jthompson

Shared 2SV is perfectly possible if that's what you're having to do. When setting up T-OTP (i.e an authenticator app), store the secret or the QR code and just reuse it when setting up each person's authenticator app. If you have security keys, just add each one (I don't know if there's a limit to how many security keys an account can have). I'd make sure that they use Chrome profiles to keep accounts separated in their browsers, too.

The new Surface models aren't fanless, I gather, so I already want them less than my entry level MBA. I'm sure a lot of the performance gains will be wisely spent on serving ads, weather and AI panels. Yay.

Just encountered this year's E-Marker2 now. The AppLocker rule for the main executable (DRS.PLATFORM.UI.FRAMEWORK.HOST.EXE) need adjusting to update the publisher and product name: Rule type: EXE publisher rule Action: Allow Group: [your user group] Publisher: O=AQA MILTON KEYNES LIMITED, L=MILTON KEYNES, C=GB Product name: E-MARKER2® File name: DRS.PLATFORM.UI.FRAMEWORK.HOST.EXE File version: 24.17.0.0 and above

If you do have the hosts on the same domain and your DCs are all virtual servers, you'll want at least one of those DCs on a host that's either on a different domain or on no domain.

Jbloggs would need to do a regular download of the attachment and then save those to whatever Shared Drive. Either saving/moving the downloaded file(s) into place via Google Drive for Desktop, or dropping/uploading the downloaded file(s) into place via the Google Drive web app. Both of which you've probably already reverted to doing anyway.

When you say "quick", do you mean quick to initially set up the tooling, or quick client deployments (i.e. minimising the time required to deploy everything to a particular computer)?

Hopefully this is just in the nick of time to prevent RealPlayer from establishing market dominance. \s

As an AI language model, I'm unable to share experiences of AI tools in the workplace.

I don't think you're doing anything wrong. I wouldn't have thought that that feature would be available when accessing a mailbox as a delegate, since the delegated access covers only the mailbox and not Google Drive. If you're using Windows and have Google Drive for Desktop deployed, then your users could make use of that to most easily move files into Google Drive locations from their downloads folder.

I direct people to Canva now. We have it set up but hardly anyone knows about it, so I'm hpoing that the video features will be a gateway into people producing better posters and notices to put up around the school [and leave there indefinitely].

I can appreciate that a larger org with many different divisions will have a harder time wrangling their outgoing email sources, but all the more reason to actually do it when you know that you have a deliverability problem across your recipients.

That looks like quite a job to maintain! I'm guessing M365 doesn't have the option that Gmail does of attaching a warning to any external emails where the display name matches that of any user in your org?

I'm guessing that the inner workings of the e-Marker2 software don't recognise the inspection certificate (i.e. aren't going by Windows's root CA certificate store).

Haven't tested this year's version yet, but certainly last year it was HTTPS inspection that broke the e-Marker2 software here, even though we had e-marker.co.uk allowlisted. You may need have no HTTPS inspection going on in order for the software to call home successfully.

Just installed the Summer 2024 CMI+ version. It looks like it still needs to have TLS 1.0 enabled on in order to sign in, like in previous years.

I guess that's where the GitHub method described above helps. Also, your policy file would get cached by sending servers and might only need to be fetched once it's stale (as per the max_age value you set), which would limit the impact of any hosting outage.Happy to be corrected on my assumptions there, though.

I'm not sure that it matters. gmail.com emails are going to be allowed regardless, since it'll be gmail.com's SPF that governs that, not your own org's.

Yup. 100s of end users who aren't adults, aren't employees and have terrible online hygiene and are switching to different shared devices roughly once an hour. Oh, and can't be expected to have a personal mobile as an additional factor. Surely NCSC or somebody has some leverage to convince Microsoft to stop charging schools for de facto baseline security features.

Long time GLPI user here. The agent is very comprehensive. Some highlights for me of using the agent with daily inventory: Seeing Windows build (i.e. monthly patch level) Seeing whether volumes are encrypted or not (i.e. BitLocker protected). Full software inventory with versions. BIOS versions. Laptop battery real capacity (I.e. health). Date of OS installation (i.e. when it was last imaged). I find the search engine in GLPI to be so powerful, too. As well as looking at all of the stuff about a particular computer, you can more often than not go from the other end and list all of the computers with a particular characteristic (e.g. all Dell Latitudes without an encrypted C: volume, or all PCs in certain rooms that are a month or two behind on their CUs). The financial info that you can attach to everything is also surprisingly useful, too.

I use the second one. It's exactly what the option is there for, and the rules when added are fairly clear for other admins to interpret.

Not familiar with the books at all, and whilst I found the story engaging and thought provoking, I found the cast pretty bland.

A filter made of a tight enough mesh of nano fibres would allow water molecules through but anything else like bacteria or dirt particles would get minced into small enough pieces that they would prevent no health risk. Not sure about chemical pollutants, mercury, etc though. Also, it'd presumably be rather dangerous to have nano fibres out and about in public where they could be put to more malicious uses.

I'd better make a note to test ours next week then! EDIT: Just tested now and the AppLocker rules are definitely working to block Calculator and Clock.

We do it using a "Packaged app" rule in AppLocker. Set the rule to deny for a suitable group. Publisher: CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US Package name: Microsoft.WindowsCalculator Package version: 10.2103.8.0 and above We also have a similar rule for blocking the Clock app (alarms, timers, etc. that might fall foul of exam conditions). Same publisher, but with a package name of "Microsoft.WindowsAlarms". Version 10.2101.0.0 and above. I'm assuming that these are still working as I won't have tested them for ages!

Maybe do both. Record on the laptop as before but also have them record using a dictaphone device. Should anything go awry with primary recording on the laptop, they can fall back on the dictaphone recording and only have to rename the file(s) they need. Teachers seeing exam boards' file naming requirements as not their responsibility is definitely a theme for us here this week.