free780

My 100mbps Virgin Media connection copes fine with multiple HD streams. Playing fortnite etc. Is it just living in a remote town/village/hamlet just not cared about by BT Open reach?

Was the certificate self signed that you used to sign the powershell script? If so you need to add the certificate to the Trusted Root Authorities store on your test PC. If you have ADCS setup you can create a code signing cert from ADCS and your PCs if on the same domain will trust the certificate.

It use Web sockets so don't do any SSL/TLS Interception on it. If your really brave you can put it through the Azure App Proxy then you don't have make an inbound rule in your perimeter firewall :-). But you need the licensing.

Has it AzureAD joined?

Looks like you need A5 and information barriers. https://techcommunity.microsoft.com/t5/microsoft-teams/prevent-searching-people-contacts-from-another-group-in-teams/m-p/1381890

Or the SSU needs updating first.

The updates haven't expired/superseded ?

I think Covid has pushed 1:1 even more. Now the budget is needed and the chnage in mindset to look after equipment.

Hi Anybody seeing issues with VPN (IKE) connections via Sky Broadband over the last few days?

Check the date stamp on "C:\Windows\System32\GroupPolicy\Machine\Registry.pol". I think its should be the date the last time local group policy was changed (SCCM client uses local group policy). I've seen AppLocker rules not update when this file is stale (which means its linked to non-local group policy as well). You could try Stopping the wuauserv service rename the c:\Windows\softwareDistribution. Start the Service and try again.

You can if you configure intune with MAM so the intune app or company portal does the SSO. You need the intune licence to so this. Or Azure P2 which only does MFA if its a new device/location.

Is it DNS? Its always DNS! Have you got a public DNS name to the VPN server. E.G. Vpn.domain.com. and is it resolvable externally? Or it could be certificates.

From this Months Windows Updates. Addresses a security vulnerability issue with user proxies and HTTP-based intranet servers. After installing this update, HTTP-based intranet servers cannot leverage a user proxy by default to detect updates. Scans using these servers will fail if the clients do not have a configured system proxy. If you must leverage a user proxy, you must configure the behavior using the Windows Update policy “Allow user proxy to be used as a fallback if detection using system proxy fails.” This change does not affect customers who secure their Windows Server Update Services (WSUS) servers with the Transport Layer Security (TLS) or Secure Sockets Layer (SSL) protocols. For more information, see Improving security for devices receiving updates via WSUS. https://techcommunity.microsoft.com/t5/windows-it-pro-blog/changes-to-improve-security-for-windows-devices-scanning-wsus/ba-p/1645547 The Tech Community link isn't working at present. Ideally I wouldn't proxy WSUS traffic at all.

If you hybrid join all your clients and servers I think you can use AzureAD joined as a control as well as MFA which gets round the need for P1 issue. I can see that most orgs will need P2 at some point. You may need to push an extension to Chrome.

Yep say no to LTSC. Visual Studio doesn't support it and there are other gotchas. I'd only update to the 09 releases very gradually.

I wouldn't. It saves credentials in Credential Manager, with RC4. It may be a built in setting in secpol.msc disabling RC4. There are the settings to delegate credentials in group policy. You can enable them, with Intune it may have to be a powershell script. Also please please don't expose RDP on the public internet. This is the main method of Ransomware getting in. Use A VPN and MFA. At least a RDS Gateway with MFA.

I wouldn't use VNC due data in transit isn't encrypted. MEMCM Remote Control or quick assist are more secure.

Any Windows MDM will have the same access as intune. The difference is you can do Co management with SCCM and autopilot. In theory you could lock down as much as GPO if you wrote powershell scripts to do it. An always on VPN will enable GPOs etc.

UAC does work on quick assist as long as you it's not the secure desktop with a non admin user logged in. Ideally you want an always on VPN so you can authenticate against a DC, unless you have cached admin credentials on each laptop[emoji15]. Ideally have LAPS deployed if you need to elevate. Or use JEA where a virtual admin is created when needed.

Looks like Zoom (in the US) has fallen over. https://gizmodo.com/zoom-is-down-at-the-worst-possible-time-1844825643?rev=1598274937510&utm_campaign=Gizmodo&utm_content=&utm_medium=SocialMarketing&utm_source=twitter https://status.zoom.us/

TLS 1.3 is getting closer. https://www.microsoft.com/security/blog/2020/08/20/taking-transport-layer-security-tls-to-the-next-level-with-tls-1-3/

MEMCM needs a particular collation for SQL. I'd probably use the same instance for the WSUS DB. The other app may require different SQL settings and does it have a front end that needs hosting? It may as well be on a seperate server.

Yeah I beat @HPlum78 to it http://www.edugeek.net/forums/security/216871-changes-netlogon.html . Though it could be easily missed. I wouldn't be surprised if it got pushed back. Microsoft have yet to enforce the LDAP changes due to COVID-19.

You can try stopping the WUAUSERV service rename c:\windows\Software distribution. Start the service and check for updates.