danrhodes

Hi all, Can anybody else confirm if they have these issues? We're struggling to get NSW to get to the bottom on them and provide a fix for us. It is causing no end of stress for the school DSLs/Heads who receive the prevent/porn/etc alerts. See below for a write-up of the problem I have provided to the sites with the issues. What is Happening? Your site uses a web filtering system called Netsweeper to ensure that inappropriate websites are blocked and do not reach your users. This system checks website addresses against a list of known inappropriate sites. It also performs an additional check to ensure these sites are correctly identified. This extra check involves looking up the IP address of the website to see what other websites might be using the same server. Where is the Problem? The issue is with the additional IP address check, which can lead to false positives. Many websites today utilise Content Delivery Networks (CDNs) to enhance their performance, making their sites load faster and more reliably. A CDN hosts numerous websites on the same server. When Netsweeper checks an IP address, it might encounter one of these CDN servers, which can complicate the identification process. Here's where things go wrong - The CDN server can return the URL of any website it hosts as it doesn't not know the website you are attempting to access from just the IP address so returns a random virtual host url. - Sometimes, the website returned by the CDN is inappropriate or blocked by Netsweeper (for example, a pornographic site). - Even though the website the user tries to access is safe and appropriate, the system mistakenly flags it because it is inappropriate and hosted on the same CDN server. Example of the Issue with CDN Servers Let's consider an example with Cloudflare, a popular CDN service. When Netsweeper checks the IP address 172.67.216.176, the reverse lookup process resolves to the website sextasytube.net, among 500+ other domain names, otherwise known as virtual hosts. Cloudflare's servers host many different websites, and when the system performs the reverse lookup, it may return any of these hosted site addresses. If the returned hostname, such as sextasytube.net, is inappropriate, Netsweeper generates an alert. This does not necessarily block the original, safe website you were trying to access, but it does cause unnecessary alerts. Additional Issues Another issue causing alerts involves computers accessing the IP address 192.168.0.1. This is a standard internal IP address used in many local networks. However, due to incorrect DNS (Domain Name System) records, this IP address incorrectly points to the website whitepower.com. As a result, when computers try to access 192.168.0.1, Netsweeper mistakenly generates alerts because of this misconfiguration. Example Timeline Leading to a False Positive Alert 1. User Logs into the Internet - A user connects their device to the Internet. The device already has the Netsweeper filter agent installed. 2. User Attempts to Access a website - The user Googles for a site or enters the URL of a website (e.g., newswebsite.com) in their web browser and hits enter. 3. DNS Resolution - The device sends a request to a DNS server to resolve the domain name (newswebsite.com) into its corresponding IP address. - The DNS server responds with the IP address, e.g., 172.67.216.176, which is managed by a CDN like Cloudflare. 4. Netsweeper URL Check - Netsweeper intercepts the request and checks the URL (newswebsite.com) against its list of known inappropriate websites. - The URL passes this initial check because it is a safe and allowed site. 5. Netsweeper IP Address Check - Netsweeper performs an additional check by looking up the IP address (172.67.216.176) to see if it is associated with inappropriate content. - A reverse IP lookup is performed to find the hostname associated with this IP address. 6. Reverse IP Lookup Result - The reverse IP lookup returns a random hostname hosted on the same IP address. - In this case, the lookup returns sextasytube.net (a pornographic site) hosted on the CDN server. 7. Alert Generation - Because sextasytube.net is identified as inappropriate, Netsweeper generates an alert. - The alert indicates that the IP address 172.67.216.176 is associated with inappropriate content due to the presence of sextasytube.net. 8. Alert Logging - Netsweeper logs the alert internally, recording details such as the user's attempt to access newswebsite.com, the IP address involved, and the inappropriate domain found (sextasytube.net). 9. Alert Notification - The system sends an alert notification to the designated members of SLT at your site - The notification includes information about the user's access attempt, the IP address, and the inappropriate domain detected.

Thanks, will check this out but suspect it might not be the case as all the other VM's on the cluster are fine. Cheers

Nice idea, just checked but indexing is off.

Hey, thank you in advance for any comments, tips etc. Facing a peculiar issue on two file servers, it was originally just one. However, the second one has started doing the same thing, whereby file access for reading/writing is very slow, and disk active time shows 100% in resource monitor. It feels like a hardware issue; however, the two file servers are at different schools, run on similar but different hardware, and both run Windows Server 2019 Std full patched. The hardware the two VMs run on is similar, HPE Servers; one has an HPE MSA 1050 with 10Gb iSCSI connections (2 each in multipath active active, so 20Gb in total), and the other has 12Gb SAS (2 each in multipath active active so 24Gb in total) with the same HPE MSA 1050. The MSA 1050s themselves each have 24 x 1.2Tb 10k SAS disks in a RAID10 volume. The HV hosts run 2019 Datacenter and are also fully patched. Ther other virtual machines on the failover cluster as well as other large file server arent affected at all. Things we have tried. Turning off Sophos Uninstalling Sophos Turning off Windows Defender and Real-time scanning Deduped the Data to be none dedupe (one server is still deduped) Re-Installed the OS Recreated the VHDX and restored from backup all the data Drivers on the Hyper-V hosts for storage controllers Setup hyper-v replication to a spare none SAN-based server and replicated the server to this, then swapped the servers round live so the primary one was running from the spare server; this seemed to solve the issue strangely, so is this a hardware issue? I moved it back to the failover cluster, and it appeared to be fine but then started with the active time again shortly after. Upgraded Veeam to the latest version as though it might be CBT causing the issue. However, I haven't yet turned off CBT as I can't find a guide on how to achieve this completely. Screenshot of the error with sensitive data covered over. Any pointers would be greatly appreciated. Thanks

Hey, I was unsure whether to post this in Wired Networking or Server 2019 but opted for here. So working on a weird issue currently with a DC not being able to detect the PDC and LocatorCheck failing in DCDIAG, basically I've narrowed it down to that the DC is unable to LDAP Ping the PDC on UDP/389 (tested using PortQuery and NetTools). Myself sat inside the same site behind the same VPN can LDAP Ping the PDC in the other site, logons, replication etc all seem to be fine though for the affected DC. LDAP Ping from other sites DC's is fine except one more that I know of so whatever the issue here is likely the issues there too. All are Server 2019 and are patched fully. Rapidly running out of ideas so any sparks of wisdom anybody can come up with would be greatly appreciated.

If you're syncing passwords with AD Sync you can also enable Seamless single sign on with the matter of about 10 clicks also to Office 365...its a real god send as it stops users having to think!

I cant see why people can't just turn their phones off or have it set to manually check for email and not set on push!

To give a bit more info and see what has started this off see New French Law Bars Work Email After Hours | Fortune

Then that would be against the academies IT Policy and be a disciplinary measure so that would soon stop.

In the interest of work life balance one of our large academy customers have requested we look into delaying all emails sent outside working hours until during working hours. The customer uses Office 365, so I have been in touch with MS and they say without 3rd party software it isn't possible. I know you can do this in outlook but it needs to be seamless, and also have a fail safe built in for say if the subject contains [uRGENT] it gets through the filter. Failing that im going to make a service myself and make millions from it

It sure is they become very messy it’s same at a lot of my sites every so often I try to strip them back, normally in the summer hols. The power shell installer I wrote as I install new servers / networks as a job mainly in junior schools but also some secondaries and I got tired of doing it all manually and there being slight differences with each install so along came a 3k lines power shell script 👍 it’s not perfect it’s a work in progress but it works for me. Basically plonk it on a fresh fully updated 2012 r2 or 2016 server and it will sort everything from domain onwards, dhcp, DNs scavenging, ou structure, group policies etc etc

I agree I’d like to take a look at how other people go about locking down windows 10. My basic set of gpos include a default computer policy then various user policies for students and staff. I also have a power shell installer that crates the ou structure etc etc if you want to take a look?

I’m in the process of upgrading my standard gpo set to be compliant with 1709 so if anybody is interested I’m fine for anybody having a copy. I will stick it up on GPO Share at the end of next week.

Grant, however for the OS to negotiate the disk back to 3.0GB/s is poor.

Quick Update, I have since re-installed Windows a few times and done various other fixes. I have also since installed a Windows 7 x64 VM on Hyper-V. the results are attached, and its not good, it looks as though its Windows 10 throttling back.