free780

Its a default in Windows Server (not sure about client) even though the vuln is from 2016. This is how to fix in Powershell. If you have MECM you can autoamte a Compliance Baseline # Triple DES 168 Start-Process reg -Wait -ArgumentList "add `"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\Triple DES 168`" /v Enabled /t REG_DWORD /d 0 /f" #DES 56/56 Start-Process reg -Wait -ArgumentList "add `"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\DES 56/56`" /v Enabled /t REG_DWORD /d 0 /f" #NULL Start-Process reg -Wait -ArgumentList "add `"HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Ciphers\NULL`" /v Enabled /t REG_DWORD /d 0 /f"

I think Edge and Chrome now choose https over http for URLs typed. Certificate CRL/OCSP uses http. You have to do a detailed audit. I managed to parse the Windows Firewall log a while back with a similar aim.

I thought Win11 wasn’t supported on MDT.

If you pay for P2 you can set the CAP to only allow MFA registration from a low/no risk sign in. Many orgs need remote workers to register for MFA anywhere. It is a risk. Better than no MFA. If an account starts sending a lot of email or triggers Anti Malware then you can take action. MFA isn’t a silver bullet but it does make things a lot harder for threat actors.

Interesting discussion. For some of us Cyber Essentials is a funding requirement. 95% of software gets patch within 14 days which is do able. where I am. Nessus does miss vulnerabilities or has false positives. The areas where updates don’t happen are where there is a mission critical application with dependencies where a lot of testing is required. It seems to come back to lack of a decent budget in Schools and maybe FE. Which affects the whole sector with the amount of networking that takes place.

Looks like MS have resolved it. Follow this account on twitter. It’s the quickest way to be notified of service issues with the notifications turn on.

Ah Cyber Essentials requirement there. You need a vulnerability scanner in place. Or subscribe to alerts from Adobe/Microsoft and be on top of patching. Easier with Patch My PC. Possible Vulnerability Scanners are Nessus, Qualsys etc. Zoho/ManageEngine which may be cheaper. Defender (depending on licensing) can detect vulnerabilities.

This GPO setting should stop driver updates. https://learn.microsoft.com/en-us/windows/deployment/update/waas-configure-wufb#exclude-drivers-from-quality-updates

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/windows-server-update-services-wsus-deprecation/ba-p/4250436 WUfB then? But you have to pay for Log Monitor to get reporting. Just seems like the need to increase Azure spending to me.

Shouldn’t part of being at school be modelling students for the real world of work? Some workplaces ban phones. EG Call centres . But the majority probably permit them. Self Control is required in the work place why not in education? Isn’t it more rational to model self control of technology rather than a blanket ban? MFA should be in place. There are also other benefits of having P1/P2 such as identity protection. Account Compromise can happen on site.

I did it years ago. You have to make your security group a Sharepoint admin for each Onedrive Sharepoint site. You can use Powershell to do it. Would it be too hard for students to just click share?

As far as I know it does not work as SYSTEM. You need Patch My PC to automate applications and updates.

Interesting my LG tv can’t mirror from a Chromebook without a Chromecast. About 2 years old. Miracast and Airplay work fine.

All the Eggs in the same basket.

Did someone install crowdstrike? Or let a certificate expire?

I think I did via MECM many years ago. I think I may have used GPP to get the registry settings to apply. A powershell script can do the same thing.

I found this out. If you licenced, you can limit stop any org data being used for general copilot learning.

If you have ADCS setup move to certificate authentication. Issue certificates to each computer via GPO and certificate templates. There are guides online to do this. Credential Guard may break other things.

AITM Phishing is a big risk which can steal the users token and password. Moving to Windows Hello/FIDO2/Passkeys/Cert auth can mitigate the risk.

You can disable the RDP file download via Powershell for the html5 client. Remove access on your firewall. Provide all access via the html5 client page. You can still use mstsc on site or via VPN.

Have used Message Labs years ago. Then mimecast and now Proofpoint. Proofpoint is very effective and makes us aware of upcoming industry wide changes. E.G Google DMARC changes. Almost half of inbound mail is quarantined. The sandboxing can’t deal with the Cloudflare “are you human” control that we see user in AiTM Phishing pages. Somehow defender can detect these. We get false positives in both Defender and Proofpoint. It’s a balancing act. Enhanced Filtering is almost there. Proofpoint needs to support ARC really. No solution is perfect and user training is really important.

We’ve had several Teams issues. I went through procmon during test calls and did exclusions for Sophos and Defender (passive mode). Also blocked any traffic using the VPN Interface. Even though the link refers to Skype for Business but the ports are the same. https://techcommunity.microsoft.com/t5/skype-for-business-blog/enabling-lync-media-to-bypass-a-vpn-tunnel/ba-p/620210 I have not had the missing camera / camera not working since these changes. All I can think is that the new teams (web view 2)will a very sensitive to Anti-Malware.

I ran into this getting to 1709. You can run a dism to apply the language en-gb. If you have MECM in place it may be possible. Re-Image would be easier though. https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/add-language-packs-to-windows?preserve-view=true&view=windows-11#change-your-default-language-locale-and-other-international-settings There are some powershell commands that can be run online.

Microsoft seem to be the masters in not being able to communicate clearly. I suspect there may be a push to MFA for all users. However if you have P1 or higher you can use IP restriction etc via conditional access. The mentality is that service accounts should be applications with cert auth. It could get very interesting.

I’ve seen revoked DKIM keys when amazonses is in use. But this is by design and expected.