free780

Are seperate Server rooms not factored in when primary schools are constructed? I had to deal with a loss of Internet and connections to remote sites as the comms rooms was next to the caretakers rest room. They'd plugged in some dodgy microwave and due to budget cuts no UPS. Given how mission critical IT is now an isolated room is a necessity.

Just be aware most html5 rdp clients use websockets. This means you usually need to not proxy the domain. Due to the shortcomings of Smoothwalls firewall (no FQDN) this may prove difficult if the IP ever changes.

I dont really understand this. The organisation has paid a lot of money for devices ipad/surface/chromebook in oder for staff to do their job. It's may get to the point where personal devices are blocked from Office 365 data via Conditional Access.

What happens if the source IP is v6? Or a user goes to a banned country (unlikely at the moment) and needs to access services?

Fortinet FSSO or SCCM will show user but not designed for shared devices so can lag.

I'd consider firewalling access to vcentre. Also all of your VMWare Infrastructure. There have been cases where ransomware has encrypted VM's. This is partly why security researchers keep finding holes in VMWare software. Expect more patches.

Windows Package Manager 1.0 | Windows Command Line (microsoft.com) Key Point Version 1.0 of Windows Package Manager will soon ship as an automatic update via the Microsoft Store for all devices running Windows 10, version 1809 and later. Group Policies are available if you don't want users install vscode etc. It could be useful on a per machine basis to update 3rd party apps or deploy them.

Two words shared devices. People logging off and not letting sync complete is the issue, some sort of local server cache would solve the issue. It looks like 1:1 devices will be the norm at some point.

We saw issues with finance web sites with this. Just be aware before you pull the legacy plug.

Having seen what happens when you remove it (some sites till needs it IE Banking) the solution of blocking via GPO IE standalone and using the Enterprise mode in Edge is a good one. The only annoying thing with the list in XML is if you have a few CCTV Camera you cant enter 192.168.1.* you have to put in each individual IP or DNS name. Hopefully Vendors will completely move away from Internet Explorer, ActiveX etc

I've set it up in a College. It required ports being unblocked for outbound traffic. We let the lecturer have local admin to manually install and keep it up to date. Students had to setup their own accounts for battle.net. We had a generic account for login which only the lecturer knew the password. We tied down battle.net with applocker. It's never designed for use in a managed network so a bit of a bodge.

Remove-AppxProvisionedPackage On a powershell sctipt per machine? You may need to do Get-AppxProvisionedPackage to find the app.

It comes down to the cost of disposing the equipment. If it gets let in your server room the supplier ISP etc doesn't need to pay for disposal. So dispose and invoice them or state your intentions to dispose.

Sounds like you have to go for the subnet only option. Sorry I've never worked anywhere where the ext ip was shared with other organisations.

Yep has been a problem for the last few weeks. Lots of false positives.

Trying to move things to automated with good alerting/monitoring like ADRs in SCCM. AAD Identity Protection saves a ton of time in blocking/forcing password resets on high risk users. Move to let's encrypt for certificates and automating the renewal will speed things up. Getting applications deployed via SCCM means install is consistent. As others have said having a monthly/new release of win10 automated image capture process within MDT saves a lot of time. You can also think of things that you don't mind giving up control on so they are automated. E.G Antimalware software updates.

So its really for licensing unless you allow your users to use the storage. There is a cloud connector. The end game is 1:1 devices not shared devices for Adobe. You can get it to the point of users having to enter your domain in the username box and SSO can take care of the rest. Its not as seamless as MS Office. Set up SSO with Azure AD Connector (adobe.com)

If you do use the Azure AD App Proxy you do not have to have inbound TCP 443 avaliable on the Internet. You most likely want to use the webclient. It's one of those services you have to set it up yourself to get your head around how it works.

From a Security and Compliance point of view I think Office 365 probably wins. It also depends how hybrid you want to make the approach. Microsoft will always have the edge as they have a foot hold within on premises.

You can only do in PowerShell what you standard user can do. Blocking isn't necessarily the answer. Auditing and having AppLocker making sure constrained language mode is a start. You can also scripts from Microsoft via AppLocker. Alerting isn't too hard to setup if you forward events to a server and do a scheduled task to send a email.

Rule number 1 there's no such thing as a golden image. It will change as soon as its deployed. Use the International ISO for Windows 10 as en-Gb is the default language.

Did they do select HR? That was awful software.

You should just be able to use the link to the webclient. Presuming your using the app proxy with the webclient. If using the RDP file method then the mfa only happens when the connection is made using the mstsc.exe not to the Rd Web. The webclient will make things more seamless. Users still need to enter their password so it's not complete SSO.

Why not use Office 365 Proplus? The monthly updates mean the desktop software should keep in strep with chnages.

You may also get a bit of help with mail check from the NCSC.