rrrrr

Windows defender comes a distant bottom on virtually all detection tests. At the moment its a good extra but not good enough to be used on its own

I use pactester software for testing. I think this was it https://github.com/pacparser/pacparser

I have done this with a vbs logon script. Just checks the time and maps it if its between times. Week 1/2 is harder. Perhaps a registry key that is updated every monday (if value is 1 then set to 2, if value is 2 set to 1?) the script could then check this and current time before mapping

Sims database version looks correct : 3.62.232.0, but the patch seems to be looking for 0.0.0.0 Solus agent had not crashed and service was still running our LA cleared out the C:\ProgramData\Capita\Solus3\Deployments\Packages folder and told me to retry will retry next week

Environment>Targets>sims-server = version 7.164.21.1 Version of update is 1.8.221.1 is this where you mean?

No this patch is only been sent out for about 1 week. LA have told me to try through dbattach, which I will try next week. Just wanted to get to the bottom of the issue

got office 2016 now, no visio 2016 on there though?

I have sophos utm setup as transparent proxy, if needed i can guide you through my setup

Trying to run "Patch To resolve the issue in cover where the remaining entries are not removed when the absence period is shortened" through solus 3 Getting an error "Tolerance not met for target Sims Database, Deployment stopping" I have tried; restarting server re-entering SA username and password made sure everyone was logged out Couple of things I noticed in log file; target id Sims-server reported target version number 3.62.232.0, expected target version is 0.0.0.0.|WaitForAgentResponse() Why is it expecting version 0.0.0.0? *** Checking tolerance for SIMS Database (32Bit) targets We are running a 64bit server Any ideas?

Might have to wait for US time to catch up?

Nothing on VLSC for me either yet

I'm not familiar with SonicWALL as we use a different UTM here, As a quick fix, could you not just remove proxy settings in GPO for that PC? If this would affect more than one PC, a quick logon script if %COMPUTERNAME%= then remove proxy settings?

Staff yes, students no. Depends what management applications you have running and if they can be canceled by end task. E.g vnc server or possibly av? Worth testing. Do they need it for 1 lesson for demonstration or permanently? If it was for one lesson i wouldnt have a problem, permanently i would query reasons

Microsoft dpm stores the file backups on disk using a non standard file system on a drive with no drive letter assigned. There is noway of getting to the files without going through the console. It also does file versioning so keeps multiple restore points of the same file. I cannot see anyway how it could touch these backups

Well done by the way!

Started on ccnp security. Look at nugget videos, get cheap kit off ebay for stuff you cannot do in gns3. (Resell for same as purchase price once finished). Do a few past papers and ready to go!

I think gen2 are more protected against corruption if the host server occurred power failure. Does anyone have the issue when doing windows updates on a 2012 vm and you restart, when the server is shutting down all you can see is the start screen with the clock? There is no way of seeing the progress of the configuring updates at shutdown. Sometimes can take a while and im wondering if its stuck or not!

Apparently its not on VLSC until 1st Oct.

I have mitel voip phones. We untag the ports if its just the phone on that port. We tag the voip vlan and untag the pc vlan if it piggy backs off the phone. If we use the piggyback setup, we have to specify the voip vlan on the phones config so it knows which one to use. Could you not put a laptop on the voip vlan just for a connection test, to rule out any phone config issues? If you can ping the gateway address for the voip vlan but no voip devices, says to me they dont have the core switch set as their default gateway. Both devices on the different vlans both need the same switch as default gateway for routing to take place (needs to be their vlans ip address for that switch)

As above, ruckus supports this as this is what we use

To me, the protection against cryptolocker and other malware/viruses is a lot bigger than just SRP's. Viruses and malware have multiple attack vectors, with browser plugins being one of the most targeted (cryptolockers main infection path is adobe flash exploitation). SRP's are good protection but there doesn't seem to be much other than them mentioned in this thread. Below is my checklist I have put together on some other protection methods in order of importance to provide defence in depth. Backups Make sure all backups are regularly done and have adequate retention age. Educate Staff Make sure all staff are cautious on opening email attachments and links, and know what to look for Patch OS and Plugins Make sure all windows and browser updates are applied and any plugins are installed sparingly, and updated Check any old versions have been removed Cleanup Script Below on error resume next dim WshShell dim RegKey dim ScriptVerKey Set WshShell = CreateObject("WScript.Shell") 'checks to see if registry key exists, if it does, the cleanup runs. RegKey = "HKLM\SOFTWARE\EDU\Cleanup" ScriptVerKey = WshShell.RegRead(RegKey & "JAVAOldVer") if ScriptVerKey <> "1" Then Cleanup() Else WScript.Quit End If Sub Cleanup() ' Uninstall REM Uninstall Java 8 Update 51 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83218051F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 51 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86418051F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 45 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83218045F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 45 - 64 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86418045F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 31 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83218031F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 31 - 32 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86418031F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 25 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83218025F0} /q",1,True ' Uninstall REM Uninstall Java 8 Update 25 - 64 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86418025F0} /q",1,True ' Uninstall REM Java 7 Update 67 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F03217067FF} /q",1,True ' Uninstall REM Java 7 Update 60 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F03217060FF} /q",1,True ' Uninstall REM Java 7 Update 55 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83217055FF} /q",1,True ' Uninstall REM Java 7 Update 51 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83217051FF} /q",1,True ' Uninstall REM Java 7 Update 45 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83217045FF} /q",1,True ' Uninstall REM Java 7 Update 40 WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F83217040FF} /q",1,True ' Uninstall REM Java 7 Update 40 – 64 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86417040FF} /q",1,True ' Uninstall REM Java 7 Update 25 – 64 bit WshShell.Run "msiexec /x {26A24AE4-039D-4CA4-87B4-2F86417025FF} /q",1,True ' Uninstall REM Java SE Development Kit 7 Update 5 WshShell.Run "msiexec /x {32A3A4F4-B792-11D6-A78A-00B0D0170050} /q",1,True ' Uninstall REM Java SE Development Kit 7 Update 45 WshShell.Run "msiexec /x {32A3A4F4-B792-11D6-A78A-00B0D0170450} /q",1,True ' Uninstall REM Adobe Flash Player 11 Plugin WshShell.Run "msiExec.exe /X{9BFB1FAB-8FC4-4FAA-9B2D-2B121834B659} /q",1,True 'regkey below stops the script from running again WshShell.RegWrite "HKLM\Software\EDU", "Default" WshShell.RegWrite "HKLM\Software\EDU\Cleanup", "Default" WshShell.RegWrite "HKLM\Software\EDU\Cleanup\JAVAOldVer", 1, "REG_SZ" End Sub AntiVirus Make Sure Antivirus is up to date and active scanning enabled on all machines UTM Check Virus/Malware scanning is enabled for HTTP/HTTPS traffic as well as email. Enable Greylisting ( builds and uses a database of ’known-good’ SMTP hosts that resend messages after receiving a temporary error) Enable BATV (Bounce Address Tag Validation) signs the reverse path of outgoing email, so it is possible to detect and drop spam and virus backscatter) Enable SPF check querying allowed sending hosts for a domain from DNS. User Privileges Make sure all users have the bare minimum file permissions needed to perform their job. This will help reduce what can be infected ACLS Set ACL's on VLANS to reduce what can be accessed by each machine. This will help reduce infection rate Enable Click to run for Internet Explorer Create Registry Key through GPO Preferences under User config for both staff and students HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{D27CDB6E-AE6D-11CF-96B8-444553540000}\iexplore\AllowedDomains\RandomSite Enable Click to run for Chrome GPO User Configuration\Administrative Templates\Google\Google Chrome\Content Settings\setting="Click to play" Disable Macros in MS Office Set the below for each office application in the users GPO User Configuration->Administrative Templates->Classic Administrative Templates(ADM)->Microsoft Excel 2010->Excel Options->Security->Trust Center->VBA Macro Notification Setting Block Malicious filetypes on Email Block Malicious file types being sent on Email including Zip's EXE's etc Software Restriction Policy Disallowed by default Whitelist the below C:\Program Files (X86) C:\Program Files C:\Windows C:\Program Data Network Shares File Screening Enable file screening for shared and home drives, blocking any malicious file extensions USB Security Check SRP's and AV protect against malicious USB's BIOS Security Checkboot from USB is disabled, all Bios updates have been done and password protected

Both smoothwall and sophos do a free option for small/home networks. As you only have a small network this may be worth looking into. http://Http://Www.smoothwall.org https://www.sophos.com/en-us/products/free-tools/sophos-utm-home-edition.aspx

Setting the wol port number worked. I assumed it would do it on port 7 or 9

Internal Routing if set as your default gateway

Should be able to allow anonymous from only the ip address of your fsrm server http://johanveldhuis.nl/file-server-resource-manager-client-does-not-have-permission-to-send-as-this-sender/