DGardiner

mailcheck is worth setting up like - Gives a decent amount of info back and sends you recomendations/change notifications

Press f12 o nthe affected browser, check the console for errors - usually pretty obvious whats not working. And id be careful a few of thew urls above in the thread are effectively opening up a hosting companys clients... its not aws level but i still wouldnt do it

https://software.smoothwall.com/ chuck your smoothwall serial in and it should give you a download

Getting papercut yourself will save you money, Print providers have a habbit of "keeping" the licence so you have to buy papercut every renewal if you switch. Our most recent supplier got papercut in our name and released it to us so its ours to keep so on renewal regardless of where we go its just a maintenance fee with papercut... Id imagine the benefit of 1stop regarding the machines is being able to avoid the finger pointing, papercut is one thing but i couldnt be arsed dealing with fingerpointing with the machines/service providers.

https://workspaceupdates.googleblog.com/2021/04/restrict-third-party-api-access-to-sensitive-data-with-new-admin-setting.html not sure if this will help any of you!

Block all direct ip connections, close all ports and force everything via the proxy.

i was under the impression restricted without high risk scopes ticked would block everything - been so long since i had the war of locking down all the things to remember! if youre in a position to try it make a test account and try to sign up with lumen

It may be that apps can create files but only access what they create. That may fall outside high risk since it isnt sticking its nose in anything else [color=#3C4043][font=Roboto]For Gmail, high-risk OAuth scopes are:[/font][/color] [list] [*]https://mail.google.com/ [*]https://www.googleapis.com/auth/gmail.compose [*]https://www.googleapis.com/auth/gmail.insert [*]https://www.googleapis.com/auth/gmail.metadata [*]https://www.googleapis.com/auth/gmail.modify [*]https://www.googleapis.com/auth/gmail.readonly [*]https://www.googleapis.com/auth/gmail.send [*]https://www.googleapis.com/auth/gmail.settings.basic [*]https://www.googleapis.com/auth/gmail.settings.sharingFor details about Gmail scopes, see [url="https://developers.google.com/gmail/api/auth/scopes"]Choose Auth Scopes[/url]. [/list] [color=#3C4043][font=Roboto]For Drive, high-risk OAuth scopes are:[/font][/color] [list] [*][url]https://www.googleapis.com/auth/drive[/url] [*][url]https://www.googleapis.com/auth/drive.apps.readonly[/url] [*][url]https://www.googleapis.com/auth/drive.metadata[/url] [*][url]https://www.googleapis.com/auth/drive.metadata.readonly[/url] [*][url]https://www.googleapis.com/auth/drive.readonly[/url] [*][url]https://www.googleapis.com/auth/drive.scripts[/url] [*][url]https://www.googleapis.com/auth/documents[/url] [/list]

Not sure how it all works, it may be the case for oath login things that its the act of extracing data that requires permission is if its done its done so logins will continue to work? Wonder if theres a delay from changin settings to it affecting

Ive never added any workspace apps and had no issues - though i have gmail/drive set to restricted on high risk scopes which just stops apps reading emails/drive files etc but still allows oauth i think "data" in this context is connecting to the api scopes, https://developers.google.com/apps-script/api/reference/rest

Youre over complicating it. Access Trusted: Can access all Google services Limited: Can only access unrestricted Google services Blocked: Can't access any Google services So if you flick the restricted buttons on the services. the apps should be limited by default so they will now be blocked(on the restricted services), anything you want to work you need to set to Trusted. If you need to enable anything going forward, when they try to login it will present an error report. saying what scopes the app is requesting and a client id - you can use the client id to manually add them to the list

Yeah but juding from that output list, windows wants to read the parent directory as the server name, but you have the backup trying to look for server name one directory too deep

not that i use it but it looks like youre connecting to the wrong folder, its listing folder names instead of server names? maybee youre one directory too deep or high?

If you go https://admin.google.com/ac/owl and click manage google services, you can set the scopes to be open or restricted(require whitelist) im not sure which is oauth - im presuming gmail. We have it set to Restricted - High-Risk Access, this allows oath logins, but anything that wants to put fingers into your actual account data needs to be on the whitelist. Presumably you could set this to restricted all together and it would stop anything not google or on the whitelist, just be aware if youre using google login on anything not google youre probably in for a few days of hassle

if you go into google admin, reports and under auduit log in token i think that shows api accesses, if you search the of clientid or name there you should see who and what

you should be able to find the users, i know you can see on each users profile what apps they have linked. And no oath is too useful to play whitelist only, lets face it - the alternative would be they have put their email address in which is just as likely not explicitly filtered on any of our domains... until youre prompted to

you can block it by getting the clientid and blocking it presumably in the api controlls, anything anyone in your domain has used should popup there

a longshot, but would it not be possible to use ident by location? and add a location that contains that fixed ip? Not played with it so not sure if it overides the proxy auth config but just thinking out loud!

If you have added it to the guardian source exceptions you may need to add a firewall rule to allow traffic from that ip outbound as the transparent proxy wont pick up the connection.(depending on firewall config) Though if youve added it to exeptions and its still getting a 407 that would suggest the device has a explicit proxy set?

they null route the ip's usually.. dns filtering is well... inefective

Thats the problem demote yourself - you can always force yourself back to manager using admin, stops the emails in the meantime

remove everyone from the manager role, make the users who need access content managers or whatever it is, if you need to muck about bump yourself to manager via google admin. Had the same issue a few weeks back, if your drive access is managed by groups people shouldnt need it anyway The notifications/access requests get sent to managers

Oh really? thats cool - https://support.apple.com/en-gb/guide/mac-help/mchl9388ba1b/mac if this is current Looks like you should set any hardwired macs to cache since they work to offload traffic between themselves

regardless ipads are greedy af, get a caching server for your own sanity. takes no setup its all transparent - when a client asks for something from apple they will check the ip the request comes from to see if theres a cache server also at that ip and ask the client to check there first. Could even use another mac computer in the school if its on all the time, just need to spend £15 on "server"