free780

Becomes an issue with 3rd party software such as Adobe etc where staff/students need to store files. The Machine level installer keeps up to date via scheduled task rather than only updating in the user context. I think I did script the download of the latest installer to SCCM. The deployed is as part of the TS. The largest issue is getting staff/students to realise they need to let their files sync on logoff.

Is it a. Browser extension ? The only way you could do it in iOS/Android would probably be a VPN connection, but inspection may be needed.

It’s not the first vendor I’ve heard of using their “cloud service” just hosting a RDP farm. I best it’s a lot more expensive than on prem servers.

I also wonder how you can do this at home without SSL/TLS Inspection. I don't think you can. Domain checking will only block so much. On an iPad or Android device a lot will break with SSL/TLS Inspection. Years ago I heard Smoothwall describe how at some point children/teens will find things thy shouldn't online.

You also have the issue of applying updates at night that may be a requirement. I do like the idea of MFDs being powered down though.

I'd move to cloud trust as it reduces the need to make PKI changes. https://docs.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/hello-hybrid-cloud-trust As long as the domain controller can reach the OSCP / CRL location in a Hybrid Trust deployment it should be OK.

Are you using a http CRL?

Could cause issues with cctv if reliant on switches.

A RDS deployment without a dedicated SQL instance will use WID. This only supports TLS 1.0. Enable schannel logging before making any changes.

A decent DR plan with technical controls ready to enable is what you need. When an attack does happen it’s usually out of hours and little can be done that is a manual action. Computers are just too fast running a script as a compromised domain admin account. A defence in depth can really help. Multiple controls can slow down an attack.

64Mbps. Just order Vodafone 900 Mbps so hopefully that sorts it out as I live in a city fibre area. I do wonder what happens if you live in a ADSL only area.

Anybody else got a PS5 and seen the PS5 use most of your internet connection when downloading? I’m curious as to what others do. I’ve used an old net gear AP to use QoS to throttle the PS5 a bit.

I didn’t put 2 and 2 together. Advanced own ProSolution which many colleges uses as their MIS.

Just don’t get used to the E5/A5 features unless your going to pay for them.

Speaking of AzureAD. You can make a AAD joined device a requirement or MFA. The IP address issue is taken away. Any abuse of accounts will now be on AAD/HADDJ devices. These need protecting with AV etc.

It can work in Chrome and Edge. There is a Barclays extension you need.

You are correct. However implementing MDM for staff personal devices is hard work. Doing it for students would be a massive under taking. The requirements to list all devices that are accessing organisational data are probably the hardest to implement.

Students are viewed as customers so are not in scope, only staff.

Had this when GDPR first came in 2018. We suggested a SharePoint Site as its more secure than a USB stick getting lost in the post. Forcing MFA for guest users would make it very secure. Apparently it is too difficult for examiners to deal with a password to unlock the pen drive or click a few links to prove they own their e-mail address.

It can be very challenging under the current question set. You need to audit all your servers and cloud services. All admin accounts must have MFA enabled. Access to organisational data can only be accessed from devices that are compliant. E.G patched within 2 weeks of release. This includes personal devices. You must provide a list of devices that are accessing organisational data. All clients and Servers in scope must have software updates applied within 2 weeks. Vulnerabilities with CVSS 7.0 or above need to be patched or remediated. Nessus is good as it will highlight what you need to patch. This isn’t an exhaustive list.

I set this up for a college many moons ago. Due to Rocket leagues nature you need it to be able to update. Which meant either IT updating it or giving a staff member local admin rights for the generic account used. The Epic account thing is annoying. We let students use their own. It’s a shame epic haven’t put the effort in unlike Minecraft for education where Microsoft have built in AAD account use. Fundamentally gaming presumes everyone has local admin and each device is 1:1. We had to make some firewall changes.

I found I needed a scheduled task running as SYSTEM to fully remove profiles.

I can never phantom why banks don’t enforce an Authenticator app rather than txt and phone call. More secure and works where you have an internet connection but no mobile signal. It sounds like you need to raise it with o2.

They mean your staff not your customers. I do not understand the phone ban thing. Theres this thing called self control which I'm sure would be helpful.