Davit2005

Use another router/fw to terminate the Guest network, you will prob need ISP to add a route from the ISP router to the new router. Once you get that far you could also move potentially do the same and move other internal vlans to the same router/fw two and get back control :-)

Exclusive rights should not prevent anything working as far as I know. We used to redirect at a previous place and always un-cheched the box. We had a redirected desktop for students which they had only read access too which was also quite handy. 1 it stopped the saving to the desktop, 2 we were able to put links on the desktop.

Setting Display Name and email address to specific format will help though. Everywhere I have worked we have had specific format for students i.e. first inital, surname and intake year. There only comes a problem when 2 students with same initial, surname and the same intake year which I have had once.

Mostly you will need to enable promiscous mode to get these to work however that is a security risk and as I assume the WAN connection would be external. Not generally recommended to run firewall on VM TBH although many do including myself at one stage but only in a home environment.

I did the same at a previous employer and it was an ache. Building the physical desktops with OS, configuring network then you have to make sure that they don't connect the laptops to the wrong network etc. Some sort of virtual environment would be a whole lot better. But I'd agree at looking at the curriculum for said course as a first step.

Pretty sure You need the root cert not the server cert.

If you are totally cloud then prob little point. But if you have VOIP phones might be worth getting one to cover the firewall, Core switches and maybe some key areas. You certainly don't want servers shutting down improperly, especially if they have RAID with out battery backup. At a previous place we used to have long power cuts and it was getting to the stage where I'd be shutting down non-critical servers to prolong battery life. As others have said you want to size your UPS devices appropriately.

Get policies agreed by SMT. Policies for lost power supplies, damage, usage (i.e. only for the staff member use not siblings or other family members) etc.

The delays with TCP due to it's method means that most voice is UDP. But there should be no reason to open up RDP, SSH, DNS, HTTP, etc. If you have a application based firewall it would be easy to do. But opening up all ports still seems risky to me. That is like opening up all ports to a DC internally, yep there is user control too but you still have the port open.

Personally I'd go for a survey. You can have a lot of issues if there is too much signal in certain places. We had this with a new build, the builders put the points where they saw fit not where we asked. We had years of WiFi issues before we got a proper survey done and ended up turning off 30% of the APs because some were too close Why they do that I don't know. Not the first time either for us. One lot of builders even put the APs on top of metal cable trays

Personally I'd be a bit more cautious too. It only takes the perfect set of coincidences or clever social engineering with poor practices, look at the LastPass incident. If a 3rd party cannot be specific about the ports needed you have got to wonder about their knowledge of the product, an open policy looks like they do not know. We get this occasionally from app teams because the supplier does not know the product.

Some of these suppliers have no idea, it bugs the hell out of me. We get asked to add IP addresses to allowlists for incoming and I have to continually say we only work with firewall policies that are specific. From > To and application and/or port. Then it takes them a week (or more) to give us the correct info.

At the price point for edge switches you could likely get a spare or 2.

Been so long since I've relied on any 3rd party for admin of firewalls or switches. I don't think I could go bac to the days of waiting 3 months for the LA to make a firewall change, lol.

Some time back I did do this as a startup script. The script would check if the software did not exist before deploying. Will have a look to see if I can find it.

We use Aruba 2930's in loads of areas, most are 8 switches per stack with some been 4 due to them been setup before the VSF change with firmware. Also 2 locations with 5406 in a VSF admitedly I don't think we have these setup as LACP yet. I have setup 4 Aruba CX in a VSF stack in a lab with LACP uplinks and had no issues though :-)

If he was you wonder why his account was not disabled immediately, lol.

Really :-) We've had stacks for 7 years plus with no issues :-)

Sometimes if you cannot replicate you really need to see what they are doing when it happens.

Long term look at removing roaming profiles Are all settings once made by user not moving with them? Is it only effecting Outlook? Does it work OK for the same user on another machine?

Even hiring a car over 7 years back in UK was giving a code to the hire company so they could see the license for 21 days. Have not needed to do that when hiring car in Southern Ireland yet though, lol. https://www.gov.uk/view-driving-licence

Generally for filtering as requires the traffic to be decrypted by your filtering device i.e MITM. Of course there are other methods too.

Similar to what we did 8 years back. Jus store the SSL cert on a web server and provide a link on the captive portal. Other changes may need to be done.

Try opening PowerShell then run the script from the powershell window. Unless you put a delay in a script it will jus close.

Get into the habit of commenting what happens at each stage of the script. That is the one major bug bear I see with scripts found online. Then it is easy for people to one understand what that part of the script is doing and two backward engineer to modify/repair the script.