meakjoe

Interesting, so that NPS policy is for connections directly to the RRAS? On the RRAS server, do you 'Allow machine certificate authentication for IKEv2' or is it all done through EAP?

Thanks for your reply. We've got a group created to auto enroll PCs with the machine certificate as you suggest, however once they have the certificate there's nothing stopping them connecting. Having a computer security group with the NPS Server as you suggest is what we'd like, however I don't think that's possible? User auth with a security group and RADIUS works perfectly but machine auth seems to work in a different way...

Ok thank you. Are you aware of any way to restrict machine tunnel access with RADIUS or security groups? As I understand it, if machine has the certificate and the VPN Profile installed, they can connect. Whereas with User tunnels, RADIUS authentication with a security group allows/denys access when they attempt to connect.

Hello all, We've recently successfully set up Always on VPN, and both Machine and User tunnels are working. The only part that I'm a bit unsure on is when to use Machine or User tunnels. Some guides I've read say that a Machine tunnel should be used for initial device communication and for pre login steps, and that User tunnels for accessing file shares etc. Has anyone here got it setup in this way, so that the user logs in with a Machine tunnel, then establishes a User tunnel once logged in? The only downside with Computer tunnels is that there's no way to lock down which users can login to the PC as once the machine is connected, it's just like being on the internal network, so we would like some way to control either which users or machines can use the VPN, with some sort of security group potentially. Thanks!

Hmm very true, I'm thinking the AirFibre might be a bit overkill as the buildings are so close.. They mainly market them for carrier backhaul services.

That's great thank you, yes a good point about AirFibre, I'm thinking the NanoBeam dishes might be a good option looking at their range

Thats great thank you, do you know what the hardware model was? Was it one of their air fiber products or the lower priced range?

Hi all, I'm looking at changing the way that 2 primary school sites currently have their internet connection set up, and utilizing a P2P wireless. At the moment each site has their own FTTC internet connection, and my proposed plan would be to have a Fibre 100mb connection installed at one, and then share that connection through a Ubiquiti P2P wireless link. The distance between the 2 schools is around 100 meters and is line of sight, so getting a fast and stable connection shouldn't be an issue. My only concern however is when there are 50 - 60 users, all using the internet at the same time, and their connection being affected due to the P2P repsonse time and load on the link. Does anyone have any experience with this type of set up and can say whether the Ubiquiti P2Ps are significantly affected when there are many people using the link? Thank you.

Someone hasn't turned on 'High Altitude Mode' in the settings have they? That often increases the fan speed to compensate for the lesser cooling effects of thinner air at high altitudes.

Hi all, I'm attempting to streamline Solus and SIMs install using SCCM this summer when we reimage. I've got it working successfully, but the only issue is the latest MSI I can extract from Solus is 3.12.41.1, whereas current clients are 3.12.41.3. You can upgrade clients to .3 from the Solus GUI, but was wondering if its possible to obtain the latest updated MSI so everything can be done automatically. Thank you!

I'm pretty sure we do that every year when they expire. Surely without both of those being active then it wouldn't work at all to begin with?

Hi all, We're having an issue with our Apple Profile Manager. We can set up and manage iPads successfully, and deploy apps etc. The problem comes exactly a year after the management profile has been installed and it expires, which stops our ability to manage the iPads and deploy apps. The only way to fix this is to physically connect the iPads to a Mac and reinstall the enrollment profile, which re-enrolls them for another year. Has anyone else had this problem and knows what the issue is? Thank you!

Do you use Roaming Profiles or redirect AppData at all? We had that problem, normally after the user tried to change the tiles round or add something. The AppData couldn't be written back or it corrupted somehow causing a lot of them to disappear. Local/Mandatory profiles were fine though.

From what I've seen when I've experimented it briefly before, I don't think theres too much to worry about. If you are concerned about what Apps they can and can't install, you can restrict through GPO to only see the 'Private' store. You can then control which apps they see by navigating to the Microsoft Store for Business, and logging in with your O365 Admin and then downloading and sharing apps to specific groups or users from there. When they open the store and log in with O365 credentials, thats all they see. It might be possible to also do App Requests but I haven't investigated that yet.

Are you running the right OS if its for server changes... And the right ADMX files for 1809 if its for Windows?

We had some big issues with UE-V with Apps over standard Programs, just could not get them working properly. Edge is a similar case, an App opposed to a Program, so credentials with that don't roam. Microsofts answer seems to be 'Enterprise State Roaming' I think it is which is part of Azure Premium. OneNote App might be in the same boat...

Have you checked and cleared the Registry area... HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList\ Within each subkey, if there are any, there should be a username/profile path so you can tell who it is. We have this problem occaisionaly and deleting that resolves it. Delprof doesn't usually delete that entry we've found.

If they're in seperate VLANs, there's no firewall blocking ports between them that SCCM may need to use?

I've found Xibo to be pretty good. As people say the web interface can be a bit confusing and not the easiest to work around for most people. A way round this that I found on the internet is to set up a webpage on a server with IIS, and then put the content on there. Put a shortcut on the Editors desktop and give them permission, then just open the html file within Word to edit easily. Embed the same webpage within the layout in Xibo and there you go.

It might be worth looking at this post here... http://www.edugeek.net/forums/windows-10/191185-disappearing-printers-15.html#post1723472 We've deployed the registry key on our Windows 10 machines and so far its totally cured the problem. One slight downside is that the key only works when the user logs out, so if they have previously logged onto the machine then they won't get any printers on the first logon after the fix, but any subsequent logons should be absolutely fine.

Can always teach them to Right Click on the Start Menu button and press the Sign Out button under 'Shut down or sign out'.

Out of interest, what provider are you using for your new mobile broadband? Our landline speed is slower than 2mbs and I'm thinking about changing...

I would think it would be something to do with an unattend.xml file potentially? We used to get all those animations until we made sure the unattend.xml was correct and being used, now it jumps straight to the Login Screen after completing the Task Sequence.

There was another similar post somewhere where people have had success with adding the printer into the GPP twice, once for a Create, and again for an Update. If it fails to Create it printer then the Update should still add it, might be worth trying if you haven't already.

We've had this exact same problem as mentioned here and I believe that we have now found a fix. The issue is to do with the printer mappings against the users SID in the registry not clearing out. When they log on for the second time it tries to pull from the reg which doesn't work. To remove the entries on logoff, take a look at this thread here with the registry entry needed... http://www.edugeek.net/forums/windows-10/191185-disappearing-printers-15.html#215 Since implementing the change I have struggled to replicate it. The only thing to bear in mind is that if a user has already logged onto a machine, then they may not get printers on the first logon since implementing the change, as the entries still exist within the registry, but after a subsequent logoff, they shouldn't get that error on the same machine again.