Norphy

Hmm. Who would have thought that selling overpriced toot with one of three different prints on it wasn't a viable business model?

There is no reason why you can't buy a couple of drives and have them as a mirror for the OS. No need for 1TB drives, even 500GB NL-SAS or SATA drives would do the job quite cheerfully. Putting in an SSD cache certainly won't hurt matters. Make sure you buy one on the HP HCL, rather than some generic thing from A N OTHER supplier. A cache is likely to need a write intensive-capable SSD and more than that, it wouldn't surprise me if the controller refused to use anything which didn't have an HPE firmware on it, HPE are buggers for doing that. If you want to use Storage Spaces (or ZFS for that matter), you can't use hardware RAID of any description. The OS needs to be able to access the drives directly, which is why I was asking if the controller supports HBA mode.

Yet mine have just increased so that's better for me

I'd like to say that I'd put it towards a more comfortable chair to use while I'm having to WFH but more likely, it'd probably be spent on Paw Patrol or other god-awful children's television in that ilk.

Depends on the hypervisor and the guest. Windows Server 2016 and 2019 supports nested virtualisation but I don't know if it supports it for Windows 2008 guests.

No, I don't think so. Going by the spec sheet, the M2 slot is meant to be used as a cache; data that's frequently access is copied to the SSD and retrieved from that instead of the spinning rust. I don't know how that would work with JBOD. Ultimately, I think it means that you can't put an SSD into that slot and expect to be able to access it as another drive. I think your options are: Use the storage controller as a hardware RAID controller and set up volumes on that. The drive loadout you've got there is somewhat peculiar to be honest but these are the options I can see: 1 large RAID 10 volume spanned across all 12 drives, 6TB big. You'll waste half the capacity of the 2TB drives doing that, you're essentially treating them as 1TB drives 2 RAID 10 volumes, spread across the different sized drives, both 4TB in size. 1 large RAID 5 volume across all 12 drives, 11TB total size. You'll waste half the capacity of the 2TB drives doing that, you're essentially treating them as 1TB drives 1 large RAID 6 volume across all 12 drives, 10TB total size. You'll waste half the capacity of the 2TB drives doing that, you're essentially treating them as 1TB drives 2 RAID 5 volumes, 7TB (8*1TB drives, 1TB of which is parity) and 6TB (4*2TB drives, 2TB of which is parity). 2 RAID 6 volumes, 6TB (8*1TB drives, 2TB of which is parity) and 4TB (4*2TB drives, 4TB of which is parity). Using RAID 5 on drives this size and speed is not recommended. If a drive fails, the amount of time it takes to rebuild the array is massive and increases the change of another drive failure during rebuild. I'd only use RAID 6 when write performance is not an issue, like a backup archive, as the processing overhead for dual parity drive arrays is massive. I wouldn't use it for user shares. RAID 10 gives you the best read/write performance out of all the options as there is no parity overhead. It also gives you the same redundancy as RAID 6 as it's able to tolerate up to two drive failures and should a drive fail, the array rebuild time is the lowest. However, it means that 50% of the raw drive capacity is "lost". Or you could put the controller into HBA mode. That treats the drives as a bunch of individual disks and lets the operating system manage them directly. Windows has a feature called Storage Spaces which allows you to bundle disks into a single volume. It's also a bit more flexible when you have different sized disks. You have similar redundancy options to hardware RAID but the advantage is that it's easier to expand the array later on with additional disks if you want to. The disadvantage is that any parity calculations that the RAID controller did before are now being performed by the server's CPU so overall server performance and disk performance will be reduced, although not by much on modern CPUs.

This is a conversation I'm sure that everyone on these forums has had at one point or another. First of all, I would say that you need to speak to someone in the management team of your school and explain to them what the situation is, what the problems are, what's caused them and what the various solutions to the problems are and what the advantages and drawbacks to those solutions are. You need to get support from them and you need to be able to point your staff at policies and directives from your management team when they complain about not being able to do whatever it is they want. In regards to giving people local admin access, that should be an absolute last resort for when there is no other way to get a piece of software to work. Giving someone local admin access allows them to install whatever they want on a computer which means (going by my experience anyway) that the laptops end up with all manner of unlicensed or outright pirated crap on them, browser toolbars, spyware and god knows what else. You also end up getting the blame when the user inevitably breaks it. It's been a while since I looked at deploying software from Intune but why can't you deploy the software that they're asking for from it? If I remember correctly, you can bundle both EXE and MSI installers and deploy them from Intune?

As I see it, the main reasons to segment your network are: 1) Security - you might not want some people to access certain parts of your network. This can be achieved with ACLs and most likely other methods I'm not aware of. An obvious use for this would be a guest wireless network or maybe your CCTV. 2) To reduce the size of your broadcast domains. The general recommendation is that you don't have more than 500 devices per subnet otherwise broadcast traffic gets unmanageable. As a subset of this, you might have a device that's particularly chatty and sends out lots of broadcasts, so you might want to separate that out. 3) Organisation - Not a technical reason as such you may want to say "This area has that range of addresses" or "This kind of device lives in this address range", for example servers. For 1 and 3, the size of the organisation isn't too relevant. You never want Wifi guests to be able to access your production network whether you have 50 users or 500,000 users. As for separating out your photocopiers from the rest of the network, it might be worth doing if they broadcast a lot of traffic and those broadcasts are affecting your network performance (it's not unheard of with printers and photocopiers) or if you want to make sure that no-one but your reprographics department are able to use them as printers or otherwise access them over the network. I seem to be saying this a lot recently but honestly, there is no definitive right or wrong answer to this question.

Ok, looking at the spec sheet for that range of storage adapters here: https://h20195.www2.hpe.com/v2/getpdf.aspx/a00047736enw.pdf The card can be run in both RAID and HBA modes so you can use Storage Spaces with Windows or ZFS with something like FreeNAS.

On a RAID controller, SSD slots like that are generally used for caching, rather than as extra storage devices.

So it's an iPhone 7/8 with an A13 CPU in it? Presumably sans 3D Touch like the iPhone XR and 11. That's nice but it's going to disappoint a lot of people who wanted an update to the existing SE.

What storage controller is in the server? Does it support running drives in HBA mode, rather than in RAID mode? The difference between the two is that HBA controllers allow the OS to access the disks directly, rather than through an abstraction layer like a RAID volume. If so, you could install Windows on one of the disks then set up a Storage Spaces volume rather than hardware RAID. That will allow you to use the space better than a pure RAID array.

Installing Windows on an SD card is not ideal. It can be done but I wouldn't recommend it. If you're going to run an OS on a SD card, it should be a hypervisor or something like FreeNAS. As for the storage configuration, this is one of those "How long is a piece of string?" questions. There are many different answers and none of them are necessarily the correct one. Whichever option you choose is going to be a tradeoff. What kind of storage is the server going to be used for? Shared file server? Personal storage area? Archives? How important is access speed compared to raw capacity?

It won’t be a performance demon but I’ve used Windows on Bay Trail based Atom CPUs before, of which this CPU is a more modern version, and as long as you stay using basic stuff like Office and browsers, you’ll be ok. Start trying to run Photoshop or Visual Studio on it and you’ll run into problems. Stay within its limits and you’ll be ok.

The 5400R chassis has a redundant management controller option, which was admittedly absent from the plain 5400. Along with multiple redundant power supplies and modular ports, I’d personally say that a modular switch is the way to go but there are advantages to both approaches. The other thing to say that at the level we’re taking about here, in HP’s range there are chassis and 1u versions of each switch. For example, the 5400R and the 3800M are the same switch in different form factors

I don’t have anything much more to add about the topic directly but there is something else that’s worth looking at. There was a post on here a while ago about password hashes. There is a list on https://www.haveibeenpwned.com of NTLM hashes of passwords that have been known to be compromised and broken. Someone wrote a script which takes a dump of your Active Directory database and compares the password hashes with ones which have been known to be compromised. I ran this script on our AD database and it found a plethora of weak passwords, some of them from the IT team. It’s worth running this script against your AD database and seeing what it turns up.

If you have an Azure AD P1 or above license and have password write back and SSPR enabled and someone changes their Password inside Office 365, the changed password is written back to the local AD. The next time an AAD sync is run, the old password isn’t synced back because Azure AD connect has written a new one to AD. If password writeback isn’t enabled, this plain won’t work as Azure AD will see that the account is an AD managed one and won’t do anything if the user tries to change their password. It will tell them that the feature isn’t enabled for them. Just a note, DirSync is loooong deprecated, you should be using Azure AD Connect to sync your AD users to AAD if you’re not already.

Somehow I doubt Microsoft care too much which of their products you pay for, just so long as you pay for it. Either way, if you’re a largish enterprise of some sort you’re likely to be paying for their stuff on a subscription.

The second article that I linked goes through the steps of integrating RDweb with Azure MFA

The obvious one is Azure MFA: https://docs.microsoft.com/en-us/azure/active-directory/authentication/concept-mfa-howitworks Which can be integrated with an RDWeb gateway: https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-rdg

The first thing you need to understand is that Azure AD is not the same as an ADDS Domain in the cloud. You don't join a PC to Azure AD in the same way, users don't authenticate in the same way There are advantages and disadvantages to both approaches but it's not easy to declare which is the more suitable option without knowing a few things like: Budget Whether you have space for a local server Computer allocation: 1:1 or shared devices Where your people work: All in one office/multiple offices/working from home If it's a small business where everyone has their own laptop or computer, I would consider using Azure AD and Intune to manage devices.

Can I ask the thinking behind this? The Remote Desktop Gateway that you're talking about here is designed to be exposed to the internet; the whole idea behind it is to just open port 443 to the internet and use that to publish remote desktop servers. What purpose does putting that behind a VPN serve? If you're really married to the idea, I'd suggest looking at Always On VPN which is built into Windows. The process is then completely transparent to the user, they are automatically connected to the VPN as soon as they connected to the internet.

Apologies, my reply was in no way directed at you. It was to mavhc. I was trying to explain to him that things aren’t as simple as he was making out. I know full well that the bulk of the time, people contacting tech support do so because something has broken. What ground my gears was the implication by him that companies should be paying customers to contact tech support.

Very often, there was nothing wrong with the product, the problem was due to the customers not reading the documentation or not following instructions. Do you expect me to go to the customers house and force them to read the manual at knifepoint or something? Even when it’s not the customers fault, it’s not the job of a phone jockey to improve the product, beyond logging common bugs and problems for the development department to fix.

I take it you’ve never worked on the phones for technical support or customer service then? I have. A HUGE proportion of the calls that I got were thanks to the customers own stupidity. Yes, it’s a bit rich to use high cost phone lines or numbers which you derive an income from but expecting freephone numbers for those kind of services is asking to go bankrupt