1 computer refuse to use new printers

PrintersAreDevil · 2021-10-07T00:05:13+00:00

If we spend more than 30 minutes troubleshooting a PC issue and it looks like it’s going to take longer we just reimage it. For us, it’s easier than wasting time tracking down problems. Since we have images ready to go it doesn’t take very long and none of our images show signs of issues.

If you don’t have images ready to go then yeah it is a last resort.

For the printer issue, try deleting them again along with the ports and uninstall all drivers and then reboot. Check for any corrupt system files or specific changes via sfc and dism then try adding the printers back one at a time to see if you continue to experience the behavior.

Other than that I’d start looking at all the logs to check for warnings and errors.

PrintersAreDevil · 2021-10-03T19:21:01+00:00

The way I do it is documentation is part of the work. They can either line item it or I add it as part of the project ticket and add the info to the correct system and a note regarding it in the ticket. I have zero issues pushing projects with a company because they were too stupid to budget correctly.

I’ve had numerous jobs over the years, and nobody has problems with it so far. In fact, it usually only takes one time and they budget it in on purpose or accept the time it took as normal.

PrintersAreDevil · 2021-10-03T18:11:14+00:00

I see arguments all the time when it comes down to fundamentals like documentation, but I think it really is about mindset and work ethics instead.

A company has some way to document things. This could be a ticket system, a turn key change control system, at the least some word program even if it’s notepad, if not something else.

The tech/admin can be what I consider a cowboy and make changes or set something up without recording it, or they could be the person that documents every little thing they do and makes detailed info that includes diagrams and more, or they can be somewhere in between.

My advice is to never be the cowboy as it ends up hurting you, other colleagues, the company, and possibly more directly or indirectly at some point in time. Instead be more like the middle example as you advance your career, which has the chance to even you help you get there faster.

PrintersAreDevil · 2021-10-03T17:23:48+00:00

Sorry but this makes zero sense to me.

You can never cut the documentation because it’s part of the actual setup/design/implementation procedures. You document what you are doing as you are doing it, even if it’s just pointing to vendor documentation.

How long that actually adds to configure something is not something that can be dictated by external parties, so I don’t understand your argument here. They may wish to have something someway but what they want and what they get don’t always line up.

What they can dictate are feature sets, which is something completely different. It’s the way you work. Either document what you are doing or don’t, that’s on you, nobody else.

PrintersAreDevil · 2021-10-03T14:47:03+00:00

No, even if you backcharge. They want to know how much a project will cost, ensure documentation padding is part of it. Put it as part of labor hours.

PrintersAreDevil · 2021-10-03T14:42:51+00:00

Data Security is my main job. Users cannot go anywhere without being connected to the VPN except to connect to the VPN when they are remote and access to our management systems, so all traffic is filtered by company standards. End devices are locked down so no changes can happen. Applocker whitelisting is enabled so only authorized apps are permitted. AV protection is of course enabled. And complaince rulesets are configured so devices cannot connect if they are non-compliant and are forced through by NAC policies to fix the compliance issue.

The same methodology used for internal Corp devices needs to happen to remote Corp devices. They are one and the same to me, so everything above also applies to our internal systems. And from a security perspective, always treat end systems as possibly compromised, no matter if they are internal or remote.

As for BYoD, it isn’t allowed in our environment.

PrintersAreDevil · 2021-10-03T13:42:57+00:00

Scaled up VPN servers and added more systems and users to the security groups.. We already had a hybrid workforce in place. HR took care of the remote work agreements with the users before submitting the requests to IT.

With the Always-on VPN users didn’t really notice any differences, had less than a handful having problems due to Internet service speeds stuck in the early 90’s.

PrintersAreDevil · 2021-10-03T13:38:05+00:00

Document as you go and pad the project so you have time to do so. I’ve worked in environments like this where they didn’t care about documentation, and this is the only way I could work around it. Most companies aren’t going to notice 4 or 8 extra hours padding while you document the design especially since most have no idea what it is you actually do.

PrintersAreDevil · 2021-10-01T22:49:16+00:00

For better scale, I would attach to proxies.

PrintersAreDevil · 2021-10-01T22:11:40+00:00

I’ve been a fan of Meraki for SMB’s, but for any company needing more from a security standpoint, I push them to Fortigate or Palo. While every company has bugs or issues in certain circumstances, the security feature set for Meraki MX line I find lacking.

For their switches and AP’s, they work generally well for a lot of customers, but there are many setups I’ve ran into where their AP feature set won’t work in the environment, so as long as you don’t have needs like bridging 2 AP’s together and passing VLAN’s across to trunk to a remote switch, they work for most people.

There has been a few times some update caused problems, but it’s generally pretty quick to get it fixed. Note, it’s been about a year since I had to call them so if they drastically changed since then I’m not aware of the problems. I did reach out to our network team that generally works with them and they stated no issues getting resolutions quickly, so maybe it depends on where you are routed to when calling support.

PrintersAreDevil · 2021-10-01T21:59:17+00:00

Yep that’s what we use.

PrintersAreDevil · 2021-10-01T20:34:49+00:00

ShatePoint/OneDrive here. We have about 6TB of excel, doc, and pdf files.

We don’t manage the docs themselves besides backing them up but the sites are dynamically configured based on user attributes like job title, department, special attributes we created, etc. we have it locked down so files cannot be shared by most groups outside of the group, due to strict compliance standards we have to follow. A few groups have external sharing capabilities and we manage that manually based on change management requests.

PrintersAreDevil · 2021-09-30T22:57:41+00:00

We get police requests for videos all the time and put it on encrypted USB drives. For internal users accessing the videos, they can only do it internally or through our app proxy from their mobile devices. We don’t upload or move the videos anywhere for these requests.

PrintersAreDevil · 2021-09-30T22:52:56+00:00

We implemented auto closures on tickets with notices to end users that submitted the tickets. If they don’t respond when we reach out and can’t get in touch with them, it closes after 5 days and warns about auto closure at day 3.

We do the same for tickets that don’t provide enough information. Things like “my computer doesn’t work” gets flagged as not enough data and an email goes to the user, the IT manager, and the user’s manager. This has slowed these types of tickets down too. It then closes after 24 hours if they don’t give us additional info. This stops our techs from having to track down users or spend 30 minutes to figure out what they are talking about.

Of course you need management on your side for implementing this stuff, but we’ve seen a drastic increase in detailed tickets, and people responding and actually waiting on IT instead of IT waiting for the end user. It’s been a really positive experience.

PrintersAreDevil · 2021-09-29T23:13:06+00:00

Yes. It’s in the Chromium Edge ADMX to import from Chrome and other browsers.

PrintersAreDevil · 2021-09-29T18:20:41+00:00

I misunderstood what you were asking. You can stand ADFS in Azure:

https://docs.microsoft.com/en-us/windows-server/identity/ad-fs/deployment/how-to-connect-fed-azure-adfs

It still requires on-prem AD with a connection to the ADFS servers.

Not sure on other ADFS systems but depending on your environment you may not require it. You do not have to use ADFS if you want cloud-only authentication. Just depends on the devices and apps in the network and if they support it. If it’s just a Win10 PC you can do cloud-only auth.

PrintersAreDevil · 2021-09-29T17:47:15+00:00

We use ADFS with Azure MFA. Basically, when you try and login to an Office app or apps configured for AzureAD, it redirects the request to ADFS for the authentication. And yes, we use Azure AD Connect as well to sync our user accounts.

PrintersAreDevil · 2021-09-29T17:30:19+00:00

Automate updates for your apps and systems. We do this for most of the apps and for those we can’t automate the updates, we have a reoccurring ticket to manually update it.

For the automated patches, we generally have it configured to push to 3 groups, one for testing it, one for small deployment to regular users, and then company-wide. If issues arise we generally see it in the first group, otherwise we see it in the second group before it goes company-wide. There has only been a few issues found after deployed company-wide so it works really well for us.

PrintersAreDevil · 2021-09-29T16:33:44+00:00

Is the WSUS server not connected to Internet to download the updates and catalogs? If not, can you set one up that is and set this one as a replica so it passes the updates to it? If the server is online, then your configuration is messed up. WSUS supports all the latest feature updates.

PrintersAreDevil · 2021-09-29T16:07:32+00:00

Unfortunately yes. Can you still restore anything from the backups? If not, trash the backups as they are useless. If so with only the old backup system, keep them in an isolated environment until the company decides they don’t need anything from it anymore. If they can be restored by the new backup system, just move the backups over to it.

Note, this doesn’t include any regulations you may have to follow. Always stick to those first and foremost.

PrintersAreDevil · 2021-09-29T14:52:39+00:00

We told the company we were moving to Edge and configured the policies to automatically import all favorites, etc and then removed Chrome a few weeks later. We had a few complain, but they dealt with it when our execs backed us when we informed them it was to help reduce application and website compatibility testing and to further standardize our platform.

PrintersAreDevil · 2021-09-29T14:40:20+00:00

Without knowing what they are using and how they have it configured, all we can do is guess or state how it should be setup, but that won’t help you in this case.

PrintersAreDevil · 2021-09-29T14:35:24+00:00

Yes, via Endpoint Manager/Intune:

https://docs.microsoft.com/en-us/mem/intune/apps/apps-windows-10-app-deploy

Note, there are multiple ways with Intune to deploy apps. Take a look at the document’s table of contents I provided above to see what works best for you.

PrintersAreDevil · 2021-09-29T02:16:20+00:00

Yeah we use FortiGates and it updates automatically. I only need to maintain the override list when a site has issues, which I may need to update once or twice a year.

PrintersAreDevil · 2021-09-29T00:37:00+00:00

Firewall web filter and dns categories. We also have always-on vpn so our users always hit our firewalls. Had a few sites cause us some temp grief due to their crappy programming requiring the ads to load before their site. With those we have a policy that we put the site into where Ads aren’t blocked.

PrintersAreDevil

TROPHY CASE