many things to fail, especially if using non-production checkpoints, but even then. Consider that time still passes so when resuming a server, whatever it was just in the middle of doing inexplicably took x hours instead of a few ms. There's also file locks, database connections, and other things which can easily get dropped. You only have 2 servers so shutting down and booting up isn't going to take much time. IMO the LA is taking a huge risk, especially with SQL servers and the like. Found this Microsoft Article that might help you: https://docs.microsoft.com/en-us/windows-server/virtualization/hyper-v/best-practices-analyzer/avoid-using-checkpoints-on-a-virtual-machine-server-workload-production

This ^ Like you all, I've been asked this and gotten very little out of using the report feature (although I have gotten some removed). The best thing you can do is just get your students to leave a review as a matter of course. Over time, a couple of bad reviews won't matter.

There isn't anything that does this. Best I can think of is to use firewall/filtering logs to see who's using it but thats pretty terrible.

Do you mind if I ask why you're selling and what you're replacing it with? I ask because we just put in a Ruckus system and I'm wondering if there are any issues.

Thank you for explaining. However, am I wrong in thinking that they would still need to find out the password and log into one machine before they could abuse this? How might they go about doing that without the password? Wouldn't most attack vectors be just as effective on domain accounts? Any of the attacks that allow changing/resetting the password would change the hash wouldn't they? And what do you do if you need to use the local admin account occasionally? Do you maintain a list of random passwords for each machine, do you use a pattern/calculation based on some other aspect of the machine?

I don't agree with this. Having the same Local Admin password is no less secure than having a domain admin account at all. Furthermore, in a properly configured domain no private information should be stored on local machines. Choose a secure password. It's easy to change on mass using GPO as needed. I agree with the scripting suggestion. I recently built a brand new 2016 domain on Hyper-V and had everything down to software installs scripted into powershell and command lines and as a result I was able to rebuild it from scratch several times in minutes. There are other things I'd suggest: Use a private sub domain of your external domain such as ad.myschool.org, don't use .local or .internal or anything similar as you cant get SSL certificates for them. Create a new domain admin account, set the Administrator account with a random secure password then disable it and never use it again. Consider future licensing costs when working out how to split/combine certain roles between servers. Don't use domain admin accounts for services, syncs and LDAP access just because it's easy. Don't use service accounts on more than one service. Make sure to always employ the principal of least privilege. Dont make teachers local admins no matter how much they moan about it. Test test test test test!

@Wave9_Lee Maybe I could talk with you about what options you offer?

It has come to that time when I need to consider renewing our web filtering solution, however, this time it is complicated. We are currently with BLOXX, but they have been bought out and seem to be stopping their hardware devices. We originally went with BLOXX because of the reporting capabilities (which turned out not to be the best) and the on-the-fly categorisation of websites, which, at the time seemed to be unique to BLOXX. It's been quite a long time since I looked at alternatives and I'm not sure of the available options, so was wondering if people could recommend systems they have used. We need: - Transparent proxy capability - having to manually set proxies is a real nono - AD single sign on that detects when you log off properly too - Easy to read reporting capabilities that produce stuff that leadership types can understand - Support for multiple vlans with different filtering policies We would very much also like: - On-the-fly categorisation - Something that can act as a gateway/firewall with UTM to replace and existing sonicwall device We are a MAT with ~2000 students. If you have any suggestions, advice or tips I would very much appreciate it. Thanks.

That's not it, but maybe it doesn't record it in the event log in this case. FileLoadException is thrown when a managed assembly is found but cannot be loaded. Which means pulsar isn't able to load one or more of it's library files (or perhaps .NET Framework libraries). This could be a permissions issue. When you said .NET Framework is installed, did you install it from server manage features? Also what kind of user are you testing it from? Admin/user? Local/domain?

Could you post the full exception stack, as this should indicate what file it's failing to load.

I sign scripts using a code-signing certificate issued from our internal CA so it works for everyone automatically. We've had no problems at all with powershell portability. You can check for and import modules as part of your scripts if its a problem. Execution policies should all be set centrally by group policy anyway, not sure what you mean about network drives, powershell has no issues with UNC paths that I know about.

Thats correct, it will show you how protected you are and whether you need additional firmware updates.

Looks right to me, step 3 isn't needed on clients, but the rest is.

Please can you explain a little more about what you want to achieve? If you want to allow students to easily see how much space they're using then a mapped drive + disk quota will show them.

Here: https://support.microsoft.com/en-us/help/4072698/windows-server-guidance-to-protect-against-the-speculative-execution