CCCSecMan

My thoughts too.

You would be best approaching RM and if you play your cards right they might give you some advice/training for free in the hope you buy more products and services from them.

It could be a duplicate IP address. If you do an "ipconfig /all" check what IP is reported. If a duplicate IP is detected it will revert back to DHCP or an APIPA address.

I am not sure why you would want to disable the Windows Firewall. You are opening up yourself to many more security vulnerabilities. It should work and not cause any problems out of the box for the majority of things. If you are having trouble with it is it possible you have a GPO which is mucking the settings up perhaps?

Your reverse lookup zone ought to be a /24 not a /16. This will not be helping and might even be causing the problem. i.e if your network is 10.2.0.0/23 then you should have two reverse lookup zones: 0.2.10.in-addr.arpa 1.2.10.in-addr.arpa Also ensure the DHCP server is setting the DNS suffix value correctly as otherwise it will not work correctly. You could also try experimenting with "Computer Configuration\Administrative Template\Network\DNS Client\Register PTR Records" GPO settings and similiar.

Agree. This would be how I would do it now for a secondary school size environment. 2 or 3 hypervisors with RAID1 SSD storage with capacity for 1 failure. No SAN. Daily backups with a documented and quick recovery procedure - worst case if a server fails and the storage is toast too just restore all VM files to remaining hypervisors and load from there. Save thousands by not requiring a SAN and could spend that on getting high spec SSDs with ample capacity. Growth simple too as you just buy an extra server with storage as and when.

Have you tried rebooting each domain controller in succession?

You would be better just fixing/stopping whatever is deploying the setting in the first place. Putting a script in to set the proxy to something else is not going to be a good long term solution. Alternatively just create a new GPO with correct settings with higher precedence than default domain policy as well as enforcing it and that should do the trick - not ideal but better than some script running.

Praxis - that screen on the draytek is port forwarding inbound, if I am not mistaken. You need to be concerned about Outbound, which by default on a Draytek is fully allowed, however you should double check. If you have a smoothwall UTM you would be best configuring the Draytek to pass all traffic to the smoothwall, rather than having the Draytek doing NAT etc - best to let smoothwall handle it all. If you are not familiar it would be worthwhile engaging Draytek and smoothwall support to get it configured properly.

I wouldn't waste your money on it - better to look at a 3rd party product. Is there a particular trend of the phishing scams that the existing product is letting in? Are you sure that you have got the spam filter configured correctly in exchange online protection? You haven't got a bunch of email addresses in the allow list have you? This bypasses all filtering for any email addresses you add in.

This. Always the odd random machine that won't PXE boot properly, generally there is a very slight underlying problem too with these machines. Best to chuck them in the bin.

This should work. However you can also choose "if the sender is..." and then type the external address in and press check names when selecting the sender address. This will work even if it is external. You don't have to resort to the list-type option. You should also probably add an action to generate an incident report when this rule triggers so that you are aware, depending on the circumstances.

You can do it two ways. Option 1: Two rules: If sender address = parent and destination address = particular person at school then Stop processing more rules Then have a 2nd lower priority rule If sender address = parent Then reject/quarantine the message Option2: If sender address = parent Then reject/quarantine the message Except if: The destination recipient is particular person at school Ideally you should redirect or quarantine the message rather than blocking, for obvious reasons..

I would agree in a school environment to have a "primary" DC doing all the FSMO roles as well as the primary DNS server, then have 2 more additional domain controllers (also configured as alternative DNS servers on your clients). Ensure forwarders are configured correctly too taking into account the desired flow of DNS resolution. DHCP on other hand is best kept off domain controllers and I'd suggest a separate server just doing the DHCP role.

These so-called benefits of it being "in the cloud" are a little bit woolly though. For example I am a little wary of the claim that it is both cheaper outright, and on an on-going basis, yet updates, resilliency, expert support etc are all being provided. These things clearly aren't being done for free and I imagine the discounts on licensing are not that great so I am not sure what magic is occurring in the cloud such that it is cheaper and yet all these things are also being taken care of too. This is no different to things like RM CC3 and CC4 which supposedly save schools tens of thousands of pounds a year yet as we all know is not always the case. I am skeptical.

Surely that is the point of a network manager to decide what rules he wants configuring for his internet connection? Firewall rules at the basic in/out level are very simple.

I like the smoothwall firewall as it's basically only a little extra money compared to the normal web filter so you may as well take advantage and use that as the firewall. No point having a separate box running pfSense if you already have a smoothwall - just added unnecessary complication.

I reckon the ability to manage your own firewall rules is worth 1-2 thousand a year just in the convenience. Presumably the turnaround time for RM to modify inbound/outbound rules is not that quick.

Surely if the local telephone exchange lost power then your site would probably be affected too - so at that point bit pointless having a 4g backup. Unless your site has a backup generator or something.. You would generally need resilient fibre links which travel in opposite directions and go through different POPs. For a school or educational establishment this seems a bit overkill?

Maybe I use Russian Dating sites? I don't think looking at dating sites is a crime. That is true but they shouldn't be able to have a fully functioning account without verifying. It simply is not allowed. If all of these accounts have been registered using your email address then unless gmail or paypal themselves have been hacked then someone has been able to read your mail or at least obtain the verification links. This happens all the time - whether someone has done it deliberately or not, honestly as long as you are sure your emails aren't being read then you should not worry about someone messing about trying to use your email for something. The other possibility which you might not be aware of is that Google will direct emails from one address to another if the email is listed as a recovery email address. Are you absolutely sure the email is being addressed to you?

Are you completely sure your account hasn't been compromised? Most of these websites you mentioned (if not all) require you to click the registration link for the accounts to actually activate. So either -Your account has been hacked - in which case yes you need to change all your passwords. Or -These are spoofed emails and aren't genuine in the first place -Someone is registering using your email address and the websites aren't checking the address actually belongs to them. If it is the last two, then just ignore it, anyone can type in your email address, that is the nature of the internet, and there is nothing you can do about it nor is it your responsibility to advise incompetant websites who fail to do proper checks that it is a bogus registration. You could advise your colleagues or IT team just so they are aware, however just because you got dodgy emails doesn't mean you did anything dodgy, hopefully they know this!!!

Are you absolutely sure laptop has correct IP settings etc? Can you post an ipconfig /all output from laptop and perhaps do an "ifconfig" on the smoothwall and show the output? The fact it isn't responding to ping suggests something is fundamentally wrong (this is normally allowed regardless), also, presumably you have rebooted the smoothwall after configuring the settings?

Have you switched WiFi off on the laptop? Depending on configuration if it realises there is no internet access via wired it just shuts it off and tries to direct all traffic out via the WiFI. The other thing you could do is install Wireshark on the laptop and see what IP address the smoothwall is chatting on, that may get you a bit closer. Failing this you can log into the smoothwall via keyboard/video/mouse and type in "ip addr" and "ifconfig" to verify the IP address settings it actually has.

How did you know you were being DDOSed by those IPs? What sort of traffic/attack was it? You can probably alleviate the issue a bit by closing off any inbound ports that are opened unnecessarily. This won't help the actual DDOS but the attacker might give up with the attack if you've closed down whatever they are trying to hit. For example, if you've got RDP and websites available to the internet, you could switch them off for a day or so and see if the attack goes away. What is your bandwidth? If your pipe is big enough (say 100Mbps+) then whether you have paid for DDOS mitigation or not ISPs will generally start applying their own mitigation because it is in their interest to stop large quantities of data coming into their network only to be discarded at the customer site, which is why it seems unusual to me that you are being so badly affected. Could it actually be that one of your internet facing services is being attaked (a webpage etc) which is what is actually causing the main issues?

Yes known bug (now fixed), the other thing you could do is put pressure on esafe to change their code such that it can cope with the certificate error. If you're a small single site just regenerate a new HTTPS interception certificate and roll out, that is probably the easiest bet. Was fixed in Kenilworth-4 iirc - think something alludes to it in the release notes actually if you have a gander.