mullet_man

Tomorrow is going to be D-day for a lot people. I've deployed out removing SMBv1 from all devices using this https://www.techwhisperer.ca/2017/03/04/disable-smb1-with-powershell-and-sccm/ Most devices are already patched with the March patch but there will be student devices which haven't been booted up in a while no doubt so need to get everything switched on tomorrow. Trouble is for everyone tomorrow, will be trying to ensure stuff is on and ready for patching while people are going to be using equipment. Fingers crossed for everyone tomorrow.

Hopefully none but would suspect its effected someone somewhere. Monday might be the day people are hit with potentially staff using unpatched laptops over the weekend and bringing them in to infect the rest of the network.

This looks perfect actually. https://www.techwhisperer.ca/2017/03/04/disable-smb1-with-powershell-and-sccm/

Perfect! Thanks. Will test over the rest of the weekend and deploy out ready for Monday.

Laziness and complete stupidity by the sounds of it. Must have gone like this Tech A : "Windows update is creating lots of errors" Tech B : "just disable it and the errors will go away" Haha

Ok thanks Arthur.

Is there guide on how best to disable using sccm?

I've blocked the internet macros for Office, but am interested in tightening things a lot more. I like the idea of blocking poweshell access to the internet etc. So am interested too. Does this blocking break anything?

Arthur will the MSI update previously installed versions? Or do they need uninstalling first?

Ok thanks for that, just wondering if that was the case.

I've not seen this mentioned but does this only effect users who are admins of their devices? E.g student devices would remain safe but still vulnerable?

I've always had Windows Updates configured to install for clients, I've also recently been working to ensure we update 3rd party stuff like Java, Flash etc more regularly. Hopefully this happening will stop the moaning of staff who insist on never restarting their laptops to complete updates.

Boggles the mind how companies can disable updates due to their being agreed limits on boot up/logon times.

Thanks everyone! Yep totally agree about getting the cheapest ones, we regulary have student ones broken but we also have a fair few of staff ones too.

Thanks snagrat I'll take a look.

Hi all, Can anyone recommend where they purchase replacement laptop screens from? I've used a company who have been great for years but in the few months have really gone off the boil. So am on the look out for somewhere else to purchase them from. Thanks

Sometimes the docks look fine but broken pins can be hard to spot

We are all Dell and have docks in our classrooms, have you checked the dock connector on the laptops? We've got a mixture of E5520, E5530, E5550 and E5570s and I've found a small amount of laptops that have a slightly different dock connector most have what looks like a black bit of protective plastic running down the middle of the connector and others don't have this and you can see the pins are more exposed. Anyway the moral of my story is laptops with this type of dock connector we've found that pins are more exposed and over time become misplaced and out of alignment and therefore won't work on the docks. I've had a bit of a battle with Dell over this issue. Also check for any broken pins on the dock itself as we've had some heavy handed staff who have managed to damage the docks and this can cause all sorts of issues including really serious ones such as blown motherboards we had one dock that had broken pins which was being used for a while before it was caught and had caused the motherboards to stop recognising the batteries.

Interesting. Am not sure what my approach is going to be for student devices, re-image or use SCCM to upgrade them.

Haha Woah that sounds like it will keep you busy!

And yes totally agree use MDT for your captures, i also use it for deployments too, find it really good after I got my head around it. Got MDT for OS and SCCM for apps, trying to keep OS image as slim as possible.

Bloody hell what software takes up 500gb? Here's me thinking CS6 was a bugger for taking up a lot of space. Interesting to see if 1703 improves login speeds for us, I haven't tested on a student device yet.

Have you double checked their is no wmi filters on the GPOs? Have you ran a gpresult on one of the clients and see if it's deffo picking up the WSUS settings? Can you ping the WSUS?

Have you got the latest WSUS patches installed? Am remembering having to install a patch at some point. Just checked now My WSUS version is 3.2.7600.226. And my pc which is 1703 is showing in the console and reported back a few hours ago.

Sorry you mentioned it is 1607, am fairly certain this is your issue. You'll know this is the problem if you check for updates on the client and see it get stuck at searching for updates or downloading updates but never installing them and then lose the updates and have to download them again.