free780

The issue is not being able to gather the Make,Model and OS of personal devices with a technical control. Full MDM is necessary. Android has the advantage of the Work Profile model which means only business data can be deleted/managed. iOS is a bit more messy. In terms of scope you should aim for whole org. CE is hard work and will bring out other issues. Over the last few years education has needed to catch up with a more mature cyber security posture. You have to think. If we don’t do this control when will we ?

There are quite a few variables here. It’s possible to setup a Always On VPN with RRAS that doesn’t use NPS if certificate based. If the VPN Server isn’t domain joined I’m assuming the additional checks won’t be done. A trusted certificate has to be provisioned and trusted by the VPN Server and the client. However forwarding the requests to a NPS server where PEAP/EAP occurs may encounter issues where the SID can’t be verified. Given the vulnerability additional verification is probably wise. I’m not sure of the impact on 802.1x. Microsoft need to provide more details. With the original May update errors would only be logged and access still given. Many Reddit comments seem to indicate that the new events don’t get logged with the original May update.

2016 DCs in a test environment. No issue with cert auth with KB5013952. I'm going to apply the new "fixed" update KB5015019 and test. My VPN Server is not on the domain. Using Computer Level Certs.

Larger orgs have to purchase mail gun or similar to send bulk mail. Microsoft will want to protect their infrastructure. I think Mailgun is about $35 a month on the lowest tier. It also doesn’t help a fair few Phishing emails have the subject remittance.

Still "Investigating" for Server 2016. https://docs.microsoft.com/en-us/windows/release-health/status-windows-10-1607-and-windows-server-2016#2826msgdesc

I’d wait until the issue is marked as resolved or mitigated on the Windows Release Health.

You can limit scope to just your admin team. Then only their personal devices come into scope. I would just get Intune/MEM setup. You have to go through the pain and moaning. Evandine has got a fair bit wrong but ensuring up to date devices access your organisational data can’t be a bad thing.

My worry is that I have users who never are on site. So cert renewal must work across the VPN that is using the cert. It may be possible to issue manual certs.

I’ve tried to replicate issues in a test domain. I can’t break VPN connections using cert auth at machine level. This is using the computer template and mostly default NPS settings. So I’m confused for what the big deal is. Though will be waiting for MS to changes the status on windows health to resolved before applying to DCs.

You can always right click and run as admin to force elevation. Starting an admin cmd/PowerShell as admin can also have the same effect. Not all installers respect UAC properly.

It’s an add on for MEM/Intune. Very unpopular with ConfigMgr types on twitter. You probably need an intune licence in your tenant to see prices for it. I would just try deploying the new app via the store through MEM or ConfigMgr.

It seems like if you don't have a SAN with the DNS name of the computer. You may incur issues. https://directaccess.richardhicks.com/2022/05/16/certificate-based-authentication-changes-and-always-on-vpn/ I can't replicate this in testing. Microsoft's guidance seems to outline the issue.

Reading around the issue it looks like there will be some additional requirements around user and computer certs. But there is a year before enforcement. This means renewing client certificates or adding AD attributes that align with the certificate. This is due to a vulnerability where it is possible to generate a cert for a DC from a Computer Account. However updating the domain controllers is somehow breaking certificate authentication for 802.1x and/or Always On VPN connections. Microsoft’s guidance seems to indicate enforcement mode is enabled by default.

Useful links in this thread. May 2022 Windows Updates may cause issues with NPS and RRAS /showthread.php?t=227690

Only as a church member. It works. Each person can join small groups or volunteer groups. It’s probably a lot simpler than a school MIS.

MS are not dropping support for IE on LTSC versions of server. However the only reason you'd need it is some legacy app.

https://docs.microsoft.com/en-us/windows/release-health/status-windows-10-1607-and-windows-server-2016#2826msgdesc https://support.microsoft.com/en-gb/topic/kb5014754-certificate-based-authentication-changes-on-windows-domain-controllers-ad2c23b0-15d8-4340-a468-4d4f3b188f16 You may find VPN clients fail to authenticate with certificate based authentication after this months updates particularly to domain controllers. In the long term some additional AD attributes may need to be added and certificates replaced.

It looks like the latest Windows Updates are causing issues with computer certificates to n NPS and RRAS.

Either option 2 or provide a mobile device for each staff member who requires it to fulfil their role. The most difficult part is to keep track of the manufacturer, model and OS of personal devices. A MDM provides this.The enrolment method that apple and google want you to use means that work apps are segregated. In some ways the requirements are a bit out of date. You can use MAM and put controls on apps and the underlying OS and hardware are not as relevant. In theory vulnerabilities could be present.

Isn’t it more difficult to secure external access? Web Application Filter Intrusion Prevention System MFA Etc. Rather than going to a cloud hosted solution?

I experienced locky affect 1 user on a RDS host a few years back. It sped up getting AppLocker enforced and a rigorous checking of defender settings that needed enabling.

You can script adding teachers as admins of each OneDrive. Depends if they just need read access and they have to change the URL.

Due to the enrolment setup you have to assign to enrolled and unenrolled devices. This is for personal devices. I don’t want to change the ownership of this device as it’s not part of the scope.

Have you tested your internet speed at home on a wired connection? SSL VPNs tend to seem a bit slower than IPSEC VPNs. IPSEC takes a bit more work to setup.

Hope this is allowed. After weeks and weeks I've cleared my garden of the remains of a very large tree. So if anyone is in or around Leeds and wants some wood please DM me. Its free.