Michael

So essentially are we all saying Microsoft's default Active Directory password policy is inadequate, even in the likes of Server 2016?

Let us know when Apple punch you in the nose and say 'no' A keystoke App to detect all activity is something we've been shouting for, for years on iPads! It's written in their T & C's they do not allow keystroking Apps.

You have to draw the line somewhere - any password is breakable and you can of course tweak it even higher as you require, to say 12 characters. I think that's why (for years) regular password changes rather than very long complex ones are considered better, simply because if it's too long/complex, Staff will just write it down.

Is re-imaging the machine out the question if the event logs say nothing interesting?

If you enforce certain password complexity requirements and then relax how frequently it's to be changed, surely that's the better solution? So if it's 8 characters, one capital, one symbol or number, then it's impossible to have 'password' for example.

Not so sure about that - the App could be purchased, just like any other and they take x amount of commission. I think it's a lot more complicated than that though and maybe something that would involve a significant change to iOS or maybe just their policies. Even in a home context, monitoring your young child's browsing history is desirable for obvious reasons.

It's definitely something that Apple need to get on board with. Safeguarding is a global issue, not just a Windows or other issue.

Will it monitor all, or just a custom browser? Of course if it's just a browser only content within it will be monitored.

You have to ask the question - if you're using a CC3/CC4 network and you don't buy into their support, you could potentially be stuffed if something specific RM stops working. If you go down the generic/vanilla route then you can buy support from anyone of your choosing.

If you disable the Action Center altogether, does it not resolve this? User config > Policies > Admin Templates > Start Menu and Taskbar Remove Notifications and Action Center and Remove the networking icon policies. The Action Center GPO is Windows 10 or later, so a regedit might be needed for Windows 8 if you can identify where the change is being made!

Yes Education Edition.

Hi all, I've deployed MinecraftEdu (latest version) and Powershell informs me it's provisioned for all users. I create a shortcut to a redirected desktop and sometimes the icon is blank and other times it's shown correctly, but more crucially sometimes it launches and sometimes it doesn't. Any ideas? Redstone x64 Edu build, with latest Minecraft Edu. Everything else works beautifully....

Unless Staff require it, (fat Outlook) get them to use OWA. Outlook 2016 is good if you need multiple accounts at once, or want to perform Mail Merge or similar, otherwise not possible in OWA. 99% of the users I support use OWA. And no, I don't redirect AppData, I leave it 'as is'.

I'd try rebooting your switches and see if this clears the issue.

I guess the other possibility is a switch problem, but doesn't sound like it's isolated to one area!

It's a different format completely. I 'think' Facility uses .rp files.

You can stop the messages using GPO, but this doesn't speed anything up, it just suppresses any messages. I think an AP per room and mandatory profile, you'll be spot on for sorting this.

Presumably all DNS requests are made internally first (to your on site DNS servers), then to the likes of Google or other? And not directly to Google. That wouldn't make sense in a domain scenario. I would definitely check the health/status of your internal DNS, I can't come to any other conclusion.

I presume the main LAN, your phones and cctv are on separate VLANs? I am surprised you found mandatory was slower, that's definitely not my experience at all. Mandatory profiles literally take seconds, whereas a new profile can take 30 seconds or longer. 'We're happy to see you' I'm sure gets tiresome for end users every time!

Two things come to mind - - Either a weak or saturated wireless signal, as confirmed by Katy, no AP directly in said classroom - I'd say the Profile creation each time doesn't help. OK this isn't directly a wireless issue, but more so a time/processing issue. I'd definitely explore a single/mandatory profile for end users; it makes a huge difference. Windows 10 especially takes forever to create a new profile (by design), brilliant! Link aggregation or trunking does two things - increases overall throughput, as well as adds redundancy, but to be honest I don't think it would make any difference in this scenario, even if it were a 1Gbps link, rather than 4Gbps.

There's no real solution to this, however the likes of NetSupport DNA includes USB Management, so you can block all connected USB Storage devices and only allow authorised devices or none at all. Entirely up to you.

The default view is to hide known extensions, so I would leave it like that. There's always the risk the end user renames all of the file (including the extension), as was the case on older versions of Windows where it was visible by default. I know Windows prompts the end user when they do this, but not everyone reads warning messages!

I would say check internal DNS first also.

It's poorly thought out on their behalf. If schools were part of a Trust, that's different as their requirements are the same or similar, but dealing with many different/separate identities (schools), it's inevitable their requirements over time will differ.

I'd still do it the PST way, as this guarantees you get everything. Might take longer, but it's the result you want.