Koldov

Many thanks, I will give this a go (but might wait until the summer holidays now).

What about something like a 'Plasterboard Lifter/Drywall Lifter/Hoist'...?

Long story.... But essentially I wanted to remove IE11 from all the computers on site (not having the ADMX to disable it as a standalone browser in GPO)... So I messed with the remove in DISM as a start-up script, but it didn't actually remove IE11 from the computers (you could still use it fine), however it did remove it from 'Turn Windows Features On Or Off' and then any further attempts to remove it manually via PS or CMD failed as it it couldn't find it anymore! But I found I could add it back in and then remove it manually... So, I wanted to do the add-in to them all at once, but didn't want to make it worse as the remove start-up script went so badly... probably because I didn't do it correctly due to it not being the way it should be done and the correct services not being loaded on start-up.

Thanks, unfortunately I don't have anything like that, it was just easier in the end to remote into all the computers (doing it in batches per day) and run it. Lesson learnt... Everyday is a school day... Test, test, test.... etc.

Yeah it's one of the reasons I'm trying to get it split up into Hyper-V machines if anything ever needs to be moved onto a new machine quickly. Also for the many other benefits including checkpoints and restores... at the moment it's WSB to a USB, I can only imagine how painful that would be in a DR situation! Ah, I remember now, the NIC Team was due to WSUS hogging the bandwidth once a month as the updates were released... thinking of going with the 'Do not store update files locally; computers install from Microsoft Update' anyway, as there are only maybe 20 laptops, 1 ICT Suite and 10 admin PC's with an OK internet connection.

Got to say I feel it might be a bit of an overreaction if I'm honest... but I don't know the school or the probability of a student (or intruder) smashing windows to unlock the door... Get the site guys to put a better lock on (also one that only opens with a key from both sides), put a blind on the glass panel and a sign up saying 'History Resources' or similar outside...?

Not really got any further, but just had my suspicions confirmed.... Two teachers (one yesterday and one today) came to me with battery issues. Checked them and found both set to 'sleep on lid close', so no prizes for guessing what they do at the end of the day.

Thanks, it did cross my mind (can't remember why I did it in the first place now - possibly just because I could - maybe resilience/load balancing?) I don't think it gains anything from it speed wise as our old Cisco switches are only 1GBps at the core anyway... So NIC1 for the HOST and NIC2 for the VMs...?

Trying to start this journey and falling at the first hurdle... I teamed both the NICs in the server a few years ago, so which do I choose....? I'm presuming the team, but I don't want to mess anything up!

Yes, there was a discussion about that... the author seemed to think that it was negated by the fact that the update in question would have been superseded and therefore that 'should' mean that it is no longer needed (the superseding update should have replaced it).

OK, so it looks like I need to revisit this again... For some reason on a server restart, SOLUS decides it wants to download a patch and fails causing it to retry every few seconds (and since I did the latest Windows updates on Sunday morning it has been filling up my event log with thousands of errors)... The error is for SCHANNEL: A fatal alert was received from the remote endpoint. The TLS protocol defined fatal alert code is 70 Which Google says is: It means communication with the server was attempted using a recognized but unsupported TLS version. If your server is set to accept only communications using TLS 1.2 or newer, for example, then anything that tries to communicate via TLS 1.1 or lower will throw this error. Which is OK, if it does it once, realises it's a no-go and carries on with TLS 1.2 or higher, but it looks like this isn't happening.... Is this a problem with my server or with ESS/SOLUS...? I tried the suggestion from @eddyc and it did the trick again, but it's getting annoying! I downloaded the update/patch it was trying and it went through (but there was a brief 404 error) so the errors have stopped. Weird thing is I already have that patch downloaded, but think I tried it when the URL changed to ESS, so it must have got confused...

Is the AJTek script $60 per year? I'm no WSUS guru for sure and so I'm always looking to improve the WSUS server (for free) and recently looked into a few things and why completely random updates keep hanging around (for years)... From here (old post and mainly relating to W7/2008R2 SP1 systems so might not all be relevant): https://social.technet.microsoft.com/Forums/windowsserver/en-US/b02c04ef-a8ae-4568-aaff-fe182e854b29/wsus-declining-superseded-updates?forum=winserverwsus Something interesting to note: *VALID* updates are never deleted. What WSUS considers as valid is a bit more complicated I think.... The Server Cleanup Wizard does not do that. The SCW declines superseded updates, only if: The newest update is approved, and The superseded updates are Not Approved, and The superseded update has not been reported as NotInstalled (i.e. Needed) by any computer in the previous 30 days. [sNIP] At a minimum, the WSUS Admin must manually remove approvals from superseded updates so they will be eligible for declination by the Server Cleanup Wizard. (Note: As long as the WSUS Admin is removing the approval, it's trivial to go ahead and decline the update instead. The only advantage to using the SCW is that you also ensure a newer update is approved and that no client system is still reporting that update as needed.) It seems there doesn't appear to any mechanism natively in WSUS to 'unapprove' or decline superseded updates and SCW needs that to remove them. Looking at the wording: 1) Delete updates that are 'expired' and have not been 'approved' for 30 days or more and delete older update revisions that have not been approved for 30 days or more. 2) Delete update files that aren't needed by updates (see point 1 for why they won't be deleted). 3) Decline updates that aren't approved (see point 1) and have been expired by Microsoft (things like 'bad' updates I guess?). 4) Decline updates that have not been approved for 30 days or more, are not currently needed by any clients and are superseded by an approved update... Seems quite likely that SCW is actually NEVER going to clean-up much.... for some reason... Also mentioned here: https://social.technet.microsoft.com/Forums/en-US/24a1f880-61ff-459f-ac87-ffcf464eed91/how-to-delete-decline-update-from-wsus-server?forum=winserverwsus is a PS script which I have amended with the suggestion in the final post: [reflection.assembly]::LoadWithPartialName("Microsoft.UpdateServices.Administration") | Out-Null # Run From LocalHost $updateServer = [Microsoft.UpdateServices.Administration.AdminProxy]::getUpdateServer() $updateServer.GetUpdates() | ForEach-Object { if (($_.IsSuperseded -eq $true) -and ($_.IsApproved -eq $true)) { $_.Decline() $title = $_.Title Write-Host "Declining update: $title" } } $cleanupManager = $updateServer.GetCleanupManager() $scope = New-Object "Microsoft.UpdateServices.Administration.CleanupScope" $scope.CleanupUnneededContentFiles = $true $result = $cleanupManager.PerformCleanup($scope) $space = $result.DiskSpaceFreed Write-Host "Freed $space bytes." I thought I would run it on the off-chance it would do some good (and reading through the code thought it at least wouldn't do much damage) and it deleted an embarrassing amount of stuff the Clean-Up Wizard hadn't for whatever reason. YMMV & UAYOR obviously! It has ignored anything without a 'superseded' marker and there are still a few Office updates from as far back as 2015 hanging around (we are using Office 2016 though) and some other Windows updates from previous years for some reason (I might be brave and decline them manually though as I'm thinking as long as I've got the latest CU/SSU what else would I need?). I have actually toyed with the idea of choosing the options to not store the files locally at all and let them use WU (I'm presuming everything else would still work the same, so not actually sure what benefit there is having them on the local network if there were only a small (ish) amount of machines and had a decent internet connection?)....

Honestly there shouldn't be any need to attack or defend how it works... that's just how it works... might not be for everyone and there might be 'options', but basically it is what it is. It also depends where you are coming from, your experience and what sort of level of 'control' you want over everything. If you are used to doing everything yourself, you may find having to ask for every little change in a support request very frustrating (especially if you think you can do a better job and quicker). I've always found them to be accommodating and willing to sort out any issues where possible. Also, as an only IT tech, I find a lot of the LGfL stuff quite reassuring and helps me concentrate on the day to day. Plus we take advantage of most of the bundled software/services (Sophos, Malwarebytes, Meraki, Gridstore, Adobe CC and CISCO AnyConnect for VPN access).

You should be completely informed if this is a school you support? How was the decision made (or who decided on the move)? @PaddyNewman should be able to point you in the right direction. If you are supporting the school you will need to be very involved from the get-go as there are huge implications for the entire way the network runs and how you currently access services over the internet (with a whole new filtering set-up), NAT etc... You will need to have yourselves as nominated contacts set-up and access to the LGfL/Adept/Atomwide service/support portals. You will also need access to OTP tags. We were told we had to completely change our IP addressing scheme (which cost us support fees from our network provider), then were later told the old scheme could have been used (depends on clashes as you are in effect one big LGfL network with central routing/firewalls).

Might be overcomplicating things...? You need to find out what the current situation is with the DCs and the clients (I believe domain clients and other DCs just get their time natively without any other setting changes needed once the advertising authority DC is set - PDC Emulator/FMSO - by default). Run from CMD w32tm /query /source or w32tm /query /peers On everything to find out where they're getting their time from. Check your DCs for the settings (GPO): Computer Configuration > Policies > Administrative Templates > System > Windows Time Service or Regedit for: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet\Services \W32Time\... Especially the Key ...TimeProviders\NtpServer\Enabled 1 I did mine many years ago through the registry on the main DC as that was the first 'How To' guide I found (and I wasn't confident with GPO). Make sure it isn't hitting the firewall. EDIT: Sorry, just seen your last post...

This... This set-up has been rock solid for years, I know her inside and out, all the quirks, there is hardly a day I have to do more than a quick look over the Server Manager to see if anything is being weird (which is very, very rare - unless it's SIMS or an MS update)... it works OK and does everything it needs to do (which isn't much in a small school). Yes, I've had to change a couple of drives, but in all honesty I do appreciate not having to come in and fight fires or struggle with issues related to the server at least... I have enough of that with pupils/teachers... I think one my main issues is that I'm not really a 'poke the bear' type and try not to make work for myself... I like (need) low stress, no drama... But having said that I'm really not looking forward to the day when something goes 'pop' or we get some sort of Malware/Virus attack (plus the server OS only has a year to go) and so as others say, I know I need to have a better Back-Up, DR plan and splitting roles and Hyper-V should help me with that in the end.

This may be why it seems a little hit and miss as I've confused myself and been trying to use the GPO settings to do the heavy lifting, but I'm still trying to get my head around the reboot part... Does an install that requires a reboot actually force a reboot just with WSUS settings? I thought only the GPO could 'force' a restart, but the deadline in WSUS forced the install...? I don't have automatic approvals set up for anything other than Defender (because the mess MS made of the last few CUs) but I think you can set one on approval anyway? The default rule is there too but it only looks at critical and MS seem to change the categories a particular type of update is in - I have a Critical section that hasn't seen a Windows update since 2018, but now Office updates seem to be in there... CUs seem to have gone from Critical to Security since 2018 too.

TL;DR - just wondered if you force updates and how/when? Currently running WSUS and sitting here looking at the console with a large proportion of laptops with the following status: "1 update waiting for the computer to be restarted to complete installation" This is the June CU (released 14/06/2022)... I have tried forcing the installation at a certain time through GPO but this was hit and miss and was met with a fair amount of resistance from SLT for a variety of reasons (T&L disruption, end of day meetings, training, etc.), once or twice they have even reached the install time limit and just restarted at an inappropriate time... anyway I secretly stuck to my guns and they 'should' install at 15:30.... but this obviously isn't happening. Reasons for this I presume is that laptops are either being used at the time and then being put into standby (set to sleep on closing the lid) and they are obviously just doing this at the end of the day and running for the door instead of shutting them down (not that I blame them for that, but it really doesn't take that long - although I was 15 minutes late leaving yesterday waiting for an old spinning rust laptop to finish its updates - an old spare, 'just in case' from the cupboard that I cloned and stole the SSD from). I am thinking of setting a power config via GPO to shutdown on lid close and reminding them that by putting the laptop into standby it doesn't need Bitlocker to get right back into the login page.... and that WUs are for the security of the network and the data we hold and usually address vulnerabilities etc... Obviously there are a few TA laptops/spares/special use ones that are only used for an hour or so a day/week and they will always be a special case as they sometimes don't even have time to download or install the updates.

The firmware is currently: Software Version 7.4.150.0 (would new firmware require a licensed vendor/support account to download?). Yes, I thought that might be the case - won't be getting rid of IE11 on my PC yet, just in case anything else like this pops up! Management Via Wireless Enable Controller Management to be accessible from Wireless Clients Is ticked, but I'm on a wired PC anyway.

Literally £0 budget... I'm not in charge of it and have no say in what it is allocated to, anyway I've asked and most of it (if not all of £10k) has already been set aside for a new class set of iPads and various other shiny things important to T&L... Although I will put in a request to the Business Manager saying 2012R2 is EOL in October 2023 and so the OS needs to be upgraded (although might have to wait until next year now to have some allocated), plus all the benefits of VMs etc...

I haven't tried to do this for a long, long time... but I seem to remember being able to put the IP address of the WLC into a browser and pull up the Config web page for it. Just tried to do it and check an SSID had the correct Wi-Fi password set... and it is refusing to connect. Thought it might be a Chrome thing as Edge does the same... Trying HTTP and HTTPS gives slightly different warnings... Initially just refusing: This site can’t be reached XX.X.XXX.XXX refused to connect. Try: Checking the connection Checking the proxy and the firewall ERR_CONNECTION_REFUSED Then various warnings about: This site can’t provide a secure connection XX.X.XXX.XXX uses an unsupported protocol. ERR_SSL_VERSION_OR_CIPHER_MISMATCH Unsupported protocol The client and server don't support a common SSL protocol version or cipher suite. I can Telnet in through Putty, but I don't know enough Cisco Cli to do anything useful! EDIT: Got there in the end, good old IE just lets me click through all the warnings, but I can normally do this with Chrome as well... this time it is just refusing point blank! I wonder with the demise of IE and the fact that Chrome/Edge are dropping certain ciphers means the CISCO switches of a certain age are going to be more difficult to manage? EDIT 2: Just went and stood next to the visitor who was trying to get on to the 'guest' Wi-Fi and watched them type it in... it worked first time... Nothing wrong with the password...? What a surprise! Guess I just need to be standing near things to get them to work... It's a tough job, but someone has to do it...

It's an old DELL PowerEdge T420 single server in a very small rural Junior School, there's no money to throw at it... Obviously this is going to be a nightmare, but I really want to get this server up to at least 2019 host and split it into 2 VMs. Current server is on 2012R2 - SQL/SIMS/DNS/DC/FMSO, holds all the data/file shares... well just everything really! It uses WSB to a USB (not tested - I know... file restores OK though). Currently it runs: 1 x Intel® Xeon® CPU E5-2440 v2 @ 1.90GHz 32GB RAM PERC H310 2 x 300GB (15K SAS 6G AL13SXL300N) set in RAID 1 for C:\ OS 4 x 600GB (15K SAS 6G AL13SXL600N) set in RAID 10 split into 2, roughly 500GB each for D:\ SIMS and E:\ DATA Is it easier to P2V (but isn't that just going to make a VHDX of the whole server - which might be easier, but not what I really want?) or just create the 2 x HYPER-V servers and migrate SIMS to one (which I don't actually know how to do) and the DC to the other, then upgrade the host/demote etc...? I would upgrade the host first, but worried an in-place might do some damage to SIMS or the DC and it might be better for them to be on their own VMs first... In case you haven't guessed, I've never done anything like this and the worry of messing it up is just going to mean otherwise I'm going to leave it as is... forever...

Interesting theme, rather than the usual '98% of the population die' disaster scenario, only 2% of the population disappear (MCU 'Blip' style)... but it is still unnerving and gives a lot of scope for exploring the trauma in those it leaves behind. Hope it doesn't get silly... already a bit put off by the 'cult' members smoking (plot element/theme/visual cue) that conveys something which will all be explained in time I'm sure...

No idea, that's why I came to ask those who know (we have sharing outside of the org set to off). There must be massive safeguarding protections available in a 'made for education' platform (including protecting children from themselves... or each other)... no? Good shout, but if I go to that setting it says: "To apply these visibility settings, enable 'Contact sharing' in the sharing settings" Unfortunately, there it says: Directory settings Sharing settings Contact sharing Enable contact sharing OFF No idea what that means in practise.... do I have to enable contact sharing in order to hide them, or are they already hidden because it isn't enabled...?

I think it's only a first step before merging the 2 together, it's a bit like making a copy of the old Policy Definitions folder before you install and overwrite with the new ones (which we all do, right?)... "When the operating system collection is completed, merge any OS extension or application ADMX/ADML files into the new PolicyDefinitions folder. When this is finished, rename the current PolicyDefinitions folder to reflect that it's the previous version, such as PolicyDefinitions-1709. Then, rename the new folder (such as PolicyDefinitions-1803) to the production name. We suggest this approach as you can revert to the old folder in case you experience a severe problem with the new set of files. When you don't experience any problems with the new set of files, you can move the older PolicyDefinitions folder to an archive location outside sysvol folder."