jthompson

Yes, it will prevent them from renaming a file to something with an extension not allowed by FSRM. It'll present in the same way as if they didn't have write privileges on the location (i.e. access denied, insufficient privileges, etc.).

You'd want to be able to manage access to it, such that when staff leave, they can't continue to access old helpdesk data.

Format Factory has this option. Never actually tried it for docx to pdf, but it's my goto for any bulk transcoding.

Sounds like a pain. You can't really win, so you may as well set your deadlines? Windows does rather stick out these days with it's bothersome updates. Newer OSs are a bit more streamlined in that regard, so that's increasingly what people have come to expect.

Crying GDPR seems like a bit of a stretch, and pretty easy to brush off. Better to have been more supportive whilst at the same time negotiating for some storage space elsewhere, maybe? I very much doubt any school needs a whole classroom-sized room for IT equipment storage anyway.

If the alternative is a forced restart, might they begin to? At the moment it sounds like their choice is either to elect to restart, or to just not bother and carry on indefinitely.

Mandatory reboots to complete updates are only going to happen once a month, so I'm happy for people to habitually sleep their laptops at the end of each day. They get opportunities to perfom those mandatory reboots at their convenience. If you're bringing in forced restarts, you may want to begin emailing your staff whenever patch Tuesday comes around, to advise them that their computers will soon ask them to restart when convenient.

Using Datto here, but only licensing for staff members. We're not backing up students' accounts: didn't seem cost-effective. Doing it that way, we still get all of our shared drives protected.

Hi all We have a Hikvision NVR, and the 'plugin' for video playback in Chrome/Edge causes a UAC prompt whenever a user signs into the computer. The plugin installs to Program Files and the UAC is triggered by %Program Files (x86)%\LocalServiceComponents\LocalServiceControl.exe. If I just dismiss the UAC prompt, video playback still works in Chrome/Edge for the Hikvision stuff. I'm really just looking to not have the UAC prompts appear. I've tried creating a shim for it, following https://www.amorales.org/2020/12/bypassing-application-uac-requirements.html?m=1, with no success. The shim is adding RunAsInvoker, but after installing the shim I'm still getting UAC prompts after each sign-in to Windows. I've tried accessing the NVR using IE mode, but the page doesn't render at all anymore, so that's seemingly not available as a workaround. Anyone else run into this issue and have a solution for it?

Check the output of w32tm /query /source on clients and DC's. Clients should all show a DC, DC's that aren't PDC should show the PDC, and PDC should show an external source (e.g. time.windows.com). The following command will also show the time difference to some external source. In this example, it's time.windows.com. w32tm /stripchart /computer:time.windows.com /samples:3 /dataonly Restarting the Windows Time service on a client should be enough to start it syncing with whatever it's source is. Note that it won't necessarily correct instantly in one go. For larger, munites-long differences, the clock will adjust in a series of progressively smaller jumps over a period. From what I remember of that article, you should be able to achieve what you're after just by using w32tm commands, without needing any Group Policy at all. If your DC(s) are virtualised, you may want to disable any host clock sync in the VM settings. In Hyper-V, at least, that'll ride roughshod over DC's w32tm sources, such that the Hyper-V host will be setting the DC's clock regardless, and then everything else syncing from that. By disabling that clock sync between host and VM, the DC is free to have it's time set from an NTP source.

After a bit of testing, I've determined that the "e-Marker CMI+ v8.11.0.6" application requires TLS 1.0. Anyone wanting stronger ammunition for not supporting this software on school devices, there you go! That's the one that's installed to Program Files by an MSI, not the v22.6 one that runs from user profiles (that one just needs to not have HTTPS inspection, so fine for home use). It will fail to connect if TLS 1.0 is disabled on the device (giving the "Could not connect to server" pop-up) but with TLS 1.0 enabled, entering random login details will instead return the message "Login rejected", indicative of successful communication with the servers. We disable TLS 1.0 and 1.1 via GPO, so even with a local admin user on a home WiFi connection, the software wasn't able to connect to its servers. I've been kind and loaned one of our staff members a school machine with a vanilla Windows install (not domain joined) as they have no other device available.

I set up an account for staff to use, as staff sometimes set iPlayer content as cover work. I wouldn't let pupils use it.

I've got one member of staff for whom this doesn't work on their school laptop, even when signed in as a local admin using their home connection (or hotspotting my phone). The software refuses to sign in, saying it couldn't contact the server. We have TLS 1.1 disabled on our machines, so I'm now wondering if that's what's breaking it. Will test.

IME, best to let the Windows domain get on with managing itself for the most part. I've found this blogpost helpful in the past. I should think you can get away without needing to use any GPO for this at all, and just manually configuring the Internet time source on DC that has the PDC role. https://blogs.msmvps.com/acefekay/2014/04/26/configuring-the-windows-time-service/

This is my understanding of it. Happy to be corrected if I've got this wrong. The deadline in WSUS is for completion of a update, which is a subtly different thing from installation of an update. You'd use Group Policy to schedule when computers check for updates and also when they'd then download and install them. There are then other GPO settings around how long a reboot will wait for, whether it will hold off if a user is signed in, etc. My understanding is that the deadline in WSUS for completion will trump all of that by forcing a reboot in order to complete an update that may have been installed several days prior. So, say an update is approved in WSUS on a Monday, and has a 7-day deadline associated with it. A computer checks for and finds it on the Tuesday, so it has until the following Monday to get it all done. GPO tells that computer to automatically download updates and then schedule them for installation at 3am. It won't then install the update until Wednesday morning when it's next powered up. The update is installed on the Wednesday but needs a reboot (if it doesn't need a reboot, all is good). If other GPO settings tell the computer to hold off restarting if a user is signed in, it'll be waiting the whole of the rest of the week whilst also asking the user to restart, up until that deadline arrives on the following Monday, at which point the computer will restart regardless (ideally just before delivery of an assembly).

Leave your clients to sync their clock to a DC. If you have more than one DC, have one sync with an Internet NTP source. The other DC(s) just syncs with the first. If your DC is a VM, it might be getting its clock governed by the host. I know that in Hyper-V you can elect to not have the guest clock governed by the host, to avoid having any clock drift on the host end up right across your domain.

We deploy KeePass to staff machines, so we have some teachers using it, too. On the proviso that their db files are their responsibility.

If you specify an install time, that won't have much bearing at all on the time of day that any required restarts will take place. What governs when a forced restart will occur is the deadline set by any automatic approval rules in WSUS. If you're automatically approving updates in WSUS, include in the rule(s) a deadline for X days after the approval at hh:mm. So even if a CU update is set to install at 15:30 on a Friday, you would also need a deadline being set in WSUS for that category of update in order to ensure that the reboots required to complete the installation do actually take place. Otherwise you're waiting on users indefinitely, which is not how you want to live these days. Our deadlines are all 7 days after approval at 3am. More likely to impact users at the start of their day, rather than during lessons, but only after they've had the best part of a week of notifications to elect to reboot.

Have a look at Nokia. You can certainly hit that price point. Nearest hit for you would probably be the Nokia X10 (6GB, £200, but larger than you want). They do do smaller ones, but they're probably too cheap, and unlikely to have anything near 6GB RAM. Nokias all run Android One, IIRC, which is about as clean and unsullied as it gets on Android.

Office Outlook? That'll likely give you more print layout options than Google Calendar.

MS are working to kill off basic authentication, but if I'm reading https://docs.microsoft.com/en-us/exchange/clients-and-mobile-in-exchange-online/deprecation-of-basic-authentication-exchange-online correctly, then basic auth for SMTP should continue to be available. My guess is that basic auth for SMTP has become disabled by default, and you're needing an option somewhere to opt back into it for that account. Edit: Google school here, so not familiar with the MS options around this.

Yeah, I saw that in my inbox this morning. I had fun getting it to work, so I suppose it wasn't a complete waste of time. Only using it for staff to sign into iPlayer, so I guess we'll just have to revert to old-fashioned password sharing.

I can't remember if adding suitable permissions to the cluster computer object in AD helps with getting CAU working or not. Might be worth Googling.

Do your firewall rules relating to remote shutdown make allowance for the remote shutdown command coming from the local server? FWIW, I generally run CAU from a server that isn't one of the cluster nodes. The user account I use is in Protected Users.

Used to love racing sims, but it doesn't really fit into my home life any longer. I'd have killed for a rig like that though! Wow. rFactor and the Simbin titles about a decade or so ago were ones I was quite into when I had a wheel, as well as the Microprose Grand Prix and Papyrus titles from the 90's. I've not played many recent titles, but am willing to bet that Richard Burns Rally is yet to be bettered as a rally sim. Any games I do play now are just going to be dipping in and out on the Xbox with a gamepad . WRC series (good but still not beating RBR imho), Project Cars and IOMTT (that's a special one).