HPlum78

It should accept -and or multiple -and's

new-DynamicDistributionGroup -Name 'EDG-Year7-Parents' -OrganizationalUnit 'DomainName/Groups/Email/Distribution/Dynamic Groups' -Alias 'Year7 Parents' -RecipientFilter {(MemberOfGroup -LIKE "CN=EDM-HP273-1,OU=Distribution,OU=Groups,DC=YourDomain,DC=Sch,DC=uk")} I think that looks right.....

Exchange online you need the following rather than me trying to explain it :- https://support.office.com/en-gb/article/Search-for-and-delete-email-messages-in-your-Office-365-organization-Admin-Help-3526fd06-b45f-445b-aed4-5ebd37b3762a You can just use the Security & Compliance web @ protection.office.com if you do not want to get into the PowerShell!

I have miss understood the initial requirment and I was thinking about putting the contact in an AD group called year 1/ year 2 so on.... and then calculating a value from there but to be fair that's over kill you could just use the year group and forget about a calculated value all together, the only reason I was thinking about a value was for automation of the administrative tasks on the groups in the future, along with calculating the dynamic distribution group but that's just not needed and unnesaersary to be honest.

Yeah 52 different combinations I reckon (if you have 13 year groups and 5 children per parent, assuming that you don't calculate a value for the first child) but the values are a known that's the point behind the exercise. You could then store that value in one of the extensionattributes in AD and then create the groups based on the value found in that attribute by using dynamic distribution groups or as I would do have a script that updates the membership of a group in AD. To be honest working out the values for 52 combinations is a trivial matter for a computer and any programing language or an excel spread sheet!

I still say lets tape that program as well, just showing my age!

My first thought on this would be to give each year a binary number then script the groups based on the calculation in the attribute..... I will give this more thought.

Auto-renewing contracts are an interesting one although they are enforceable in law the OFT have a dim view of them and it would take a balls out brave company to go up against the OFT! all to do with limiting a customers ability to switch and they take an even bigger issue with contracts that auto renew for the same period or longer than the initial contract (anti competitive).

Ah so an ESET Policy being applied somewhere along the line, just run it AV-less!

What happens if you stop the automatic login? is the auto logged in user a domain account?

I had the same issue with USB dongles for licensing, I said this just the other day sometimes there is no technical solution (or at least an affordable one!), the problem with alerting on the removal of a device (a simple PowerShell Script can do this) is that it can only alert when the machine is powered up (unless you start alerting when the machine is powered off as well!). Anyhow the only real way is as others have described is physical security/ USB over Ethernet setup, I used key rings and chain this stopped the little angles cutting them as easy! now have a USB setup.

https://www.theregister.co.uk/2017/10/30/windows_server_2016_price_surge/

I will link to this https://docs.microsoft.com/en-us/azure/active-directory/active-directory-reporting-risk-events As I said its one tool in the toolbox, the machine learning needs a number of days to get a handle on what is going on and this continues to re-evaluate what's going on in your environment to minimize the false positives.

So you can use Azure to identify if a user is logged into more than one device that are too geographically far apart for the user to be able to be physically logged in to those device/ have been able to travel the distance between locations.

Sometimes there is no technical solutions! but you should use impossible travel and the likes to help identify this sort of thing.

You can enforce device policies via exchange so stuff like needing a pin on the phone before they can add their work account and the like. Its a balance of protecting your organizations data and allowing users the freedom of being able to consume that data on the devices they want. At the end of the day you have the need to be able to protect the data and they have the option of being able to access their data as long as its in line with the policies you have set out in your information security policy. I have seen just how emotive this issue can be but it needs handling with care and as along as you keep people informed most will generally accept that its a necessary requirement and is for the protection of them as individuals as well as for the organisation (and needs top down support!).

Using *365 you can set the policy to just wipe application data that is associated to an account.

https://blogs.technet.microsoft.com/configurationmgr/2017/08/18/high-cpuhigh-memory-in-wsus-following-update-tuesdays/

Yeah from what you have posted that's my assessment.

Yeah Fail Over Clustering every time I hear that I brake out into a cold sweat! to be fair in 2012r2 it has improved and is less of a pain. Not so long ago something like this would have been cluster not starting!

Clearly all of the usual caveats apply here - make sure you have a backup of your current config and the like and just in case you need some background on backing up a failover cluster environment https://technet.microsoft.com/en-us/library/cc771973(v=ws.11).aspx this will help, but apart from that no you should be good to remove and recreate the CAU in your cluster using those commands. Its worth calling out that the preferred method of removing the CAU is via the remove-CauClusterRole https://technet.microsoft.com/en-us/library/hh847218(v=wps.630).aspx but I expect you are beyond the point of being able to use this command and it will throw an exception (win32...... what ever the error message is).

Some bed time reading https://technet.microsoft.com/en-us/library/cc773178(v=ws.10).aspx just in case you have not seen it....

My first thought with no research is that all domains in the trust need to be routable..... My second is around DNS forwarders....

Yeah @ShellfishClive that's what I thought when I saw it!

Yeah it was more just to point out that they have made a commitment more than anything else.