dmj

On the contrary. This is a technical forum, and we like technical answers. I'd personally like to see a technical breakdown, how the systems were compromised, with what? How did the attackers escalate their privileges? What did they encrypt? How did you get alerted? What could you have done to mitigate the problem, what have you done? I'm sure there are many more questions. Answering these points would go a long way to help others mitigate attacks. saying we rode out the problem and it's all ok now doesn't really help anyone.

It's pretty shoddy for a vendor to not know what ports their application uses and to not bother configuring the firewall rules. On the other hand, I don't expect applications to be responsible for server configuration - that's usually the system administrators role. It seems unclear who is responsible for the system - you as the sysadmin or inventry as the vendor?

Moral of the story is review the code before they deploy it to production

Retraining budget vs pay the fee

I think it's best to have teaching and support staff involved. We'd always be on hand in the introductory lessons to solve those issues.

Our IT (teaching) department ran introduction sessions to year7 as a first lesson, they'd just print out the randomly generated passwords and hand them to the students. the lesson would cover the rules, AUP as well as how to log in. There was always some difficulty timetabling these lessons in with a large cohort.

https://learn.microsoft.com/en-us/windows-server/storage/file-server/smb-signing?tabs=group-policy

^^^ if the SMB server supports signing then this is the way forward

IIRC MS recently changed the SMB client on windows 11 so that they have to authenticate against signed SMB servers. Presumably this is so that it makes things more difficult and organisations throw out their old NAS servers and everyone migrates to (microsofts) cloud - I can't think of an actual security reason why it's necessary on an internal network (they could just remember the trusted share is signed and always connect to that) You probably need to tell the clients to trust an unsigned SMB share.

I don't think it's necessary, but It might be useful if you regularly need to get another team involved in a change, or to be clear who to direct comms to (and who is sending the comms). Full blown RACI might be OTT.

Interesting, especially in light of the BBC micros using ARM, and the new ARM devices - feels like going full circle to when I was at school. There's some really good documentaries on computing history here if you are into that sort of thing: https://www.youtube.com/@Asianometry/videos

We don't tend to do RACI for SOP's, because they are literally standard procedures, so they've already been authorised and are well understood. We do have RACI for changes that are NOT SOP's, in which case it's the team that proposed the change is responsible, the service owner is accountable, developers/architects/testing engineers are consulted and anyone else is informed.

That's how I would approach it, because it's more easily extensible to apply to monitor other things and more centrally managed - but if you need to display notifications to the user then a login script is probably the way forward.

I know this is really easy to do in GSuite because it can share logs with Google Cloud, so you just set up an alert based upon any metric the logs sees. For Window's I'd be inclined to use a similar method and get a notification on login to the domain controller if you are using one. What are you using to parse logs currently?

It be fair, it's probably a configuration issue as to why they are not deploying consistently. If you don't want to use GPO then there are plenty of free and open source windows configuration tools that will centrally deploy printers: Ansible module: https://github.com/daBONDi/ansible-role-win-printer-driver puppet: https://forge.puppet.com/modules/dsc/xprintermanagement/readme

https://github.com/linux-surface/linux-surface/wiki/Installation-and-Setup

I don't think there will be much distinction in the future. Google are already experimenting with running chromeos ontop of android so you can just plug your phone into your monitor/keyboard, and I can see us being able to plug them into bare-bones laptops soon. (It's why I believe the Govt is very short sighted banning phones in schools when it is the obvious route to driving tech, they should be providing ways to make it work, but that's another debate.) Also the server market is rapidly growing with ARM, and 99% of linux stuff works fine (which is the vast majority of servers).

python, c#, rust, java - I could go on... or fix the GPO issues?

I don't think management will be the biggest barrier. One of the best thinks about windows (and also it's Achilles heel) is that management is simple through registry keys and file management and open api's. There are already alternatives to Microsoft supported management tools that work well for managing windows,mac,linux. Given there's a compatibility layer I can't see there would be an issue running these on arm windows. If your tooling isn't working then change the tooling rather than have it dictate what software you can run. I think the biggest barrier to windows arm is windows itself; the insane amount of telemetry and bloatware which make it perform poorer in everyday tasks in terms of resource usage.

We seem to be able to manage Chromebooks, MacBooks and Linux in a corporate setting ok...

Haven't they already done that with macbooks and chromebooks ?

Don't forget the AI monitoring everything you do so that it can report back "to give you helpful suggestions"

The drive's dead for sure. If you put it in a freezer overnight, you might have enough time to be able to get a partial image from it if you are lucky. I've seen that work and not.

Yeah, the estimate turned out to be pretty good. The actual attrition was 20% over three years. We'd buy in bulk for each yeargroup (300 is students) so would buy 360 machines and sell them back to parents with 3yrs support. I don't think we ever needed to pay for additional parts as we always had stock. School would pay for FSM or discount is there was more than one child from the same family.

I didn't find this to be an issue. I ran a 1:1 device scheme with 2000 devices and we allowed 20% for repairs. There will be enough broken bodies/mainboards that you will be able to salvage the screens from. These were Lenovo Yoga's though so other brands may not be as robust. (£180 at the time, but this is going back a few years now).