jthompson

Deleting the program files should suffice for SIMS .net, since there's no actual uninstaller, but SOLUS3 agent is actually uninstallable the proper way, which will remove its Windows service definition as well. If you're wanting to do a thorough clear-up, then there will be Windows firewall rules that SOLUS3 agent needed that can be removed.

I think your assessment is correct. There are some other Chrome policies in which the * character is similarly basic and not really doing regexy stuff (URL patterns for allow/blocklists?). I guess it prevents policy processing from getting bogged down by anything too elaborate.

I didn't bother removing any client software. Instead, I used a GPO to disable the Solus3Agent service on client machines, and used AppLocker to prevent anyone from launching anything from the SIMS .net Program Files folder. You might want to do those things in any case, to disable stuff immediately until you work out a way to remove the software later on.

It doesn't look like the * wildcard functionality will support that. It can only match all users for a domain, and it doesn't look like there's anything more complex supported by that policy.

I've just signed into one of our enrolled Chromebooks with a consumer Gmail account and the cert is not there for that account. It therefore looks like Admin > Devices > Networks > Certificates installs per user and not per device.

See if this line sets the variable otherValue to "Jimmy". If it does (i.e. the Logger.log() line writes Jimmy to the console) then you'd be able to incorprate otherValue into the Mailapp.sendEmail() line. var otherValue = SpreadsheetApp.getActiveSheet().getRange(event.range.getRow(), 1).getValue(); Logger.log(otherValue);

I've just done a quick test between a few different cheap ones and some big name brands, and I honestly can't taste any difference.

We have a custom login wallpaper applied per device OU in Google Admin that is like a watermark of the trolley name, so that no amount of sticker/label removal can be used by anyone as an excuse for not knowing where a particular device belongs. If devices need to be reallocated, then we don't need to peel or scrape any physical labelling off. We also have some custom scripting that logs each sign-in, which can make attributing lost or improperly returned devices much easier. I think the native Google Admin logs for that have got a lot better (they were utterly useless not that long ago, hence our custom scripting). We do that using a combination of a custom Chrome extension that we force install, a Google AppSheet app for the extension to write to via API calls, an Apps Script function or two for writing each incoming entry out to a log file and a Shared Drive full of said txt files. The files are needed because a Sheets file (or AppSheet database) needs to be emptied daily to avoid exceeding the storage quota. Ultimatley, that's all in service of the very human policy of stuff getting put back in the right place. It sounds like you need senior management to be expecting more from your staff, so to speak. - edit - We also have a Google Docs file shared with all staff which is an up to date list of which Chromebooks belong in which trolley. This allows department staff to check for any missing devices, and to also look up where any unexpected extras should be returned to. I wrote some Apps Script to compile that document automatically each day, based on the actual devices in each OU.

'Good' in this context of course means 'particularly toe-curling'. I watch The Apprentice, but I'm not sure why. Oftentimes I'll be burying my face into the sofa and pleading for them to stop. It's my TV equivalent of lemon meringue pie: I like the lemon flavour to be so strong that my face wants to turn inside out.

22 beans. This feels like something on offer from a good episode of The Apprentice. Wandering around Camden in a suit and trying to sell laughably small portions of beans to the public at 3 in the afternoon for £8 a pop.

Named admin accounts for each admin staff member makes sense, with suitable privileges as required. But is there not still a place for generically named (i.e. not tied to an individual) super admin accounts? My understanding is that you have them, and that organisation management has break-glass access to them, but you look to use them as little as possible.

I think that could be enhanced further with some Apps Script. Automatically fetch the user(s) in that OU (every 15 minutes?) and check for whether they have 2SV enabled yet. If they do, the user is moved into the required OU. At the beginning of each work day, have it automatically email any users without 2SV so as to remind them to set it up (https://myaccount.google.com/signinoptions/two-step-verification).

TBH I'm not sure I've tested how it behaves for Chromebook sign-ins.

Although the grace period for Google 2FA enforcement doesn't actually force the user's hand into setting up 2FA, it does invite them to during sign-in. They can opt to skip the setup wizard for now. I tend to give people a grace period of a week. If I were handing out hardware keys to new starters, I'd probably add the relevant key to their Google account for them ahead of time (Admin > Directory > Users > [user] > Security > Security keys). That way you're not relying on them taking note of the setup wizard, and you can avoid having to have any grace period in play.

USB security keys for each person and/or store T-OTP secrets in a password manager. If more than one person needs to be able to use a particular account (!) then you can register more than one of those sescurity keys to the account as required. Similarly, you can also use T-OTP with the secrets stored in a password manager. That secret can be plumbed into as many different T-OTP authenticator apps as you like/need, so that staff members aren't needing to share physical devices for MFA.

I think I've spotted the issue. The PaperCut user needs to have one of the "Automatically charge to..." options picked in their account selection setting. Anything where they are able to choose which account to bill against doesn't appear to work on Chromebook, due to not having a 'proper' PaperCut client available.

Hi all I'm experimenting with PaperCut NG (free trial). I have a printer configured with a hold/release queue, which is all working as expected with Windows clients. Submitted jobs appear on the hold/release queue. However, jobs submitted from Chromebooks using PaperCut Mobility Print don't appear. After 10 minutes, the Application Log in the PaperCut NG admin interface shows that the Chromebook job was cancelled because the user didn't respond to a client pop-up. I can print from Chromebooks via PaperCut successfully if the printer isn't configured with a hold/release queue. Is it actually possible to have Chromebook printing going to a hold/relelase queue? What might I have missed in my setup?

If you have GAM, you can use that add yourself as an editor of the file.

Yes, it seems like more each year. I'm assuming that it's driven more by the advancements of fairness and levels of ICT use, rather than signalling some kind of degredation.

File this one under "sigh". BBC News: Tesla owners told not to wear Apple virtual reality headsets while driving Although mostly just jokes in service of social media views at this stage, part of me despairs at the inevitability of other road users being actual dorks in the years to come, as Apple's Vision Pro conquers all.

Yep, sounds like you need to investigate using a managed guest session. It can be set to automatically launch the session on startup, or alternatively the sign in screen would show a badge for the user to click on to launch the session (no password required) alongside the usual sign in form. You can also set a maximum session time, such that it automatically ends the session after e.g. 1 hour.

Maybe consider using a managed guest session, with the user signing into Google Docs in the browser. That way you're not then exposing access to Drive files in the files app.

The device would need access to various Google domains in order to faciliate sign-ins and other background functions. I believe you'd need to perform the requisite allowlisting on your filtering system. Depending on what you use, you might be able to set up a filtering profile specificially for this, and have that be applied to the required Chromebooks. Although you can allow and block certain URLs in Google Admin > Devices > Chrome > Settings > [select relevant OU] > User and browser settings > Content > URL blocking, I don't think you can use a wildcard (*) by itself in the block list. If you could, then you'd just need to configure that for the relevant exam users, but I don't think that's possible. Worth trying? As for a list of URLs, I don't have anything to hand, so maybe just Google around for those and test. EDIT: Tell a lie, you can just put a * in Blocked URLs and then add the various exceptions that are needed. Since this is at a user level, accounts.google.com, accounts.google.co.uk and docs.google.com would be a good starting point. Probably some others will be needed, so test it out.

But you may still need a CSV to provide a list of usernames or OUs. For realtively simple jobs (e.g. a set of exam resource files into a couple of dozen exam user areas), a script that doesn't involve AD will be nice and simple/fast. But yes, for non-trivial lists of paths, programmatically fetching those from AD would be wise.

To compliment that, you might also want a script that empties a list of folders. We use this when clearing out exam user folders. <# .DESCRIPTION Script to empty a set of folders. .PARAMETER CSV The path to a CSV file containing the paths of folders to be emptied (the folder itself is not to be deleted). The CSV file must include a column named 'FolderPath'. .EXAMPLE EmptyFolders.ps1 -CSV folders.csv Empty each of the folders listed in folders.csv #> param( [Parameter(Mandatory)] [string] $CSV ) # Import folder paths from CSV. $folders = Import-Csv -Path $CSV # Process the list of folders. foreach ($folder in $folders) { # Check that the folder exists. if (Test-Path $folder.FolderPath) { # Folder exists. Recursively remove child items. Write-Host "Emptying folder: $($folder.FolderPath)" Get-ChildItem -Path $folder.FolderPath -Recurse | Remove-Item -Force -Recurse } else { Write-Host "Folder not found: $($folder.FolderPath)" } }