HPlum78

https://www.bbc.co.uk/news/amp/entertainment-arts-54761824

Did you get this resolved? The sysvol is not usually displayed in the dfs management console for its own protection...

He was great in Not Going Out https://www.bbc.co.uk/news/entertainment-arts-54731384

Yeah Don Jones has done some nice in a month of lunches books, just before lock down packt publishing approached me to write a book on PowerShell unfortunately this year has not turned out quite the way we all wanted.... I know Don is not as involved in PowerShell as he used to be but his book shell of an idea is worth a read along with how to find a wolf in siberia.

As @robyholmes has said be careful where these are stored we use one of the extension attributes and hash them in our provisioning scripts to protect them even further, then when they are exported they are decrypted or in some cases the supplier has dealt with the decryption directly in the application for us.

TBH a teachers account being compromised by a student shoulder surfing should not be the demise of your network/ cloud deployment. If I am to believe that you are really giving out privilege access to teachers (head teachers) then you are not letting that machine connect to your important infrastructure as you do not install any kind of admin tools/ allow connections to the admin portals directly from these. You are surly using gateway boxes for the purpose of any type of admin function right (like you don't log on to a DC to admin your domain). We are assigned laptops and are not allowed to install admin tools of any type on those and if we need to use our elevated creds then this is done via a purpose built set of servers (that are limited from where we can connect to them from) and even then those accounts are not members of Enterprise or Domain admin groups (if you do this then stop). So yeah risks are not just external (not quite the headline figure of 7 billion that has been banded around there are only ~7.8 billion of us on the planet, and 98% of those don't just don't care. :-p) that said not all risks are going to kill your network and steal your data. They may/ should just be embarrassing for an individual teacher. Anyhow back to additional factors for auth...

The 2 Factor issue for me should be a none starter for anything that has elevated privs, its on. Having to hand out Global Admin to manage Teams for someone outside of IT seems a little like a bazooka to swat a fly! there are so many just better ways to do this, global GLOBAL ADMIN to manage teams! Surly the most amount of priv that is required for this is Teams Service Admin even then I would not be handing that out like smarties... As for the using a Hybird joined device as a factor, well this just depends on what you want your user journey to look, what's the point in PTA if you are going to stick a popup in the way when a user wants to access something. Getting the balance of usability and security is a fine art and we should at least agree on that. We should also accept that a lot of this stuff is decided outside of IT and to be honest is not down to the IT department as its a business risk not an IT risk to accept we should be articulating these and be directed by external key stake holders not just mandating something that hinders the access/ usefulness of our services.

I would be tempted to approach this a different way (one that don't need you to give out global admin in your tenant) ton of options here PowerApp that can be used to do the user admin get it to read membership from a sharepoint list (could also be pure PowerShell) you can all so use this methodology to crate your teams as well. This way you can give access to the SP site and the required privileges to service accounts that your PowerApp/ scripts use. The guys you are paying to develop your teams service should be able to build you your service wrapper for this mind! That's just one way if you have a ticketing system you could hook that up as part of your service wrapper for your teams service. (if not I am tempted to start offing my own skills to get this stuff built for you...)

Zebra do a number of printers that are able to print and read tokens, you can then assign the token back to AD if that's how your are managing identities.

@3s-gtech made my snort out my GnT reading your reply and @elsiegee40 your comments are always level headed and tell the story of IT.

But please tell me it ain't! https://www.theregister.com/AMP/2020/10/02/exchange2010_servers_exposed/

They have been having issues since the 28th last month on a global scale. They are having some issues by all accounts! It should be comfort to us all that even the big boys can have an off day.

If you have a phone with NFC then just tap a card on your phone and a tool like MiFARE classic tool/ tag info you can read the card details see image In fact some of these tools will clone the card so you can use your phone as the token rather than the card token.

Yeah azure for this...

@Norphy has used all the words that I did not have time to write, my views on leveraging the cloud can be found on here in other similar threads.

I am going to point you here in the first instance: https://docs.microsoft.com/en-us/microsoft-365/enterprise/microsoft-365-inter-tenant-collaboration?view=o365-worldwide

IaaS is not the way to consume the cloud, as already noted if its an absolute requirement move to a cloud based SaaS solution. If not keep it in your own DC's.

@mavhc is correct and below is a link for a starter for 10: https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-sso you don't need password write back you will need password hash sync.

So @Cache is almost there and as you say @snagrat you can use 1 or 0, but just to cover this below is the way to stop powershell evaluating $ as a var note the backtick `. $var1 = "test-aduser -identity abc1 -ChangePassword `$true" below is a link that outlines the use of Special Characters: https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_special_characters?view=powershell-7

Here is a script that I have used in the past: https://o365reports.com/2018/12/14/export-office-365-user-license-report-powershell/#technet

https://docs.microsoft.com/en-us/microsoft-365/enterprise/view-account-license-and-service-details-with-microsoft-365-powershell?view=o365-worldwide I would use PowerShell and the above is a starter for 10, never looked at the admin centre for a break down of the assigned licences. Have they not added some optics for this in recent months?

@SimonInOz So i am going to put the link to about_Signing https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_signing?view=powershell-7 this has a link to an old document around Code Signing Best Practices (OLD). here is the about_Execution_Policies link https://docs.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_execution_policies?view=powershell-7 you should be setting this via a GPO so you know that its the same across your environment. We looked at code signing our scripts a while ago and decided that while we would like to get it done we was a long way off just being able to flick the switch and turn it on there is a little more to consider...

@mavhc yeah I understand what is being driven at just want to be clear that we need to think before shoe horning certs in to cert stores....

Dont just go throwing certs in the trusted root/ intermediate store! if you are using certs to code sign then you should be putting these certs into the the Trusted Publishers/ Untrusted Certificates container(s). You can see this in action, go to a machine and run your signed script you should get a message that asks the question 'Do you want to run software from this untrusted publisher?' and then you get a list of options (V) Never Run (A) Always run...... this will then put the cert into the correct container in the current users cert store. Try that way TEST and then decide how you are going to deal with the distribution of the cert, one other thought how are you actually setting the execution policy on your workstations?

An easy fix @FN-GM would be relocate to the UK I don't want to hear your problems just give me solutions. You should be able to get some kind of travel allowance if your place values you, I mean it could be quite direct depending on where you locate? And on the upside you will be able to check that your lights, sockets and the likes are just how you expect. :-p