jthompson

You could use https://mxtoolbox.com/mta-sts.aspx to check whether the recipient domain has an MTA-STS policy, and more importantly, whether it's a policy that's in enforce mode.

Eurgh. Egress... hate it with a passion. RE: attachments, if the receiving org has their email systems set up nicely and are using MTA-STS, then they will only accept incoming mail transfers that are secured with TLS. If I understand it corrently, then that would mean that emails are ensured to be safely encryted in transit to them. The risk then of a non password-protected attachment is that it just sits in somebody's mailbox indefinitely (including yours), or sits in their downloads folder indefinitely, but then there's a risk of hat anyway even if you sent it to them password-protected. You can send CCTV clips or whatever to the police by sharing it from Google Drive and then unsharing it after they've downloaded it. Problem solved!

Yeah, I think it's the tsd.dat file that you're after. It's not human readable, but you could check the datestamp as a way of determining whether it's from the earllier deployment or not. As @RLR says, I should think copying down the current one into place will be worth a go.

Yes, I have a fairly long list of filters and labels in use. What is it that you're wanting to do?

Maybe 13 months? Just to grease the gears of any annual stuff.

https://blogs.vmware.com/cloud-foundation/2024/11/11/vmware-fusion-and-workstation-are-now-free-for-all-users/ VMware Workstation and VMware Fusion are now free for all users, including education. So maybe an alternative option now alongside VirtualBox? It may not have much long-term viability if news over the last year since their acquisition by Broadcom is anything to go by.

I should imagine that it works for all currently supported versions. Certainly working for Win 10 Edu 22H2 as well as Server 2019 and Server 2022. Note that the WUfB reports dashboard doesn't ingest or present any stats from Windows Server OSes, just the client SKUs. You can still use WUfB Group Policy options to set the deferral periods, etc on Windows Servers. On the Windows Server side there is also Azure Update Manager, which offers more control and reporting, but you need to pay to manage on-prem servers with that.

AFAIK, you'll only see WUfB reporting in the Windows Update for Business reports workbook. portal.azure.com/home -> Monitor -> Workbooks -> Windows update for Business reports (under the Insights group). Or alternatively, http://aka.ms/wufbreports If there's some other console that you're looking at (Azure/Entra is a tangled mess of menus imho), I don't know what that'd be.

Still using MDT, which we're currently using to deploy Win11 24H2 with Office and the latest monthly update applied (we run an automated build & capture after each patch Tuesday). I've spent a while of late working on MCM so as to be able to replicate what we're currently doing with MDT. It's a beast but I'm nearly there and have been diligently writing up the procedure, which I plan to share on here at some point. I'd rather have moved to MCM before MDT stops working with the latest Windows release.

This is what I'm thinking. Unless there's some particular reason for wanting a browser extension, why would the native OS feature not be the one to use?

And perhaps no RDP at all to DCs (hypervisor console access only). To the OP, you mentioned it being a Google Workspace school. Just a thought: if any of those on-prem servers/computers happen to have a GAM installation on them, move that into Google Cloud Shell and remove it from on-prem systems. That'll be more secure whilst also giving you remote access to GAM.

We used self-hosted GLPI, but they do offer a paid hosted solution. Their costs for that are partly based on the number of assets, which makes in unfeasable for us. YMMV. With the Windows agent you get about as must inventory detail as you could ever need.

On the school org use side, in my mind this question is not so far away from asking which brand of tobacco a school should be recommending. A little reductio ad absurdum perhaps, but comparisons with other, less lethal public health threats are available (fatty snacks, sugary drinks, gambling sites).

Have a look at running Windows Admin Center on-prem, and then using Azure Application Proxy to make that site browsable remotely. By using Azure Application Proxy, you can have the WAC site secured behind your M365 login (with MFA!). You'd use WAC to manage the Hyper-V host, and then the Virtual Machines section of that would allow you to manage the clients. If the clients are Windows member servers, then you could connect to those directly with WAC also. That can all be done without any paid licenses.

[...waits until 2039...]

I doubt that Google provide a more granular changelog than you're already getting. The same announcements can be subscribed to in Google Calendar form, which is sometimes helpful to see on one's daily agenda. I think this link covers the extent of it: https://support.google.com/a/answer/6131189?hl=en&ref_topic=6397987&sjid=7752031445804393628-EU

Win11 24H2 has a bug where the component store hashes are all out of whack (so "sfc /scannow" always finds and repairs errors every single time you run it). I've found that that results in Windows Updates in the Settings app getting stuck on "Something went wrong" for extended periods. Might the same problem be affecting Server 2025? That bug should be fixed once the November patches come next week, btw (it's supposedly fixed in the preview update).

Yup, definitely keep in mind that ChromeOS Flex also has a certified hardware list, which doesn't really go back as far as you'd like. You're facing pretty much the same jeopardy as with Windows, only I would expect ChromeOS breakages to come out of the blue a bit more than with Windows. Windows 10 also has an official hardware support list too, like Windows 11. It's just that there was never as much of a deal made of it. I'm expecting Windows 11 breakage on older hardware to come with an annual release (e.g. when going from 24H2 to 25H2) rather than with a monthly cumulative update within a release. If that were the case, you have a bit of time to still run the earlier release, unlike with ChromeOS breaking on you. I think you have to go back to a Core2 before you find something that can't actually boot 24H2.

Ta. Currently working on getting MS Config Manager going, so that I can then move on from using MDT. As much as I do like MDT, I'm not confident that Win 11 vNext will.

Here's a version for anyone feeling nostalgic. (incidentally, these are created with Mermaid, using a plugin for DokuWiki)

Just to expand on the PowerShell importing bit, after downloading the MDTDB.psm1 module, I actually use this script (stored in the same location) to import from a CSV. Here I'm importing serial numbers, so if you're using MAC address or some other identifier, you'd need to modify the code accordingly. [CmdletBinding()] param( [Parameter(Mandatory)] [string] $InputFile ) # Import the MDTDB module. Import-Module .\MDTDB.psm1 # Connect to MDT database. Connect-MDTDatabase -sqlserver YOURSERVERNAME -instance SQLEXPRESS -database MDT # Load CSV file. Fields will need to be 'Name' and 'Serial'. $Computers = Import-CSV $InputFile $Computers | ForEach-Object {New-MDTComputer -description $_.Name -serialNumber $_.Serial -settings @{OSInstall='YES'; OSDComputerName=$_.Name}}

This is the blog post I followed for installing SQL Server Express on the server and creating a database in MDT. If you have multiple deployment shares, they all work with the same database: it's not one db per deployment share. https://4sysops.com/archives/windows-8-deployment-part-8-the-mdt-database/ As in the post, when going through the MDT database creation wizard, I just ticked the computer-specific settings option and left everything else unticked. The records in my db only include computers and I'm only storing serial numbers and corresponding OSDComputerName values. I also use this PowerShell script to bulk import records from CSV. https://techcommunity.microsoft.com/blog/windows-blog-archive/manipulating-the-microsoft-deployment-toolkit-database-using-powershell/706876 I wanted TLS between clients and the database, too. However, I found that I needed to be using the Windows 11 22H2 ADK (10.1.2200.1) in order to TLS connections from clients to be able to work when TLA 1.0 and 1.1 are disabled on the server. Earlier ADKs only use TLS 1.0 I believe. Hope that all helps

I'll see what I can dig out from my notes from the time. Hopefully I've noted down whatever blog posts I followed. Quite easy to setup iirc. When a machine gets reimaged, MDT uses the machine's serial number to fetch the hostname from the db, then joins it to the domain. It ends up as the same AD object as before so things like its description and BitLocker keys are preserved.

Do you have a database in your MDT setup? Our machines keep the same hostname for life, so we have computer records in the db storing hostnames and serial numbers of computers.

The little gantt chart that I keep tells me that you're okay for a while yet.