jthompson

I think Sign-in with Google only works with an account's primary address, not with any of its aliases.

Configure your virtual machine with no NICs, and then apply a user login script that runs any required vboxmanage.exe commands like this. In addition to this, you should also use file permissions to prevent end users from modifying the main vbox file of the VM. if exist "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" ( "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" registervm "C:\path\to\virtualmachine.vbox" "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata global GUI/Customizations noSelector "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata global GUI/SuppressMessages remindAboutAutoCapture,remindAboutMouseIntegration,showRuntimeError.warning.HostAudioNotResponding,remindAboutGoingSeamless,remindAboutInputCapture,remindAboutGoingFullscreen,remindAboutMouseIntegrationOff,confirmGoingSeamless,confirmInputCapture,remindAboutPausedVMInput,confirmVMReset,confirmGoingFullscreen,remindAboutWrongColorDepth "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata global GUI/RestrictedGlobalSettingsPages General,Input,Update,Language,Display,Network,Extensions,Proxy "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata "C:\path\to\virtualmachine.vbox" GUI/RestrictedRuntimeMenus Machine,View,Devices,Help,Debug "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata "C:\path\to\virtualmachine.vbox" GUI/RestrictedStatusBarIndicators HardDisks,OpticalDisks,FloppyDisks,Network,USB,SharedFolders,Features,Mouse,Keyboard "C:\Program Files\Oracle\VirtualBox\vboxmanage.exe" setextradata "C:\path\to\virtualmachine.vbox" GUI/RestrictedCloseActions SaveState,PowerOff,Restore ) With the "setextradata global GUI/Customizations noSelector" command being run, you'd also need to deploy a shortcut that enables your end users to launch the VM, since that command will prevent them from opening the main VirtualBox application window.

That's why a sandbox VM is nice.

IME it's the nuisance factor that is the main reason for not providing a python instance directly on the host computers. Infinite loops launching the notepad ending up with an ungraceful reboots, or creating endlessly recursing folder structures in user areas, etc. VMs and/or online IDEs give your computers an easier ride.

If they're just needing to be able to receive mail at the old addresses (for password recovery, notifications etc on those third-party sites), then it sounds like you have that covered. Keeping the old addresses as aliases on the new mailboxes will keep that going in perpetuity, assuming that mail for those old addresses is being routed to your Outlook service. If it's "Sign in with Google" single-sign on that they're using, then that assumes continued use of the Google accounts themselves, so you'll have to work out how to migrate people away from that. That's likely to need a specific approach for each affected third-party service.

I should hope an M365 account can be added to most mobile mail clients these days: Outlook, Gmail, Apple Mail, even whatever cheesy app Samsung does. If they have a mobile, there should be no need for them to have to install anything extra.

I remember counting them by weighing them. And yes, it was something a quarter of a million £s worth of shopping Tesco to get one computer.

RE: Ansible, is it a bit of a non-starter when considering managing Windows clients that are powered off as much as on? Puppet looks like a steeper learning curve, but seems on the face of it like the one to use if you just want to say "make sure all these computers are running version X" of some app.

$deity that's good!

These have both been on my "to have a play with" list for yonks.

Neither do I ... https://arstechnica.com/security/2024/09/false-memories-planted-in-chatgpt-give-hacker-persistent-exfiltration-channel/

I believe that with the free one you don't get the integration across the other Google services like Docs, Gmail, Meet, etc. It's just the standalone chatbot. Edu tenants get a freebie in the sense that you don't have to pay anything to prevent user data from being used for training. Regular business tenants wouldn't get that for free.

This page seems to suggest that the nodes will need to be members of the same AD domain - https://learn.microsoft.com/en-us/windows-server/failover-clustering/create-failover-cluster#verify-the-prerequisites Also, cluster-aware updating (CAU) requires that the nodes are joined to the same AD domain.

I've just downloaded the MSI installer from https://wjec.surpass.com/LaunchTest/SecureDelivery, hoping that it would be v24.02 and that I could deploy that out ahead of tests and use my inventory to monitor progress, but it's still the earlier v24.01. They were very specific about the timing of the release of their update, so I'm annoyed that they've not provided an up to date MSI. Leg work for me today, then EDIT: They've confirmed that there's been a delay to the release of the new version and that once it's out, the MSI link will be updated too. The WJEC Surpass home page does state what the current version is, so watch that.

In the middle of deploying PaperCutNG here. I've a feeling I initially abandoned the idea of Mobility Print during my earlier research because the Chrome APIs it relied on were being deprecated, but I think it's now switched from being a Chrome app to being a Chrome extension. That may mean that it's a viable option again. As well as Mobility Print, with PaperCut you can also enable web printing, where users sign into your PaperCut server via the web and submit files for printing (PDF, usually) to any of the printers they have privileges to that are also enabled for the feature. A bit janky but can get you out of a hole, I suppose. It can be used in conjunction with a hold/release queue as well, to give teachers the opportunity to reject stuff.

Signing into a shared Chromebook without being able to use a phone for 2SV would require a hardware token. On a shared Windows device, I guess you'd have the option of using an installed password manager to sign into Google/Chrome using a passkey or T-OTP from the password manager. Onboarding that in such a way that students can also sign into their accounts away from school seems like a massive headache, though.

How would that work in an environment where students aren't using 1:1 devices? e.g. a shared Chromebook.

Yes, this is chiefly what's behind SLT being so onboard with enforcing MFA for all staff whilst being more meh when it comes to the students. Also, if accounts don't provide access to an email mailbox, then that alters the risk imho. WRT students, the main factor in decision-making seems to be not wanting to undermine a no-phones policy (which I get). Whilst MFA != phones, realistically, buying security keys for all the students and dealing with the layer of logistical complication that that would entail makes it a non-starter right now. If we were a 1:1 Chromebook school (I live in hope), then the calculus would be very different, and I think we'd be able to enforce Google 2SV for all, and have everyone get behind that as an opportunity to instill some good digitial hygiene life skills.

Ditto. We allow students to turn it on, but isn't enforced. For M365, which we pretty much don't use with students anyway, I've got security defaults turned on (so MFA enforced for all).

My DO configuration is mainly set to Group (2) mode (I have a fallback policy of LAN mode but pretty much everything will be on mode 2), with then a number of groups, which broadly correlate to one group for each of our school buildings. Since our site has a number of different buildings, they're like spurs on the network, so I wanted to keep DO p2p traffic contained within each of those areas of the network as much as possible (they're not on separate VLANs). There are at least a few staff PCs in each of those areas, which I make sure are picking up updates in advance of the main bulk of computers, so that they can then be an initial source for computers to grab update files from. I'm getting around about 50% bandwidth saving overall, according to WUfB reports, which is not as high as I'd like but it's about as high as I've managed to get it.

See https://learn.microsoft.com/en-us/windows/deployment/update/waas-configure-wufb For WUfB you can set a standing deferral period for Quality updates of anything up to 30 days (and also a separate deferral period for Feature updates). If you set a deferral period for Quality updates of, say, 7 days, then the computer wouldn't detect an update until 7 days after it was released by MS. You can use that option to set up your different rings of machines that pick up updates at different stages. WUfB doesn't give you granular controls to hold or reject a specific individual update, but you can pause all Quality updates for up to 35 days, after which updates will automatically begin to flow again. https://learn.microsoft.com/en-us/windows/deployment/update/waas-configure-wufb#pause-quality-updates. To have a computer get Quality updates from WUfB but not other categories of update, in Group Policy you can use "Computer Configuration → Policies → Administrative Templates → Windows Components → Windows Update → Specify source service for specific classes of Windows Updates". That allows you to mix WUfB with WSUS as sources of different categories of update. I should imagine that specifying a phantom WSUS server as the source of driver updates would 'work' to stop any driver updates arriving. I don't have a caching server specifically for updates, but instead use Delivery Optimisation so that machines can p2p share update files over the local network rather than everything hitting the WAN/proxy. I use Checkmk for monitoring. The Windows agent includes a plugin for monitoring Windows Update status, and will indicate which updates are pending and whether or not the machine is needing a restart to complete its updates. I use GLPI for inventory, and the Windows agent for that will report OS details including the build number (approx every 24 hours be default, but that is configurable).

You can use WUfB to update on-prem servers without needing them to be Azure Arc enabled. It's just that the WUfB reports dashboard only includes data for the Windows client SKUs, so you won't see any of your servers listed in there. Our servers are all using the WUfB Group Policy options for deferral periods successfully. You can ignore the target version option on servers - none of our 2019 servers have upgraded themselves to 2022, for instance. Our monitoring platform includes Windows Updates checks for servers (i.e. which updates they have pending), and our inventory system reports the OS build, which shows me which CU a server has got installed (i.e. build 20348.2700 is Server 2022 with the September 2024 update installed).

If you set the taskbar to display seconds, does that have any effect on it? I'm wondering if that would make Explorer work a bit harder at telling the time.

Out of interest, what do you actually do when testing Windows updates each month? Are you just testing whether stuff boots, or are you going deeper than that? I just let our servers and workstations install their updates automatically, since I can't imagine me being able to recreate or identify all potential issues ahead of time. They have either 3 or 7 days deferral set, with a 3 day deadline to complete on top of that and 2 days grace for restarts thereafter (servers doing their restarts automatically overnight). In reality that means most things aren't running the latest patch until at least a week after patch Tuesday (patches generally getting picked up in the UK on Weds morning due to time difference with the US, the 3 day deferral taking us to the weekend, and then usage patterns, installation time and restarting needing a few days of the following week). IIRC one of the Server 2022 monthlies was pulled and delayed for a week or so earlier this year, but it was pulled before the 3-day deferral had elapsed. For workstations, a patch would basically need to have been released for the best part of a week before they begin installing, which seems like it gives MS a reasonable chance to pull anything problematic.

These are some Win 11 specific UI options that we are applying. There's no issue with having these applying in Win 10, though. Computer Configuration -> Policies -> Administrative Templates -> Start Menu and Taskbar "Remove Recommended section from Start Menu" is Enabled Computer Configuration -> Policies -> Administrative Templates -> Windows Components -> Widgets "Allow widgets" is Disabled User Configuration -> Policies -> Administrative Templates -> Windows Components -> Windows Copliot "Turn off Windows Copilot" is Enabled