CCCSecMan

My thoughts too.

You would be best approaching RM and if you play your cards right they might give you some advice/training for free in the hope you buy more products and services from them.

It could be a duplicate IP address. If you do an "ipconfig /all" check what IP is reported. If a duplicate IP is detected it will revert back to DHCP or an APIPA address.

I am not sure why you would want to disable the Windows Firewall. You are opening up yourself to many more security vulnerabilities. It should work and not cause any problems out of the box for the majority of things. If you are having trouble with it is it possible you have a GPO which is mucking the settings up perhaps?

Your reverse lookup zone ought to be a /24 not a /16. This will not be helping and might even be causing the problem. i.e if your network is 10.2.0.0/23 then you should have two reverse lookup zones: 0.2.10.in-addr.arpa 1.2.10.in-addr.arpa Also ensure the DHCP server is setting the DNS suffix value correctly as otherwise it will not work correctly. You could also try experimenting with "Computer Configuration\Administrative Template\Network\DNS Client\Register PTR Records" GPO settings and similiar.

Agree. This would be how I would do it now for a secondary school size environment. 2 or 3 hypervisors with RAID1 SSD storage with capacity for 1 failure. No SAN. Daily backups with a documented and quick recovery procedure - worst case if a server fails and the storage is toast too just restore all VM files to remaining hypervisors and load from there. Save thousands by not requiring a SAN and could spend that on getting high spec SSDs with ample capacity. Growth simple too as you just buy an extra server with storage as and when.

Have you tried rebooting each domain controller in succession?

You would be better just fixing/stopping whatever is deploying the setting in the first place. Putting a script in to set the proxy to something else is not going to be a good long term solution. Alternatively just create a new GPO with correct settings with higher precedence than default domain policy as well as enforcing it and that should do the trick - not ideal but better than some script running.

Praxis - that screen on the draytek is port forwarding inbound, if I am not mistaken. You need to be concerned about Outbound, which by default on a Draytek is fully allowed, however you should double check. If you have a smoothwall UTM you would be best configuring the Draytek to pass all traffic to the smoothwall, rather than having the Draytek doing NAT etc - best to let smoothwall handle it all. If you are not familiar it would be worthwhile engaging Draytek and smoothwall support to get it configured properly.

I wouldn't waste your money on it - better to look at a 3rd party product. Is there a particular trend of the phishing scams that the existing product is letting in? Are you sure that you have got the spam filter configured correctly in exchange online protection? You haven't got a bunch of email addresses in the allow list have you? This bypasses all filtering for any email addresses you add in.

This. Always the odd random machine that won't PXE boot properly, generally there is a very slight underlying problem too with these machines. Best to chuck them in the bin.

This should work. However you can also choose "if the sender is..." and then type the external address in and press check names when selecting the sender address. This will work even if it is external. You don't have to resort to the list-type option. You should also probably add an action to generate an incident report when this rule triggers so that you are aware, depending on the circumstances.

You can do it two ways. Option 1: Two rules: If sender address = parent and destination address = particular person at school then Stop processing more rules Then have a 2nd lower priority rule If sender address = parent Then reject/quarantine the message Option2: If sender address = parent Then reject/quarantine the message Except if: The destination recipient is particular person at school Ideally you should redirect or quarantine the message rather than blocking, for obvious reasons..

I would agree in a school environment to have a "primary" DC doing all the FSMO roles as well as the primary DNS server, then have 2 more additional domain controllers (also configured as alternative DNS servers on your clients). Ensure forwarders are configured correctly too taking into account the desired flow of DNS resolution. DHCP on other hand is best kept off domain controllers and I'd suggest a separate server just doing the DHCP role.

These so-called benefits of it being "in the cloud" are a little bit woolly though. For example I am a little wary of the claim that it is both cheaper outright, and on an on-going basis, yet updates, resilliency, expert support etc are all being provided. These things clearly aren't being done for free and I imagine the discounts on licensing are not that great so I am not sure what magic is occurring in the cloud such that it is cheaper and yet all these things are also being taken care of too. This is no different to things like RM CC3 and CC4 which supposedly save schools tens of thousands of pounds a year yet as we all know is not always the case. I am skeptical.