free780

Or do you have a script to kill the rdpclip process and start it again before launching secure assess?

Can’t believe this is still being used by exam companies. It broke frequently 2 years ago. I got asked to push this out which seemed a lot easier to manage. https://safeexambrowser.org/download_en.html

It’s because the OneDrive sync client is designed for 1:1 devices. The machine level installer improves the experience a bit. So shared PC Mode can only be used if users are only using Edge and Office software.

Is it that hard to spin up a dev domain with a print server to test updates? The spooler had 2 more vulnerabilities that were patched in October. Print Nightmare continues. There is a reversal method but is based on Microsoft admitting there is an issue and not removing the whole update.

I'm just using Printer Connections (Computer and User) which seem to not work with the default behaviour (RestrictDriverInstallationToAdministrators not present) or with the RestrictDriverInstallationToAdministrators set to 1. GPP Shared Printers in the user context work as does Add-Printer. You could have a AD Group targeting devices which SCCM syncs as a collection to deploy the drivers and also Item Level target the GPP Item against the AD Group. If you don't have may drivers you might as well deploy them across your whole environment. However I don't think this is good enough from Microsoft given that printers have to be mapped in user context. Its a shame you can't define a share where drivers can live where users can download them so point and print works as intended. Theoretically an attacker could compromise the share.

Well if I run as a non admin with the registry setting to enforce only drivers can be installed as admin. Its possible to create a printer connection. Printer Connections via GPO seem broken if used in the user context. So you need the drivers per deployed to devices and then the mapping in the user context not SYSTEM . . What a pain trying to make sure drivers are deployed to devices and then setup some PowerShell command from the run command

Or give write access to users for the directory it uses.

Anybody seen this? I'm trying to work out how to suppress it. Clicking Try it now. Brings up this which I can't click. Probably a GPO. I'm on Current Channel 2108.

Start PowerShell. Stop-Process PowerShell_ise -Force It usually recovers unsaved files. I can just hear Thanos. I used PowerShell to destroy PowerShell.

There is a group policy setting to prevent launch from the machine wide installer. Pre COVID I had a script that downloaded the latest version and pushed out shortcuts to start that file which in turn installed the latest version in the profile. This was before the machine level installer.

I’ve had ISE freeze and gobble up lots of memory when doing totally on prem stuff. Not happened recently though.

I discovered this yesterday. GPP Printer on computer level works. How ever if your using PCounter it wont map the port correctly. Not sure about papercut. Printer Connections seem to fail as the mapping is done in the user context even though it can be set at the computer level. I tried PrintUI with a script from sccm using the SYSTEM account. But even that fails with the new default behaviour. Sorry if I was bullish on this thread earlier. I've decided to use the reg fix as a temporary measure. I could map the printing with a local administrator service account via a SCCM Task Sequence but this seems to be bad for security. I can't have 1st/2nd line having to elevate every time a device is imaged. If Microsoft just allowed the system to do Printer Connections and you push out drivers via SCCM it would be fine.

They might do given the security benefits of being on Microsoft 365 E5/A5. Some functionality is limited with the LTSC version in relation to Office 365 features.

Out of curiosity, what are folk doing with stand-alone exes with flash or god forbid shockwave?

Sounds like this needs configuring. https://docs.microsoft.com/en-us/microsoft-365/security/office-365-security/configure-advanced-delivery?view=o365-worldwide#use-the-microsoft-365-defender-portal-to-configure-third-party-phishing-simulations-in-the-advanced-delivery-policy

If you have the budget this will link is card printing to your MIS. Only seen it in FE/HE. https://ips.software/i-card-id-card-software/

Drivers need to be installed prior to mapping. Both in repository and the spooler. Pnputil then add-printerdriver when scripting.

I really wouldn’t compromise security given the APT of ransomware. A malicious driver can gain SYSTEM level rights. The RestrictDriverInstallationToAdministrators should not exist or set to 1 so that the default prevents installation of drivers by non administrators.

SSPR FTW! Now if everyone could register properly so it actually works [emoji3].

I don’t understand why type 4 is a requirement. Maybe it was said earlier on. In terms of driver version drift it shouldn’t happen really. Pnputil adds the driver to the repository and add-printdriver adds it to the spooler. You may have to manually add a print driver via the printer Management mmc to find the correct inf file. Then use GPP or GPO to map the printer.

Yay DNS.

Looks like Sky Broadband home connections may struggle to connect to JISC owned IPs. https://www.ionos-status.co.uk/ Anything with a JISC can’t have its DNS resolved. It’s always DNS. If your in sky I wonder what happens if you switch to cloud flare for your DNS?

I haven’t got the time to play with it but I wondered if the the MS Graph could add the site collection admin. You can addd groups but it is fiddly. I seem to remember doing it via the web gui and then using the get command to get the right reference for the group.

I didn't test on a domain device. You may be able to map at computer level for desktops. As long as the drivers are install or users have a way of installing them (available package in SCCM) mapping will still work. You never know this might trigger a paperless strategy .

Yep be aware on iOS if you allow the built in apps like Mail. Mail supports OAUTH but calendar uses Exchange Active Sync which is only single factor. Also older versions of iOS can use Exchange Active Sync. Ideally you want users to use the Outlook app as MAM can be used.