gshaw

Just had users phone in reporting issues with Office 365 login on our internal machines (white page stuck when trying to access login.microsoftonline.com) By process of elimination we switched back to the Google 8.8.8.8 Forwarder and that seems to have resolved it. Also just found this https://expertbrains.in/2018/02/05/dns-stops-you-to-open-websites/ which suggests Quad9 could well be at fault. Anyone else experiencing the same? We also noticed that Quad9 returns different results for a DNS query to login.microsoftonline.com - Google returns 4 IP addresses but Quad9 only returns 2, can anyone else confirm? @Arthur @Bob_the_Goon @kjadams @limawhiskey noticed you're all using it from the thread http://www.edugeek.net/forums/security/190463-ibm-quad9-free-global-dns-resolution-service-protect-against-cyber-threats-2.html - noticed any issues this morning?

We're on the verge of enforcing BitLocker for staff so as soon as they plug a USB in they either have to encrypt or it opens read-only. Plus points: doesn't require purchase of new USB sticks, allows IT to recover forgotten passwords Minus points: doesn't solve issue of data already out there, takes a long time on large capacity devices (Windows 7), have managed to break a couple of low-quality sticks that couldn't handle writing to every part of the storage In an ideal world either blocking USB storage completely or standardising on a single model would work better but budget and avoiding a riot come into play (!) Also planning to recall all laptops to redeploy with Windows 10 \ Bitlocker \ Azure AD join but again a lot of those may need replacing as they either need a TPM onboard or the USB "cranking handle" to hold the encryption key (far from ideal as it usually ends up stored with the laptop)

Hosts it'll be cheaper to get a spare in from Serversource or similar and just back up any configs for VMware etc. then switch them over if required. SANs are more tricky as if that goes down, especially because of a software issue you may be up creek without paddle if support lapses so be careful there.

Usual stuff on show, good opportunity to get hands on devices we may be interested in but can't trial every single one. Really disappointed in the Microsoft stand this year though, usually they have a product-centric section with tech experts to talk to. This year it was all just about presentations (can watch that kind of thing on YouTube ta) and just an overly-crowded area around the edges that wasn't very well staffed. Best thing about it was the steering wheel navigation device to cycle through Win10 laptops on screen (!)

The apps are a real problem for us, by the time you've either whitelisted or broken WhatsApp, Snapchat, YouTube, Google etc. you've either allowed the data you want to inspect out unfiltered or caused some very unhappy users. School environment you may be wanting to block those anyway but if you're providing the Wi-Fi for leisure as well as learning it's really difficult to implement MITM in an effective way because of certificate pinning

Exactly this, with MDT set up right everything just builds up one layer at a time and all you need to do is import the freshest media and Office as and when you want to push out a new version.

@tom_newton how's the new categories you were working on for G-Suite etc. coming along? Definitely need more automated rule sets for common cloud services as the current ones seem a bit patchy in terms of what they cover. @AlanD hit the nail on the head with that one I think.

If you're manually updating the status and tick boxes just knock up a generic bootstrap-based web page? Some of those portals do use dynamic data so it updates in real-time. Reason I say the PRTG page is you can put the monitor sensors in HTML so you get best of both worlds.

PRTG can do custom dashboards that you can publish via web link, has a free version (100 sensors, ~20 servers' worth) if you don't need to monitor too many different services: https://www.paessler.com/download/prtg-download Can monitor websites, server services, switches... pretty much anything you want

Azure RMS is definitely free on EES, ask your reseller to add them on for you.

Yeah the CCS entry only got mentioned down in the comments on the page @MRDabble once you go into production with this you may need to have a second policy that sets the values in the opposite direction for any users you don't want encryption forced. Otherwise when you log off the HKLM settings are still in effect and users will get encryption prompts.

@MRDabble here you go, straight export from my GPP page That will enable BitLocker for the user it's applied to Name Order Action Hive Key Value Name Type Value Data RDVAllowBDE 3 Update HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVAllowBDE REG_DWORD 00000001 RDVAllowBDE 4 Update HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVAllowBDE REG_DWORD 00000000 RDVConfigureBDE 1 Update HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVConfigureBDE REG_DWORD 00000001 RDVConfigureBDE 2 Update HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVConfigureBDE REG_DWORD 00000000 RDVDenyCrossOrg 5 Update HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVDenyCrossOrg REG_DWORD 00000001 RDVDenyCrossOrg 6 Update HKEY_LOCAL_MACHINE SOFTWARE\Policies\Microsoft\FVE RDVDenyCrossOrg REG_DWORD 00000000 RDVDenyWriteAccess 7 Update HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Policies\Microsoft\FVE RDVDenyWriteAccess REG_DWORD 00000001 RDVDenyWriteAccess 8 Update HKEY_LOCAL_MACHINE SYSTEM\CurrentControlSet\Policies\Microsoft\FVE RDVDenyWriteAccess REG_DWORD 00000000

Not Lenovo V110 by any chance are they?

Bit of a thread necro but are people still applying these keys on imaging? Had a Win10 1703 laptop come back the other day exhibiting the same GPO failures and unable to connect to NETLOGON. Applied the keys via GPP and manual gpupdate over a LAN connection and all started working OK again. Just about to drop them into MDT but thought I'd check as ideally it seems you'd want the security settings on if they weren't bugged.

That's why I'd decided on 1709 as the build to deploy around. EMET as it was in Win7 always seemed a good idea but looked a bit fiddly to deploy but having it rolled into Win10 as Exploit Guard makes it much easier.

Yeah it's one of numerous tweaks I've had to make to 10 to keep everything under control. The big downside is that the Boot Device option will override your BIOS settings so either make sure your PXE services are secured and \ or disable all other devices in the BIOS apart from HDD. Just deployed the bcdedit settings plus reagentc /disable via MDT and it looks to work fine

Bit of a long shot but worth a try... We need to do a bulk (1000+ machines) set of BIOS updates and reconfiguration on our Stone \ Intel machines but it appears Intel have wiped all traces of the legacy "Integrator Toolkit" from their site Does anyone have a copy of it floating around by any chance?

Bumping this back up as it's just saved me a lot of work trying to get the UEFI Advanced Options menu locked down. Does everything except the Boot Devices menu, which MS have helpfully made so it ignores any UEFI \ BIOS settings regarding password protection for network boot

Out of interest what were the show-stoppers for you? It always was two versions really, 1511 > 1607 > 1703 > 1709 just the naming has changed. No more CBB status for a verified build. It's just a case of one behind the latest is relatively stable and the latest built goes out for "beta" testing to your Power Users before letting it loose elsewhere.

Add the drivers for the Flex 10 to MDT then Update Deployment Share to regenerate the Boot images. Look in your Deployment Share Boot folder for the WIM file then use Rufus or similar tool to create a bootable USB of the MDT WinPE environment. Basically the cranking handle version of a PXE boot You should then be able to capture to local storage (haven't tried it but can't imagine why a local path won't work) Similarly once you've imported the Captured WIM into MDT you can then create offline media to install the Task Sequence, Drivers, Applications etc. via Selection Profiles. Alternatively as above a USB Ethernet works fine, I use either a StarTech USB2 adapter (Realtek drivers) or the MS Surface adapter (doesn't need drivers imported)

https://larslohmann.blogspot.co.uk/2013/12/install-printer-driver.html Works like a charm as a .cmd file during MDT Task Sequence Tip: use %CD%\driverfolder\x64\driver.inf as the path to the files as the commands require a full path otherwise the install command will error out

Think a few others have echoed my sentiments on here around the CB builds. Back in the XP days and into Win7 I used to prefer the medium-fat image approach too (Windows + Office + generic apps) then just run any specialist stuff over the top. However the landscape has changed so much that static images can't keep up now. Started with Flash, Chrome etc. changing so regularly I pulled those out the image and installed on-demand during imaging. Then next it was Office as we want to move from 2013 to 2016 for Office 365 integration so I needed that granular too. Now the OS is a variable too so that's come out and we have a completely dynamic Task Sequence in MDT for it. When 1709 came out I had it deployed on a test machine about 10 minutes after the download finished as the only change I had to make was switching the WIM out in the TS. Now software is always a PITA and that's where your time and investment in packaging tools comes in. We went through a lot of pain making custom silent installs for all our stuff and whether that's SCCM, App-V or even something left-field like our ZENWorks environment it'll pay you back in being able to split software from your image. Also from reading on here classic profile management be it mandatory or roaming looks to cause a lot of issues. We don't do either and leave profiles on machines for max 7 days before they get wiped. Think that may be why I didn't hit the Start Menu issues that have afflicted so many. The new features of CB makes it worthwhile such as Exploit Guard (EMET) for security, Files on Demand for true cloud storage integration and so on. I use LTSB for a few specialised cases but generally sticking to CB and managing it best we can with the tools available.

@Rob_D it is, when I say manual Applications I mean a separate step in the TS rather than all done via database Roles alone aka the "Install Applications" step Once the machine gets started either from F12 boot or Refresh it is completely hands free This is the TS I'm currently testing with 1709, does extra logic such as only install Smartboard software for machines named in a certain way, MAK activate for laptops, pre-stage Print Drivers so GPP maps faster on first login etc.

Thin, call it a hamburger approach: 1) standard Windows 10 1709 Edu WIM direct from Microsoft VLSC 2) drivers injected via the "total control" DriverGroup001 method 3) applications installed based on machine Role from MDT database 4) a couple of manual Application steps e.g. remove Windows 10 apps, join to Domain etc. 5) enjoy

I'm just tweaking our Windows 10 Task Sequences at present and trying out the "Refresh" scenario for installing the new OS i.e. launch MDT from inside an existing Windows environment. This is nice and easy for our technicians as I've attached the LiteTouch script to auto launch on a dedicated service account so in theory all that's required to image a machine is to log in with a specific account and away you go. The only thing is some of our Windows 7 machines have filled their 60GB SSD drives up with updates etc. so I'm wondering what the minimum space required for the Refresh scenario to work is and whether MDT checks for this itself before starting the TS? I already have a custom VBScript that runs before launching LiteTouch to make sure the machine isn't connected on a slow (100Mb) link so I could easily add an extra check in there. Have read somewhere about 6GB being required but that was just off the back of a forum post I think. Anyone got any experiences of using Refresh and how well it worked?