Oaktech

But anyone using the system should have signed an AUP thus saying that they're OK with being censored/monitored.

I'm using o365 at one site and exchange 2010 at the other. I'm going to do a cutover in the summer, and I've clearly read the same articles. At the moment we don't use any PRF files. I'm given to understand I can't sync two AD environments with one tenant, so until I do the full migration and deprecate the AD environment that has the exchange server in it I can't use Sync. I've not found a way to use a PRF with Office365. PRF files need the server hardcoded into them, which is not possible when your server may change hourly for fault tolerance and load balancing - however, I've discovered Outlook ZCE... https://blogs.technet.microsoft.com/outlooking/2015/10/30/zeroconfigexchange-automating-the-creation-of-an-outlook-profile-for-exchange-online-accounts-and-exchange-on-premises-environments/

Have you tried from a 1703/1709 machine with RSAT?

Any useful information in here? https://msdn.microsoft.com/en-us/library/aa384372(v=vs.85).aspx

The closest I can find seems to be something about a version issue between the RSAT tools on the workstation and the Win RM on the server. Maybe try a reinstall of the latest greatest RSAT tools?

I'll keep googling with you!

Is it half term for you next week?

When was the last time it was restarted for updates? I wonder if you've got a CREDSSP error?

Define lost... Failed backup followed by crypto infection unrecoverable data type lost? Or handed over to a courier in the required (unencrypted) format for an exam board and never delivered type lost? I think you would be open to legal action in the first case but it would not be a reportable incident to the ICO, you haven't lost the data in a way that would land it in the hands of an unauthorised person. The second case your DPO will probably be burnt at the stake and a huge can of worms will be opened.

Access Based Enumeration on the servers and then these GPO settings: Computer Config/Admin Templates/Windows Components/Search Allow Cortana: Disabled Allow Cortana above lock screen: Disabled Allow search and Cortana to use location: Disabled Do not allow web search: Enabled Don't search the web or display web results in Search: Enabled Don't search the web or display web results in Search over metered connections: Enabled You can Banjax cortana completely but this also breaks start menu search... Import-Module -DisableNameChecking \\dc1\netlogon\take-own.psm1 # Update this with the location you have placed the psm1 module do {} until (Elevate-Privileges SeTakeOwnershipPrivilege) $packages = @( # "Browser" # Removes edge browser # "ContactSupport" # Removes contact support # "Xbox" # Removes remaining xbox information not removed by remove apps # "Microsoft-PPIProjection-Package" # Removes miracast # "Microsoft-Windows-Holographic-Desktop" # Removes VR Viewer #"cortana" #this removes Cortana, but also the ability to search the start menu ) foreach ($package in $packages) { $pkgs = (ls "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Component Based Servicing\Packages" | where Name -Like "*$package*") foreach ($pkg in $pkgs) { $pkgname = $pkg.Name.split('\')[-1] Takeown-Registry($pkg.Name) Takeown-Registry($pkg.Name + "\Owners") Set-ItemProperty -Path ("HKLM:" + $pkg.Name.Substring(18)) -Name Visibility -Value 1 New-ItemProperty -Path ("HKLM:" + $pkg.Name.Substring(18)) -Name DefVis -PropertyType DWord -Value 2 Remove-Item -Path ("HKLM:" + $pkg.Name.Substring(18) + "\Owners") dism.exe /Online /Remove-Package /PackageName:$pkgname /NoRestart } } Takeown Module referenced above (save as .psm1): function Takeown-Registry($key) { # TODO does not work for all root keys yet switch ($key.split('\')[0]) { "HKEY_CLASSES_ROOT" { $reg = [Microsoft.Win32.Registry]::ClassesRoot $key = $key.substring(18) } "HKEY_CURRENT_USER" { $reg = [Microsoft.Win32.Registry]::CurrentUser $key = $key.substring(18) } "HKEY_LOCAL_MACHINE" { $reg = [Microsoft.Win32.Registry]::LocalMachine $key = $key.substring(19) } } # get administraor group $admins = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544") $admins = $admins.Translate([system.Security.Principal.NTAccount]) # set owner $key = $reg.OpenSubKey($key, "ReadWriteSubTree", "TakeOwnership") $acl = $key.GetAccessControl() $acl.SetOwner($admins) $key.SetAccessControl($acl) # set FullControl $acl = $key.GetAccessControl() $rule = New-Object System.Security.AccessControl.RegistryAccessRule($admins, "FullControl", "Allow") $acl.SetAccessRule($rule) $key.SetAccessControl($acl) } function Takeown-File($path) { takeown.exe /A /F $path $acl = Get-Acl $path # get administraor group $admins = New-Object System.Security.Principal.SecurityIdentifier("S-1-5-32-544") $admins = $admins.Translate([system.Security.Principal.NTAccount]) # add NT Authority\SYSTEM $rule = New-Object System.Security.AccessControl.FileSystemAccessRule($admins, "FullControl", "None", "None", "Allow") $acl.AddAccessRule($rule) Set-Acl -Path $path -AclObject $acl } function Takeown-Folder($path) { Takeown-File $path foreach ($item in Get-ChildItem $path) { if (Test-Path $item -PathType Container) { Takeown-Folder $item.FullName } else { Takeown-File $item.FullName } } } function Elevate-Privileges { param($Privilege) $Definition = @" using System; using System.Runtime.InteropServices; public class AdjPriv { [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] internal static extern bool AdjustTokenPrivileges(IntPtr htok, bool disall, ref TokPriv1Luid newst, int len, IntPtr prev, IntPtr rele); [DllImport("advapi32.dll", ExactSpelling = true, SetLastError = true)] internal static extern bool OpenProcessToken(IntPtr h, int acc, ref IntPtr phtok); [DllImport("advapi32.dll", SetLastError = true)] internal static extern bool LookupPrivilegeValue(string host, string name, ref long pluid); [structLayout(LayoutKind.Sequential, Pack = 1)] internal struct TokPriv1Luid { public int Count; public long Luid; public int Attr; } internal const int SE_PRIVILEGE_ENABLED = 0x00000002; internal const int TOKEN_QUERY = 0x00000008; internal const int TOKEN_ADJUST_PRIVILEGES = 0x00000020; public static bool EnablePrivilege(long processHandle, string privilege) { bool retVal; TokPriv1Luid tp; IntPtr hproc = new IntPtr(processHandle); IntPtr htok = IntPtr.Zero; retVal = OpenProcessToken(hproc, TOKEN_ADJUST_PRIVILEGES | TOKEN_QUERY, ref htok); tp.Count = 1; tp.Luid = 0; tp.Attr = SE_PRIVILEGE_ENABLED; retVal = LookupPrivilegeValue(null, privilege, ref tp.Luid); retVal = AdjustTokenPrivileges(htok, false, ref tp, 0, IntPtr.Zero, IntPtr.Zero); return retVal; } } "@ $ProcessHandle = (Get-Process -id $pid).Handle $type = Add-Type $definition -PassThru $type[0]::EnablePrivilege($processHandle, $Privilege) }

Good point - although here those forms are in a central location, Sickness, Leave of Absence, expenses, eyetest claim, that sort of thing are in a stack of drawers in the staff room. Illness should follow a process: You come back after an illness, a reminder email to fill the form in will have already been sent to you with a form attached, you can either fill in and email back - it's a word document - or you can print and hand over, or you take one out of the forms trays, fill it in and hand it directly to HR. If the process in the staff handbook is followed they shouldn't go near a pigeon hole. Having said all of that, I'm going to mention to the HOS that he should be putting LOA requests in envelopes not just dumping them back in trays. If HR do the form it's folded in an envelope, if the HOS does them then he's a bit lax.

Payslips are sealed, general correspondence is sealed, pigeon holes are not in a public area and not an area that kids can readily access (mag lock door). That being said, I believe very sensitive correspondance such as redundancy notices, termination of contract etc are handed over personally.

Apparently it has to be done by UPN because the photographers who come in to take the yearbook photos (who have also been vetted for GDPR complaince and included in our supplier data map) have special software that automagically ties up the name to the UPN and names the file as it is taken. It's mainly for MIS photos but they use the same system for the yearbook.

We're doing this right now... * Parents have explicitly consented to the child being included and that is on file for posterity * Printers have been asked for, and have responded with, a GDPR compliance statement. * We've additionally asked for confirmation that after the print run is complete the printers will have deleted the data from their system. * We've emailed them a link to a onedrive location, requiring a known MS ID, with a password protected spreadsheet and an encrypted zip file of photos in it. The photos are not named, they're labelled by UPN, the UPN is in the spreadsheet and we've phoned through the passwords - they aren't the same. * Once the printers have confirmed they have downloaded the data we remove it from onedrive - it's still on our system should we need it. How did we do?

Signed, understood and on file before their fingers touch a single piece of school owned electronics.

Step-by-Step guide to rename Active Directory Domain Name - RebelAdmin I'm going to do it next summer...

Access here is given once the AUP is signed and not before. The AUP covers what is and isn't OK and has recently been updated to reflect any changes (there weren't many) caused by GDPR. Once that has been signed the staff are legally bound to behave themselves whether they are in contract or not.

Yeah, admin tools is a folder not an app. I'm dealing with those by creating a permissions GPO (Computer Configuration\Policies\Windows Settings\Security Settings\File System) that changes the permissions on. C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows PowerShell %SystemRoot%\System32\control.exe %SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe to the following: Allow APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES Read and Execute This folder, subfolders and files Allow NT AUTHORITY\SYSTEM Full Control This folder, subfolders and files Allow BUILTIN\Administrators Full Control This folder, subfolders and files and disables inheritance from parent. This removes the 'everyone - read' capability and with that removed in our testing it doesn't create the folders in the new user. The stuff above bans everyone except admin users from accessing control panel. If you need to allow access to control panel items, except certain items, then you might want to see if the option below helps you... https://www.maketecheasier.com/restrict-administrative-tools-access-windows/

+1 for the broadcom issue. https://www.dell.com/support/article/uk/en/ukbsdt1/sln132131/windows-server-slow-network-performance-on-hyper-v-virtual-machines-with-virtual-machine-queue-vmq-enabled?lang=en

Worth also mentioning that the nursery I seem to accidentally be supporting also now have a Gapps domain which they use for management.

Yes. And FYI Gemalto don't actually recognise Edge as a product. Gemalto is the most god forsaken software I've ever worked with. And I've done bulk installs of Adobe products. There is no meaningful support. If you have a problem Gemalto blame the bank and the bank blame Gemalto and eventually both of them blame the fact that it's not a standalone machine with no domain, no policies and UAC turned off with full admin access. FML.

It'll be function key drivers from the manufacturer. They may have been uninstalled during the upgrade. I'd check out the manufacturers website. Toshiba seems particularly bad for this.

I've done exactly this for my Son's nursery - they know I'm IT so they asked me to upgrade their tablet fleet and not break the bank. They had a set of 5x 10" Samsung tab3 on 4.4.2 and 2x 7" tab2 which were getting slow and unreliable (I'd replaced screens and charging ports and a battery for them). I got them: 2x Buy Lenovo Tab3 Essential 7 Inch 8GB Tablet - Black | Tablets | Argos 5x Buy Lenovo Tab 3 10.1 Inch 16GB Tablet - Black | Tablets | Argos (which at the time were on offer at £99.99)

Two scripts and a PS module. I run it at build time as part of an SCCM task sequence and then as a startup task applied by GPO to ensure nothing sneaks back in as an update. https://1drv.ms/f/s!AkzDYVebVuvGihkIK_hV9P7djXmj You need to put them somewhere accessible - I stick them in netlogon because I'm lazy. Then you need to decide which apps you want to remove, I remove pretty much everything except photos and store, although I GPO block access to the store for pupils. The second script removes edge and a few other stubborn things, you can remove cortana with it too, but removing cortana breaks the ability to search from the start menu. You need to edit the second script to tell it where to find the PSM1 take-own module.

The old-school way of doing it is to use GP to change permissions on the folders in the default profile... I've got a couple of machines with 1803 where I've moved from redirected start menu to a vanilla start menu because the startmenu redirection was adding too much time to the logon. Those machines seem to be respecting those settings... Your mileage may vary but I'm using a custom start screen XML, a vanilla start menu and those folder property customisations and it seems pretty good. I remove all the unwanted apps at build time with a script.