Koldov

This is interesting to me as I had some recent issues with Outlook 2016 and connecting to what I think is an O365 account. I'm not sure if it is the same issue you're describing and it seems that authenticating is not the main issue as it DOES authenticate. The issue was that they needed to at all, because they certainly didn't in the same way previously. I am wondering if we are one of the 'lucky' tenants that hasn't been 'upgraded' to maybe modern auth or whatever it is they've moved to now...? We have a 3rd party email provider (who have set up a tenant in O365 and use various licenses ranging from A1 to Exchange Online).... bit of a mess really... Previously you could access email by providing your credentials in a little grey 'Win 95' style box through Outlook 2016. Unfortunately some (most) users tick 'remember me' and that is the last time they'll need to authenticate. I didn't do that and authenticated in that little box for all my accounts every time, but at some point a few months ago that little box didn't come up anymore... instead it took me to the webpage for the 3rd party email provider, I asked our provider if anything had changed in their set-up and got this reply: "Our technical team has looked into this, and unfortunately there isn’t much we can do about this because this pop-up is generated by a third-party application. In general, when a product in the Microsoft suite has to open a webpage like this it has a hard-coded 'backdoor' to use the MS owned web browser that existed when it was made. That means this is almost certainly using an old version of edge from before they switched it to be chromium based, which hasn't been updated for several years at this point. The popup is meant for authenticating and everything within Outlook will work as expected." It kind of made sense in some respects and not others... Anyway, I upgraded my machine to Office 2019 and then 2021 LTSC and the issue went away (not sure exactly why)...

Could you not just add XML to the file associations then, or are different people going to want to open them in different apps (and so easier to target with GPO)?

Meraki documentation is pretty thorough. I know you're probably looking for something simple as it can seem quite complicated/daunting, but is this what you're looking for: https://documentation.meraki.com/SM

Interesting... we have this for XML file type... Looking through the 'Choose a default app for each type of file' there are still loads of random file types associated with IE. A lot of the basic ones are covered by making Chrome default or IIRC installing after removing IE can also help. Going to 'Default apps > Set defaults by app > Internet Explorer > Manage', so there's a few I could change over, but some don't 'see' Chrome as an option to do it this way (.mht, .mhtml, .partial, .website, .MK, .RES).

You had me worried that I'd used the wrong one for a minute there... but it appears they both have the same 'note' at the bottom of the explanation. Probably just a copy/paste error by someone at MS...

Is the policy setting explanation for this ~GPO incorrect...? Note: Non-Microsoft applications with Windows 2000 or later certification are required to comply with this policy setting. Note: To create a list of allowed applications, click Show. In the Show Contents dialog box, in the Value column, type the application executable name (e.g., Winword.exe, Poledit.exe, Powerpnt.exe). EDIT: Does this also mess with Hyperlinks...?

Is there any way to disable printing from the application?

IE 11 is very much both 'findable and runnable' here, not sure if it depends on which version of Windows 10 (or 11) you are running but one thing I noticed in the prerequisites for the GPO setting 'Disable Internet Explorer 11 as a standalone browser' is that you have to have Edge installed... https://learn.microsoft.com/en-us/deployedge/edge-ie-disable-ie11 Prerequisites The following Windows updates and Microsoft Edge software are required: Windows updates Windows 10, version 21H1 or later Windows 10, version 2004; Windows Server version 2004; Windows 10, version 20H2; Windows Server version 20H2: KB4598291 or later Windows 10 version 1909: KB4598298 or later Windows Server 2019; Windows 10 Enterprise 2019 LTSC: KB4598296 or later Windows Server 2016; Windows 10 Enterprise 2016 LTSB: KB4601318 or later Windows 10 Enterprise 2015 LTSB: KB4601331 or later Windows 8.1; Windows Server 2012 R2: KB4601384 or later Windows Server 2012: KB4601348 or later Microsoft Edge Stable Channel We don't have Edge installed so maybe that is why.

Are there any credentials you have to pass to establish the authority to do this, or can you run this type of command on any email address?

Sorry, @mavhc I deleted the post as I found it just after I posted... So in Chrome > Click on the 'Extensions' jigsaw piece (top right in upper toolbar) > Choose uBlock Origin from the list of extensions > In the pop-up box hover over the 'power button' symbol for options... I take it you have a got a way to 'pin' the uBO shield for users then? EDIT: Does this update itself or is there something else that needs putting in?

If you are not running Windows 11, why use the latest ADMX that are for Windows 11...? What are you missing and why can't you just use the latest for your server version/Windows 10 clients ADMX...? Also, although prudent I don't think it's necessary to do a GPO backup while messing about with ADMX as IIRC I had it explained to me (on here I think) that one is just reading from the other (if your ADMX files go missing the GPOs don't change or disappear too, they just have nothing to read) I think in a few cases I've had where an ADMX setting has disappeared it just reverts itself to a reg entry. https://sdmsoftware.com/tips-tricks/understanding-the-role-of-admx-and-adm-files-in-group-policy/#:~:text=How%20Are%20ADMX%20Files%20Used%20by%20Group%20Policy%3F A few other threads on the subject of Windows 11 ADMX (didn't read them, just searched for ADMX): http://www.edugeek.net/forums/windows-11/228106-where-do-i-install-windows11-admx-files.html http://www.edugeek.net/forums/windows-11/227392-windows-11-gpo-compatibility.html http://www.edugeek.net/forums/windows-11/226409-group-polices-windows-11-a.html

Not really looked into it, but I don't think mine has, unfortunately... either that or Scottish Power can't read it as it was installed by another energy supplier...?

As @DrCheese rightly says, on a Domain the PDC should be set as an authoritative time server, all clients get their time from this DC. The PDC gets it's time from an external source such as the popular uk.pool.ntp.org It's not overly complicated but can seem a bit daunting, there are plenty of threads on here about it: http://www.edugeek.net/forums/windows-server-2019/229356-ntp-server-issues.html http://www.edugeek.net/forums/windows-server-2019/228381-ntp-gpo-workstations-not-listening.html If you have VMs http://www.edugeek.net/forums/windows-server-2012/223638-time-out-dc.html

We don't have a V2 'smart' meter (despite asking for one numerous times)... I know there are people with life saving equipment in their homes that cannot be turned off and many other reasons for higher than average energy usage.... but still... My issue with it is that those who might benefit as usual, are people who have higher usage in the first place (due to their lifestyle - although some people in the '1st World' don't see these things as luxuries - and I do get the point about living your life how you want - not many people enjoy sitting in the cold and dark to 'save the planet'). They might benefit from turning off their hot tub with full garden lighting/crypto mining server farm/cannabis factory/60 inch TVs in every room etc... and get paid for doing it (although they would probably be more likely to make more money from keeping 1 or 2 of those things going - or maybe not with energy prices as they are - unless they've tapped into a neighbour's supply). I've always been a minimal energy user, honestly apart from one clothes wash a week, one TV on in the evening, one dishwasher load a week, saving water from the (quick) shower, LED bulbs in every room, heating on the lowest setting and so on that has been even further reduced lately... I don't know what I could do to reduce it much more...

I recently had a bit of a revelation using WSUS in our environment, I don't know if it will help you with your current situation and as you've used WSUS before you will probably know all this... I haven't gone the SSL route due to knowing almost nothing about certificates (and hoping to avoid over complicating things) could you try without?: The WSUS server's SSL certificate must be imported into the client computers' Trusted Root CA store, or into the client computers' Automatic Update Service Trusted Root CA store if it exists. You must use the certificate store for the local computer. It may be a vulnerability, but one I think I can manage (probably famous last words)... I'm also running it on a SERVER 2012R2 instance and (mostly) LTSC clients (and wuauclt commands still work), so there might be something in a newer server OS that has extra TLS, SSL security...? But as there is no WSUS folder for the clients to connect to I might side-step that issue anyway when I upgrade it: Where is the WSUS content directory? The WSUS content directory, usually <%windir%>\WSUS\WSUSContent must have Full Control permission granted to the NT Authority\Network Service account. This permission is set by WSUS server setup when it creates the directory, but it is possible that your security software might reset this. I saw a lot of posts about WSUS and many people saying it was old tech and we should switch to WUfB, but I don't really have the time or inclination to start moving over to Azure or whatever it needs and I already had a working WSUS that has rarely caused any issues. What I wanted was (kind of) the best of both worlds and having just moved WSUS to a VM got tired of watching the limited disk space get eaten up even though I'd got all the settings sorted for minimal/necessary updates (obviously no drivers or extra software). I wanted full reporting from a familiar system and a way of controlling what update went out and when, with the option of update removal, deadlines etc. I also wanted the ability to have the updates download and install if the device was offsite (this takes some trial and error and only works if WSUS has informed the client that there is an update to download before it is taken offsite). So, as long as the client is aware of the update, at any time during the holidays it is connected to the internet it will update (which means I need to approve them at least the week before). The basics are all the same I think with only on or two minor tweaks, but essentially clients are 'managed' by WSUS and then download the update from Microsoft directly. All clients are in segregated groups and updates are approved for each group on subsequent days to avoid overloading the internet connection (only for CUs really, the little ones I approve for every computer as we're a small site). The GPO for each client still uses 'Client-side Targeting' to populate into WSUS and this is set in the WSUS Options > Computers > Use Group Policy or registry settings on computers. Specify intranet Microsoft update service location - Enabled Set the intranet update service for detecting updates: [url]http://WSUS.DOMAIN.com:8530[/url] Set the intranet statistics server: [url]http://WSUS.DOMAIN.com:8530[/url] Set the alternate download server: (example: [url]http://IntranetUpd01[/url]) Download files with no Url in the metadata if alternate download server is set. - Disabled As there is no download server mandated it goes to Windows Update over the internet. Interestingly I've just noticed that I'd set the Download Mode Enabled to Download Mode: Bypass (100)... Bypass (100) Bypass Delivery Optimization and use BITS, instead. You should only select this mode if you use WSUS and prefer to use BranchCache. You do not need to set this option if you are using Configuration Manager. If you want to disable peer-to-peer functionality, it's best to set DownloadMode to (0) or (99). So I might need to look into this but it's all working OK... It's not perfect and I am still plagued by teachers not restarting their laptops for weeks at a time, I have used the deadline of 'now' to push one or two important updates that needed urgent installation and got the complaints about restarts in the middle of lessons, so I tend to set it to 15:30 on Friday and then send an email saying if they haven't checked, installed and restarted by then it might restart unexpectedly on the Monday during a lesson and leave it to them... Computer Configuration (Enabled) Policies Administrative Templates Policy definitions (ADMX files) retrieved from the central store. Windows Components/Delivery Optimization Download Mode Enabled Download Mode: Bypass (100) Windows Components/Windows Update Allow Automatic Updates immediate installation Enabled Allow non-administrators to receive update notifications Enabled Allow updates to be downloaded automatically over metered connections Enabled Automatic Updates detection frequency Enabled Check for updates at the following interval (hours): 2 Policy Setting Comment Configure Automatic Updates Enabled Configure automatic updating: 4 - Auto download and schedule the install The following settings are only required and applicable if 4 is selected. Install during automatic maintenance Disabled Scheduled install day: 0 - Every day Scheduled install time: 13:00 If you have selected “4 – Auto download and schedule the install” for your scheduled install day and specified a schedule, you also have the option to limit updating to a weekly, bi-weekly or monthly occurrence, using the options below: Every week Disabled First week of the month Disabled Second week of the month Disabled Third week of the month Disabled Fourth week of the month Disabled Install updates for other Microsoft products Enabled Policy Setting Display options for update notifications Enabled Specify the update notifications display options : 0 (default) – Default OS Windows Update notifications Policy Setting Do not allow update deferral policies to cause scans against Windows Update Enabled Do not include drivers with Windows Updates Enabled Enable client-side targeting Enabled Target group name for this computer TEACHER LAPTOPS Policy Setting Comment Enabling Windows Update Power Management to automatically wake up the system to install scheduled updates Enabled Remove access to "Pause updates" feature Enabled Specify active hours range for auto-restarts Disabled Specify intranet Microsoft update service location Enabled Set the intranet update service for detecting updates: http://WSUSSERVER.DOMAIN.com:8530 Set the intranet statistics server: http://WSUSSERVER.DOMAIN.com:8530 Set the alternate download server: (example: http://IntranetUpd01) Download files with no Url in the metadata if alternate download server is set. Disabled Policy Setting Comment Turn on recommended updates via Automatic Updates Enabled Windows Components/Windows Update/Windows Update for Businesshide Policy Setting Comment Manage preview builds Disabled Select when Preview Builds and Feature Updates are received Disabled Select when Quality Updates are received Disabled

I admit (although we are now slightly off topic) I only skim read the first few bits of the link, but I got the impression that you actually need to be a 'failing' school to be considered for this funding? Like a faster network connection will miraculously improve your children's grades and that under achieving schools are being held back by I.T. (again with the tech bashing?)

OK, so I'm going to ask this again in the hope of attracting some quality answers instead of.... 'OMG 1607 LTSB! You are obviously a terrible IT tech!! How can your teachers teach without Paint 3D?' 'Just upgrade all the laptopzzzzz!!!!!!1' Anyway... TL;DR 1809 gets .NET 3.5, 4.7.2 and 4.8 CU 1607 only gets .NET 4.8 CU Why? Our WSUS has just received the latest CUs (but this has been going on for a long time now) and although we mainly run 1809 LTSC, there are a few die hard teachers that I can never get their laptop from to update so they are stuck on LTSB. Now, 1809 gets an update: 2022-11 Cumulative Update for .NET Framework 3.5, 4.7.2 and 4.8 for Windows 10 Version 1809 x64 (KB5020685) But 1607 only gets: 2022-11 Cumulative Update for .NET Framework 4.8 for Windows 10 Version 1607 for x64 (KB5020614) As far as I can see from WSUS the 1607 LTSB update for .NET 4.8 is never needed by any clients (because they don't have 4.8 installed) OK that's fair enough (they are on 4.7.2 as the latest SIMS update required it). However the 1809 LTSC update seems to include 3.5, 4.7.2 and 4.8... considering I believe 1809 comes with 4.7.2 as default why does it get older .NET version (3.5) updates and yet 1607 doesn't? I can't seem to find an update anywhere for .NET 4.7.2 & 1607 (but I can obviously get an 'all version' update for 1809)... I thought that it could be that the .NET 4.8 update for 1607 includes 3.5 & 4.7.2 but as it isn't in the description (as it is for 1809 and no 1607 clients seem to need it, I doubt it.

Yes, of course, but I'm thinking maybe in the developers mind mp3 wouldn't have been the main choice when it came to recording an audio file and emailing it. I've found out with things like Audacity that functionality doesn't just come ready out of the box (needing Lame). Plus I'm not sure how old the software is doing the recording... I'm not saying they'd go to the extreme of a lossless audio codec for 'quality' or one that might rely on 3rd party/conversion or licensing. .wav just seems the obvious choice for recording audio, I knew there were different qualities but hadn't looked into different encodings

It is being generated by our phone system (3rd party provider). I can ask the question but I'd bet that it records in .wav for quality and can't do the conversion. The strange thing is why the OWA/o365 application can't preview a .wav but can for an .mp3 (I would've thought .wav was a more universal file type/format)...?

Our admin/receptionist has just phoned down to say that she can no longer play voicemail files from her email like she used to... Obviously in full Outlook there are more options (preview/open/save as), but she is using OWA/O365 and the option doesn't seem to be there. The only option now is for her to save it first (either download or OneDrive). I'm not sure if it the 'open/play' option ever was there or when it changed (the user is a bit vague about the details), I've had a quick look and can't immediately see any settings that enable or disable this function.

Thanks for the offer! I will see how this all pans out before jumping (or if the teacher manages to complain to the Head enough - whichever comes first)... I did put SSDs in all of the computers and upgraded the RAM, but as this is an online platform (Purple Mash) and they are processing the data(?) I'd agree I'm not sure they are the issue. I'm just trying to get my head around if there actually is a problem, I didn't think it was considering many places don't have massive internet connections and this has only just become an issue (and just for one teacher). Cisco also seem to still do 10/100 switches in their 1000 Series switch line (for legacy compatibility), so even that is still a thing. The LGfL graphs are a bit hard to read but we don't seem to be reaching even 100Mbps outgoing more than 1 or 2 times a day, so it isn't like we're saturating the connection or anything.

I'm pretty sure the answer will be yes, but I've got to ask as I am receiving complaints from a particular teacher. However only one teacher and the work needed to placate just one teacher seems to be inordinate. This is the sort of teacher that thinks everything is too slow (especially their laptop - same spec as everyone else - wants to hotspot her phone to get to essential teaching resources etc. Also wonders why we don't just go EE full fibre broadband like they have at home because that's really fast)... I've spoken to a few other teachers who don't seem to have a problem... We are on an LGfL/Virgin Media connection and according to LGfL we should get something like 200 Mbps but in practise on a normal day I get around 100+ Mbps on Fast.com (I know that is actually slow compared to most of you, but we are a small school with minimum internet needs). The details are class of 30 in the ICT Suite on very old Dell Optiplex 780 desktop computers, but as they rarely do more than a Word document or some online resource I'm not sure this is where the 'problem' is. The children are using Purple Mash (online platform) to do things like coding and the teacher says the children have issues saving their work. Just as a disclaimer, networking is not my strong suit... Set-up is a bit weird as it came from the BSF fund and for some reason half the suite is wired to a cab in the room (with fibre to the main switch room) and the other half is wired straight to patch panels in the main switch room (all Cat6). These are wired into Cisco 2960 series switches and therefore only capable of 10/100 (for years our servers were wired into one of these)... Yes, I know we are well overdue an upgrade, but it will probably mean completely redoing the whole network and small school/small budget... We are a total CISCO shop, from the switches to the APs, so I guess any suggested 'improvements' should bear that in mind (also we will have to pay someone to come in and do any work).

As has been said, if your projector can accept composite (RCA) video it should work just like connecting to a TV: https://www.nintendo.co.uk/Support/Wii/Setup-amp-Connect/Connecting-to-a-TV-VCR-HiFi/Connecting-to-a-Television/Connecting-to-a-Television-244057.html Audio to speakers. I did it once years ago, we have a classic whiteboard/speakers set-up at the front of the class so Wii goes on a classroom table under the projector, luckily I had long audio cable back through the ceiling to the front of class and the sensor cable was long enough to go through there as well (we also had power from a double socket in the ceiling (?)... iirc... Might be better if you could keep it all at the front by the whiteboard and just extend the composite video cable to the projector though...? We have some classrooms with an old multi AV faceplate on the the trunking and some of these still have composite cables run to the projectors.

This thread might help... http://www.edugeek.net/forums/internet-related-filtering-firewall/229505-bbc-blocking-outside-uk-solved-contacting-them.html

I got a dog as a surprise, but my wife said "absolutely no way!" So as sad as I am, I'm going to have to say goodbye.... Free to a good home: One loving owner Housetrained (mostly) Friendly (but can get aggressive over food) Doesn't shed hair much (mostly in the bath plughole) Spends a lot of time in bed or on the sofa watching the T.V. Usually calm but can be playful if a bit boisterous at times (especially after a few drinks) 37 years old Called Rachael Cooks a mean Chilli