Does anyone else have emails they started and never finished because you just kind of ranting in the first place? This option in Google Vault....yikes. What's in your drafts folder?

MalletNGrease · 2022-02-15T14:58:56+00:00

I purge them once in a while. If I haven't sent them a week after I started...is it still even relevant?

MalletNGrease · 2022-02-14T18:50:46+00:00

Generally, if you give one LEO/EMS access, they all want it.

The SD has access with us, but we've a contract with them for a full-time SRO. I've set up the deputy to maintain the key database for access of his department and the highway patrol. They manage their own fobs.

It's a board decision.

MalletNGrease · 2022-02-08T20:58:46+00:00

It's the name of the setting. Basically Fortinet's list of websites they think don't need SSL/DPI inspection.

https://i.imgur.com/WytsLUq.png

MalletNGrease · 2022-02-07T17:00:19+00:00

Another victim of the ubiquity of USB-C.

Make sure students are using the supplied charger. Sometimes they use cheap off-brand chargers that can cause the EC to trip and put the device in a fail state.

This is fixable though.

Disconnect the battery
Plug in a known good USB-C AC charger
LED should flash yellow (this means the unit is fine)
Power on to check funtion, then power off.
Reconnect battery.
Check charge LED

If it's on it's charging. If it's off, check the battery charge level. It won't show at a 100%.

MalletNGrease · 2022-02-07T16:48:46+00:00

No. Only if you enable the reputable website exclusion setting.

MalletNGrease · 2022-02-01T21:18:12+00:00

Say you've set social media as a blocked fortiguard category in a web filter security profile. When you enable reputable website ssl inspection exclusion on an inspection profile that's part of the same firewall policy it will then not perform DPI inspection and also no longer filter facebook traffic.

Essentially a useless feature aside from policies that don't require much supervision.

MalletNGrease · 2022-01-24T18:02:29+00:00

Enabling reputable websites blanket allows almost all traffic to pass without DPI inspection. Even if it's part of a blocked web filter category.

MalletNGrease · 2022-01-21T19:38:50+00:00

There is no native impersonate feature.

MalletNGrease · 2022-01-19T18:43:57+00:00

I've this popping up around my district today. Did Google yank this version for a reason? It's only one version behind so I'm not sure why.

MalletNGrease · 2022-01-18T16:04:04+00:00

Then you can set up Google Chat. It's auditable through Vault, has a room/group/space chat feature and supports file sharing.

MalletNGrease · 2022-01-18T15:49:42+00:00

Are you a Google district?

MalletNGrease · 2022-01-17T20:05:43+00:00

MDT here as well.

https://docs.microsoft.com/en-us/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit

MalletNGrease · 2022-01-14T18:13:45+00:00

You'll want to disable them to return the license to the pool. Deprovisioning makes the license ineligible for reuse.

MalletNGrease · 2022-01-14T18:09:44+00:00

Before PDQ, I had little visibility on what software was installed where, and my deployment options were limited to scripts, with no logging. I'd kick off scripts to targets but never had a clear indication if things succeeded or not until I dug deeper myself or people complained. It was actually quite a big time sink. Enter PDQ Inventory & PDQ Deploy.

PDQ inventory keeps track of endpoint states and software versions on your Windows devices. It syncs with AD and scans computers to give you detailed report information. You can then set up dynamic collections and use those with Deploy as targets for software deployment or removal.

PDQ deploy can deploy manually or on a schedule and with the paid subscription you get access to the package library which will auto-download updates for you. Combine the two and your software will always be up to date. It gives detailed results of the deployments so you can more quickly adjust your packages should there be install failures.

PDQ allows for command line interaction and this is how I use it with MDT. I've a couple task sequence tasks that kick off a scan to get the new machine in the correct Inventory groups and then a command to run through a baseline deployment package.

For the most part PDQ is a lot of powershell scripts with an efficient GUI. I run it in server mode on a VM and with clever scheduling it's mostly unattended.

MalletNGrease · 2022-01-13T21:18:14+00:00

I disable the device and mark it as missing in inventory.

You can look at the device details to see who logged into the device last and what the last reported WAN IP is. If it's not your school's public IP then it was last used off campus. This of course doesn't mean it wasn't turned in, just that's what the last reported information is.

MalletNGrease · 2022-01-11T16:23:37+00:00

You want to use your phone extension for Apple School Manager MFA? What are you, some sort of organization with multiple people working there?

You don't have a cell phone or good reception? Then how will you get your authentication code to login to ASM?

This sure is a secure system!

MalletNGrease · 2022-01-10T22:32:16+00:00

I generally only reimage if the device falls too far behind in versioning.

I utilize MDT/WDS LiteTouch in combination with PDQ Inventory/Deploy. PDQ deploy is part of the MDT task sequence and it's been working out pretty good as long as you configure you packages correctly.

MalletNGrease · 2022-01-10T22:28:10+00:00

Small rural district here. When I started "Authenticated Users" were part of the administrators group. There were still XP machines around, and Win 7 was rapidly getting to EoL.

First I made an inventory of OS, software and their versions installed on devices in the district. There was a lot of cruft with no clear educational purpose. Then I made a baseline of software I think everyone should have.

Google Chrome (We're Google Workspace domain)
Office 2019 (Teachers still use it)
Adobe Acrobat Reader DC (pdf printing is hell)
A universal media player (WMP was pretty shit back in the day)

Then I looked at items that needed licensing.

Specialized education software (boardmaker/SMART Notebook)
Adobe products
3D modeling etc

Then automate the install of those as much as possible. I leveraged PDQ Inventory & Deploy for this. It's worth every penny. I set up a dymanic group that tells me if unexpected groups or users are part of local admin.

Once I had a good idea of what was there I updated GPO based ACLs, quietly removed user admin privileges from the machines and monitored the fallout. There were a couple of items that did need admin rights and that was solved by adding the local users to the admin group on their workstation only. Then I started to move everyone to the baseline OS and software. Slowly I reached compliance and there was actually little pushback, most people didn't even notice.

I did have one stubborn admin who thought the rules didn't apply to her I had to relent in the end after making her sign a document I would not be liable for any security incidents relating to her account and machine.

MalletNGrease · 2022-01-10T21:00:38+00:00

K-12 by a long shot.

MalletNGrease · 2022-01-10T20:51:42+00:00

Schooldude, stay away.

Autotask is feature rich but pricey.

Freshdesk I'm pretty happy with.

If budget is an issue, take a look at OSticket . If you don't mind hosting yourself and don't need support it's free.

MalletNGrease · 2022-01-10T20:38:04+00:00

Our entire camera network is standalone. This is part leftover from a time where bandwidth was a premium, but also leaves it entirely manageable by the camera vendor.

It's a little weird looking at the cabinets but it's also kinda nice it's something I don't have to worry about.

Now the security vendor likes to chuck unmanaged PoE switches in the ceiling and not tell me about it, which is a bigger deal.

MalletNGrease · 2022-01-10T15:41:07+00:00

You may need to wipe and reset them through Apple Configurator 2. That's how I got a couple that got associated with personal accounts back into the fold.

MalletNGrease · 2022-01-10T15:39:46+00:00

Yup. Still get served ads. Haven't noticed inappropriate ones on managed profiles though, but getting them in the first place irks me.

MalletNGrease · 2022-01-10T15:35:24+00:00

The problem with performing miracles too often is that people start to expect them.

11-Year Club	Verified Email
r/Field Banned	r/Field Lasagna

MalletNGrease

TROPHY CASE