gh5000

As I read the MS release from this morning, they have released the patch that was available in March for custom support providers to everyone. I.e. MS are still providing custom support and if the NHS paid for it they would had access to the march patch (whether they would have used it is just like us all remoting on last night and this morning after the fact) ‪ So if you have any 2003 legacy server still going for some antiquated piece of software apply the patch released this morning. Edit: should say custom support subscribers above

Anyone seeing the same thing as me. Its the march update but showing as MS17-008. All posts say to patch MS17-010 but that isn't showing in SCCM. MS17-008 is showing as KB4012216. Manually doing online checks for all windows updates just to be sure.

Is the way that Windows Updates now work that if you install the May security updates that will incorporate anything from April, March etc as well? Also is it right that 4012216 is showing as bulletin MS17-008 in SCCM (same in two schools)? See pic ->

Again, I disabled SMB1 on my Windows 10 laptop just to be safe!

That's the impression I get but it is still enabled by default on a 2016 server I recently installed.

This site has the updates listed. Think it's one of the three depending on the OS. There's also the point about disabling smb1 via add/remove features which is covered in the technet blog ‪ http://www.angleseycomputersolutions.co.uk/uncategorized/are-you-vulnerable-to-the-nhscyberattack/‬

And NHS staff starting their PC up to show journalists and take pictures for Twitter. You're helping spread the virus! You know what a virus is don't you doctor

Time to start taking bets: which political party will be the first to politicise... That's got to have been going undetected for a while to spread throughout the whole NHS. Or are some Trusts down to protect themselves from other Trusts I wonder

One of our schools uses postage print impressions (I think that's what they're called but it does stand for PPI so may be wrong). Basically they preprint the stamp (think they do this in house directly onto envelopes or onto avery labels for non standard post). Standard ink/toner. And I think you have to pre fill a royal mail website with what you're sending before the postman comes. Don't know if it's cheaper but there's a reason the school changed to it - just can't remember the argument for at the moment. You'll find the details on the royal mail website. Just search for PPI

The two different LA support I deal with would give you the SA password if asked. It's your system not theirs. Who pays the SQL license!

I think you are the best consultant you can get - at the price of an AC Pro put one in each classroom on low transmit power. Would you be better off with another system? Maybe but could your money be better spent on switches etc. Is there an area you could test your one per classroom theory on a smaller scale. Maybe someone's had a more recent survey done but and will tell me different but they'll likely all be one per classroom with the range of AC being so poor/low. Even had one survey with Xirrus recently that was one AP per room because AC wouldn't sufficiently penetrate the admittedly old thick brick walls. But on speaking to the surveyor one per room was the easiest way for any company to cover their ass so that's all you might get after spending the money on a consultant.

Actually you probably just need to change Get-ADUser $User | Move-ADObject .... to Get-ADUser $SAM | Move-ADObject...... If you changed your script to import-module activedirectory $users = Import-Csv .\Userlist-sn.csv ForEach ($User in $Users){ $Displayname = $User.Firstname + "." + $User.Lastname $UserFirstname = $User.Firstname $Lastname = $User.Lastname $OU = $User.OU $SAM = $User.SAM $UPN = $User.Firstname + "." + $User.Lastname + "@test.com" $Description = $User.Description $Password = $User.Password New-ADUser -Name "$Displayname" -DisplayName "$Displayname" -SamAccountName "$SAM" -UserPrincipalName "$UPN" -GivenName "$UserFirstname" -Surname "$Lastname" -Description "$Description" -AccountPassword (ConvertTo-SecureString $Password -AsPlainText -Force) -Enabled $true -ChangePasswordAtLogon $true -PasswordNeverExpires $false -Server test.com Write-Host $user Get-ADUser $User } Do you see an error at the Get-ADUser part. What variable is Write-host $user giving you. Is it something that Move-ADObject is going to understand?

As for the move-adobject error. Does that line work successfully 30 seconds after that first script has run. My point being sometimes new-aduser runs on DC1 and then you try and run get-aduser and DC1 hasn't fully completed putting that object in AD, or the second command queries DC2 and replication hasn't happened yet. I put in a line of "start-sleep 3" just to give a brief pause Or there's a spelling mistake somewhere and "OU=schoolname,OU=Users,OU=Student,OU=Year 7,DC=test,DC=com" doesn't exist. To be sure you're spelling and getting the right syntax for the OU I always goto AD and right click on the OU and go properties, Attribute editor and copy paste from the distinguishedname field.

This is what I have for checking on existing users. It's not entirely perfect but works for me. It only checks for duplicate usernames, not duplicate people with different usernames (if that's a possibility in your setup). I then use similar to check for duplicate MIS_ID (3rd party field in SIMS that ensures my users are all unique. #Use try cleanly run part of script try{ #If returns true if ad user with username already exists if ([bool] (Get-Aduser -Identity $Username)) { #what happens if true #in your case you could use something like #get-aduser -identity $username -properties * | export-csv c:\csv.csv #that line is untested and off the top of my head!! Write-Warning -Message "User ${username} already exists. Please exit the script" Start-Sleep 999999 Exit } } catch { Write-Host "User hasn't been created yet: Continuing" -ForegroundColor green }

Just to check but does your csv not give an error since the OU (OU=User s,OU=Student,OU=Year 7,DC=domain,DC=loc) has extra commas Also why does your error say (CN=Test1.User1,...DC=test,DC=com :String) - DC=test,DC=com. Where is test.com come from? Have you left an old variable in there somewhere. Your powershell script is hard to read as it is written above. Put each command on a separate line. As for the CSV import you could set the OU column to be just 7. Then in your powershell script have if($User.OU -eq "7") { $OU = "OU=school,OU=User s,OU=Student,OU=Year 7,DC=domain,DC=loc" } Repeat that for each possible iteration - 8, 9, 10, Staff, Tech, Admin etc

@bobsmith - can you share the final permissions you settled on. It'll save me a bit of time as I'm going through the same process. I started the "Sharing UPN's externally" thread (http://www.edugeek.net/forums/security/181342-sharing-upns-externally.html#post1561239) with Wonde and GCSEPod in mind - before I knew they took everything. I wasn't even happy that they took UPNs and ULNs as they are unique identifiers. Wonde have been to the DfE and they have come back with the following helpful information

Ok here too on LGfL (Sutton)

Any mention of sleep settings on printer? I take it an iPad doesn't save previously used printers - it sends out a Bonjour request everytime you go to print for available printers.(? that's a question - never done printing on an iPad before)

It's great.... Can you confirm that support.lgfl.org.UK where announcements would be posted is down too. (just checking it's not my mobile data). Also Atomwide support line not working. They must use the same internet connection for sip/voip etc

Put a switch in the middle to pair the two cables as a stop gap if it's essential until you get to easter holidays to do some proper tests.

Yes, that's paying an extra £1k for the 5 year NBD. I haven't looked into it in detail before (always had HP in places I worked) but Dell do come with a lifetime warranty too. I don't know if you get quicker replacements with the NBD over the lifetime - or if the lifetime warranty is limited in other ways. You may have to get a salesperson to explain why you need the extra warranty. Does it just depend on if you can wait for a replacement?

I think he's missing a zero there. £4500 is roughly what price I see on Dell's partner site with a 5 yr nbd warranty for a N4032F. Can also find the older gen S4048 48x10GbE 6xQSFP+ on ebay for £2500 which still has a perfectly capable specification IMO. Two for the same price (ish). Dell Force10 kit is very highly rated by a networking friend of mine. Says it's better than HP for the price

And also the correct command is "ipconfig /release && ipconfig /renew" for anyone else wondering what went wrong

How have you been setting up your MX and DDNS A records so far?

Yes, we at some point have made an MSI that we push out to every computer. I think we still do it with group policy as have never changed it over to SCCM. Its probably useless to you as the password is embedded in it. Trying to find how we made it.