free780

I've found 2019 to be better quality than 2016. Just see how long updates take. 2016 is effectively Win10 1607 which has been greatly improved on. Usually Cisco etc take a while for new server OS' to be supported. Anything new I'd use 2019 as it's based in Windows 10 1809.

Well in theory you could use any MDM to managed the apps from the Appstore. One day maybe all apps/applications will come from the store.

You can't disable updates in Windows 10. There are vulnerabilities that should be patched every month or within 14 days if you adhere to Cyber Essentials. You can delay updates. Best bet is to have a scheduled time for maintenance.

I'm sure it's the usual high quality CCTV software. It's possible the updates had started in the background and affected the CCTV software. Fdepe ding on how your updates are managed you may be able to trigger them out of hours. Or in hours for CCTV.

With Windows 10 licensing I think you can continue using KMS or AD activation. You just need the KMS key. Students get an A3 Windows 10 licence and I think it's part of the Faculty A3. For shared devices I just think the first user who logs on licences Windows. If you use the subscription based licensing via intune (can work on hybrid devices I think). It will be a pain to test if you have other methods already deployed. You almost need to test it on a home Internet connection. Device Based Activation for Office was only put in a year ago which requires AAD device join. The end game is 1:1 for staff and students.

I would seriously consider stop using RUP. I believe MS are trying to deprecate them. If you are licenced I'd look at FSLogix. https://docs.microsoft.com/en-us/fslogix/overview Jeff Patterson's comment: https://social.technet.microsoft.com/Forums/en-US/9a6427b9-571f-4255-afa4-5e91b9f1cb70/folder-redirection-deployment?forum=win10itpronetworking

https://techcommunity.microsoft.com/t5/windows-it-pro-blog/sha-1-windows-content-to-be-retired-august-3-2020/ba-p/1544373 If you want the C++ 2005 redistributable you better download it today.

Basically a deny rule takes Precedent. If the app is going on all devices, is it not installed in Program Files? Other than that you could create an Allow rule for the user, ideally for a certificate as long as the app is signed.

So you still have to logon twice. We really need SSO using Windows Authentication. You can use the Password Authentication as long as your users don't mind putting the My Apps extension on. But it breaks if they change their password and potential could lock out their account. Hopefully MS will get the message and put the functionality in. Software such as https://www.cybelesoft.com/thinfinity/remote-desktop/server/ and https://www.ericom.com/access-now/html5-rdp-client/ get around the issue for now. Ericom require an addon called Ericom Connect to do SAML logins.

https://techcommunity.microsoft.com/t5/azure-active-directory-identity/azure-ad-application-proxy-now-supports-the-remote-desktop/ba-p/1257367?s=09

Allow http://www.msftncsi.com and http://www.msftconnecttest.com unauthenticated and with no SSL interception. It needs to be accessible at machine level. Years ago I heard of people putting a DNS entry for the domain in their environment and putting the text file on a webserver as a test on a network with no outbound Internet access. http://www.msftncsi.com/ncsi.txt http://www.msftconnecttest.com/connecttest.txt

If you have SCCM as long as you can tun the installer unattended there isn't an issue. You've always got to consider that you'll probably need to update the application at some point. You need a unattended uninstaller as well. Use the vendors command line as much as possible. I've written PowerShell scripts to deploy and uninstall before where there is no installer. The whole "I need a MSi" doesn't really work now. Now if every single app was in the store and would just update that would be brilliant.

I was surprised that anyone was still using these? When 1607 came out. Things like the start menu broke due to the way Windows 10 doesn't roam the Windows 10 store apps. I would look at just moving to local profiles. If you have particular app settings that need to roam, see if they can roam a different way. E.G Chromium Edge can sync settings if you have the licensing.

I saw this yesterday. https://techcommunity.microsoft.com/t5/microsoft-defender-atp/an-update-on-web-content-filtering/ba-p/1505445 Is filtering going to move into the AV more and more. It may just be domain name checking.

Then you discover you really need P2 or A5. Then they send you a hacksaw for your arm and leg. Though still cheaper in edu than business.

I did a powershell script run by SCCM which would query if Photoshop was installed and if the version was the latest. Then run RUM just for the product installed. So I got a bit of change control. You could also have a fast ring and slow ring. I was also going to create some compliance items to monitor the version. I also found Acrobat didn't update at first, I had to specify the version in the command ljne. If your worried about interrupting the users use a maintaince window or use if statements to query if Photoshop.exe is running. RUM closes a running application if it needs to with no user notification. Also bear in mind the Creative Cloud Desktop App needs to be manually created via the Adobe Admin Console and updated via SCCM as an Apllication with supercedance. You may be able to leverage the API to automate.

You also have to remember that these apps update per user. So if you do an offline app ot a powershell bodge it'll be difficult to update.

In the last few years I've dealt with Conficker, ransom ware and phishing. Most of these could have been avoided with some proactive approaches. Applocker, Disable Auto run, Disable legacy auth, force 2FA for all users. The thing is in education our IT Teams were never put together with this as a focus. Many of us are doing this on our own or in small teams. My question is. Is it possible to have a truly secure environment in education? Bearing in mind the learning environment (curriculum network etc) needs to be segregated some how. Is this where we will be in a few years?

If you have AAD P1 or above you can block access to OneDrive via Conditional Access. You can block the sync client from non domain devices globally without the licensing. If you go further you can actually use Information Protection to encrypt the files and force authentication wherever they go.

I believe you can pay for some Azure storage for DPM. Other than that having a isolated NAS which you physically have to connect every day for a backup and disconnect.

Deploy SCCM to deploy the app to a device. You have to configure the store intergration. The apps are installed per user even if provisioned for a device. As To Do will need updating its best to leave the store updates on and not block the store but restrict it to your orgs store.

1:1 scenario not simultaneously shared devices/servers. So RDP with RemoteFX or Teradici from PCs through a gateway with MFA. Both will cost in licensing per user. No idea what a RDS CAL (guessing you have to licence all users not just max concurrent users is but Teradici were asking $140 per concurrent user per year. Labstats have also done a RDP front end that let's you somehow book a user into a PC.

With the SSO issue. I found users could just enter the domain and it would login. Adobe do recommended Teradici for remote access but it's expensive. It does feel.lile a conspiracy to get education to buy 1:1 devices for students (somehow). Shared devices seem to be an after thought. How long has it taken MS to get Office 365 Pro Plus right?

A bit pie in the sky but will this push forward the move to 1:1 devices for students even further in the long term? I also thought MFDs will be a nightmare with touch screens. Maybe we can finally see printing reduce.

You can use NPS https://docs.microsoft.com/en-us/azure/active-directory/authentication/howto-mfa-nps-extension-rdg Users do need to use the authenticatior app