Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us $3,400 per month for bandwidth bills alone, and since we don't believe in shoving popup ads to our registered users, we try to make the money back through forum registrations.
«230 »
  • Post
  • Reply
Newf
Feb 14, 2006
I appreciate hacky sack on a much deeper level than you.

The Fool posted:

um, just being connected to the VPN doesn't do it?

The thing is that there is no VPN. I suppose I'm asking about installing one, whether that is quick and dirty.

nielsm posted:

You can't sit in the parking lot and reach wifi?

That did occur to me, but we've received enough communication on this issue that it seems to not be a full suitable solution. In particular, there are staff members out of town with their computers, who are advised to stay where they are (this all happened during our spring break).

Adbot
ADBOT LOVES YOU

The Fool
Oct 16, 2003



Newf posted:

The thing is that there is no VPN. I suppose I'm asking about installing one, whether that is quick and dirty.

That depends a lot on your current infrastructure. If you have an edge appliance that has a built in client vpn, it should be fairly easy. But even then you will have a bunch of other considerations: like how are you going to handle authentication? and how are you going to deploy the client?

devmd01
Mar 7, 2006

Elektronik
Supersonik


E:;f;b

Thanks Ants
May 21, 2004

Bless You Ants, Blants



Fun Shoe

You've got a bunch of laptops that are now unreachable as far as managing them is concerned, and you need to implement VPN and then get the clients onto end user devices, and your end users all work at a school.

Do you have a hefty stock of booze?

Dirt Road Junglist
Oct 8, 2010

There's a ghost in me
Who wants to say I'm sorry
Doesn't mean I'm sorry






Thanks Ants posted:

Do you have a hefty stock of booze?

There's not enough booze for that.

klosterdev
Oct 10, 2006

Na na na na na na na na Batman!

Don't have to worry about KMS if your enterprise so behind the curve you still use MAK

Buff Hardback
Jun 11, 2019


Thanks Ants posted:

You've got a bunch of laptops that are now unreachable as far as managing them is concerned, and you need to implement VPN and then get the clients onto end user devices, and your end users all work at a school.

Do you have a hefty stock of booze?

Honestly I'm so happy I managed to A. get my old district fully moved over to MacBook Pros for teachers before I left and B. left right as the shelter-in-places started to kick in

You couldn't pay me enough money to be there right now

buffbus
Nov 19, 2012


Even then, KMS generally only needs about 2 check-ins per year. Machine key changes are client side driven and won't happen until the next domain connection after the expiration. This just sounds like a very aggressive account purge script and if that's the case, it should be suspended.

Newf
Feb 14, 2006
I appreciate hacky sack on a much deeper level than you.

Thanks Ants posted:

You've got a bunch of laptops that are now unreachable as far as managing them is concerned, and you need to implement VPN and then get the clients onto end user devices, and your end users all work at a school.

Do you have a hefty stock of booze?

Here's the great part: not actually my problem. I'm a teacher, not a tech, but I was intrigued by the problem and thought I'd ask here. Sounds like consensus is that it's a headache.

Potato Salad
Oct 23, 2014

Nobody Cares




Tortured By Flan

It's not really that bad. I'm sure the school district's IT staff can push out a VPN client over their OTA configuration/package management system!!

Tapedump
Aug 31, 2007


College Slice

.. and his name is Jimmy.

devmd01
Mar 7, 2006

Elektronik
Supersonik


My wife is a teacher and theyíre in the same boat, no VPN set up or configured. Her IT departmentís solution? Send everyone instructions on how to log in to their VMware horizon infrastructure.

And then didnít include any instructions on how to actually do a password change when dropped in to a win10 desktop....not everyone knows about Ctrl-alt-ins/end.

Potato Salad
Oct 23, 2014

Nobody Cares




Tortured By Flan

Tapedump posted:

.. and his name is Jimmy.

Dirt Road Junglist
Oct 8, 2010

There's a ghost in me
Who wants to say I'm sorry
Doesn't mean I'm sorry






devmd01 posted:

My wife is a teacher and theyíre in the same boat, no VPN set up or configured. Her IT departmentís solution? Send everyone instructions on how to log in to their VMware horizon infrastructure.

And then didnít include any instructions on how to actually do a password change when dropped in to a win10 desktop....not everyone knows about Ctrl-alt-ins/end.

Writing instructions for non technical people is a real skill that a lot of us should probably practice more (or go work for a corporation where you can slough that poo poo off on a tech writing team, and then point at them when the docs are bad.)

When I used to interview people for the help desk, one of our questions was to ask someone to explain how to tie a shoe to someone who doesnít understand shoes, knots, or feet.

devmd01
Mar 7, 2006

Elektronik
Supersonik


I took the latter option...as hard as I try to simplify, dumb it down, and keep to essential information I literally cannot wrote good tech instructions/communications for the average user. The hazards of knowing the intimate details about how tech poo poo works I guess.

Thankfully I do have someone I can work with for that special touch if I have a reason to send something out to the masses.

mllaneza
Apr 28, 2007


Veteran, Bermuda Triangle Expeditionary Force, 1993-1952





Dirt Road Junglist posted:

explain how to tie a shoe to someone who doesnít think they need to understand shoes, knots, or feet.

I'm pretty good at step-by-step documentation for the lay public, but even in those I'll provide summaries at the top of each section. "Now we're going to set the network adapter to DHCP, with manual DNS servers xxx.xxx.xxx.xxx and xxx.yyy.xxx.xxx, now here's every click to accomplish this. That lets someone who knows what they're doing skim through and get the specifics they need, and gives some overview for the novice who needs their hand held throughout.

And for documentation meant for other techs ? Set these two parameters in control panels, then open up gpedit.msc and enable these three policies.

Heartcatch
Oct 14, 2004



I write all of the documentation for end users for anything regarding the VPN. There's arrows, pictures, red circles around what they need to do and a numerical step-by-step. Unfortunately, I think maybe only 5% of the users read anything I write as they will call our poor help desk and claim that they never got the e-mail/looked at the VPN section of the intranet.

FRINGE
May 23, 2003
title stolen for lf posting


Heartcatch posted:

I write all of the documentation for end users for anything regarding the VPN. There's arrows, pictures, red circles around what they need to do and a numerical step-by-step. Unfortunately, I think maybe only 5% of the users read anything I write as they will call our poor help desk and claim that they never got the e-mail/looked at the VPN section of the intranet.

Painfully true. (Even the red arrows and circles.)

wyoak
Feb 14, 2005

a glass case of emotion



Fallen Rib

I have an existing O365 setup, and I'd like to bring in a new domain that has an existing on-prem Exchange installation as a hybrid configuration. My issue is that if I add the domain to Azure AD / Office 365, any mail coming from users already on O365 tries to route internally and bounces because those users don't exist within Azure yet - is there a way to add the domain to Azure/O365 without having O365 try to route mail to it? I can't setup AAD sync without adding the domain, but I don't want to bounce mail in the window between adding the domain and getting Hybrid mode going.

Beefstorm
Jul 20, 2010

"It's not the size of the tower. It's the motion of the airwaves."


Lipstick Apathy

wyoak posted:

I have an existing O365 setup, and I'd like to bring in a new domain that has an existing on-prem Exchange installation as a hybrid configuration. My issue is that if I add the domain to Azure AD / Office 365, any mail coming from users already on O365 tries to route internally and bounces because those users don't exist within Azure yet - is there a way to add the domain to Azure/O365 without having O365 try to route mail to it? I can't setup AAD sync without adding the domain, but I don't want to bounce mail in the window between adding the domain and getting Hybrid mode going.

You're looking for instructions like this...
https://docs.microsoft.com/en-us/ex...ilbox-migration

Also, to more directly answer your question, you add the domain, add the verification records to DNS, and have Azure verify it. That will not start routing email to O365 until you change the MX records.
Office 365 might complain that the MX, SRV, etc records aren't correct. But that won't stop you from using the domain to do AAD sync.

As long as you only add the TXT records for verification, you shouldn't break your email routing.

wyoak
Feb 14, 2005

a glass case of emotion



Fallen Rib

Beefstorm posted:

You're looking for instructions like this...
https://docs.microsoft.com/en-us/ex...ilbox-migration

Also, to more directly answer your question, you add the domain, add the verification records to DNS, and have Azure verify it. That will not start routing email to O365 until you change the MX records.
Office 365 might complain that the MX, SRV, etc records aren't correct. But that won't stop you from using the domain to do AAD sync.

As long as you only add the TXT records for verification, you shouldn't break your email routing.
Issue isn't with external domains routing, it's that mail originating from my O365 tenant doesn't make it to my on-prem mail server once I add the domain to Azure (and no DNS changes) - I've tested it with a dummy domain. Mail gets bounced by O365 saying the user doesn't exist.

devmd01
Mar 7, 2006

Elektronik
Supersonik


Add a transport rule that routes that domain to your on prem smtp.

Zaepho
Oct 31, 2013


wyoak posted:

Issue isn't with external domains routing, it's that mail originating from my O365 tenant doesn't make it to my on-prem mail server once I add the domain to Azure (and no DNS changes) - I've tested it with a dummy domain. Mail gets bounced by O365 saying the user doesn't exist.

As soon as you get AD Connect up and synced that won't be an issue as O365 will see that they exist in the On-Prem Exchange and will route them properly. There will be a short mail flow outage to get everything complete but if you get your DNS TTLs nice and short and carefully go through each step it should be pretty quick. The longest thing to deal with will be the ADConnect full sync time.

Beefstorm
Jul 20, 2010

"It's not the size of the tower. It's the motion of the airwaves."


Lipstick Apathy

Zaepho posted:

As soon as you get AD Connect up and synced that won't be an issue as O365 will see that they exist in the On-Prem Exchange and will route them properly. There will be a short mail flow outage to get everything complete but if you get your DNS TTLs nice and short and carefully go through each step it should be pretty quick. The longest thing to deal with will be the ADConnect full sync time.

Just enabling Azure AD Connect isn't enough to get mail flowing between the environments. You also need to setup the connectors between on-prem exchange and O365. You can use the Exchange Hybrid Configuration Wizard to set that up.

https://docs.microsoft.com/en-us/ex...guration-wizard

wyoak
Feb 14, 2005

a glass case of emotion



Fallen Rib

I'm thinking add domain and immediately setup hybrid, that way email will continue to flow, then do AAD sync

Maybe add an internal relay before even adding the domain to Azure? Back to the lab I go

Beefstorm
Jul 20, 2010

"It's not the size of the tower. It's the motion of the airwaves."


Lipstick Apathy

wyoak posted:

I'm thinking add domain and immediately setup hybrid, that way email will continue to flow, then do AAD sync

Maybe add an internal relay before even adding the domain to Azure? Back to the lab I go

You can add the domain before setting up hybrid. The mail just wont flow correctly until you setup the hybrid Exchange environment.

But, it is the right thing to do it in that order. You want to have your domain setup and able to authenticate properly before you start setting up Exchange Online.

Thanks Ants
May 21, 2004

Bless You Ants, Blants



Fun Shoe

Buy a random domain and add that to your existing on-premises environment and run through the entire process with that domain, making notes as you go and resolving any outstanding prerequisites, then go again with the domain that matters.

Zaepho
Oct 31, 2013


Beefstorm posted:

Just enabling Azure AD Connect isn't enough to get mail flowing between the environments. You also need to setup the connectors between on-prem exchange and O365. You can use the Exchange Hybrid Configuration Wizard to set that up.

https://docs.microsoft.com/en-us/ex...guration-wizard

You're absolutely right. Skipped over that step in my head for whatever reason.

Boywhiz88
Sep 11, 2005
Probation
Can't post for 41 hours!


Is this the place that I would ask stupid basic questions as I fumble my way through the Deployment Lab for SCCM that MS offers? Iím getting started on setting up the Azure subscription so I can work through those labs and wanted to verify that I can make any ole domain choice because Iím just testing anyway.

So, I could put whatever.onmicrosoft.com and be OK as long as no one else thought of it.

Happiness Commando
Feb 1, 2002
$$ joy at gunpoint $$



Probably, but if you want the really right place for stupid questions (and answers!) it's r/sysadmin

incoherent
Apr 24, 2004

01010100011010000111001
00110100101101100011011
000110010101110010


What is the modern way to build VPN profiles? I can manually create a VPN connection that works in the wifi\network GUI pop up but CMAK installed profiles bring up that horrendous vpn window.

thebigcow
Jan 3, 2001

Bully!

Boywhiz88 posted:

Is this the place that I would ask stupid basic questions as I fumble my way through the Deployment Lab for SCCM that MS offers? Iím getting started on setting up the Azure subscription so I can work through those labs and wanted to verify that I can make any ole domain choice because Iím just testing anyway.

So, I could put whatever.onmicrosoft.com and be OK as long as no one else thought of it.

If you're going to use it with your own domain it doesn't matter, except for OneDrive links which will still show the the onmicrosoft thing.

greatapoc
Apr 4, 2005


I've got a Dell R640 with 2x Xeon 4214R running Server 2019 with Hyper-V and there seems to be an issue where the logical processors aren't being utilized. Has anyone seen this before? I've tried Googling and can only find a bunch of discussions on whether hyperthreading should be enabled or not, nothing to do with whether the cores are actually being used.

https://imgur.com/a/vsWEB7Y

lol internet.
Sep 4, 2007
the internet makes you stupid

I have a home drive file server. Domain admin has full access to it on the permissions.

If I login to the file server and try to access that folder by going to D:\Blah\Homedrive. It literally adds my single account onto every folder. Why is this?

klosterdev
Oct 10, 2006

Na na na na na na na na Batman!

Are you talking about when you grant yourself access to a folder? Folders are set to inherit permissions from the folders parent. (unless you've explicitly disabled inheritance on a particular folder)

MF_James
May 8, 2008
I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE


klosterdev posted:

Are you talking about when you grant yourself access to a folder? Folders are set to inherit permissions from the folders parent. (unless you've explicitly disabled inheritance on a particular folder)

I think he means that, he has user folders, domain admins have full access as does the user, but when he goes to access that folder as the domain admin "SeymourButtes" it explicitly adds SeymourButtes to the NTFS permissions list, despite SeymourButtes already having access due to domain admins being given full control.

The Fool
Oct 16, 2003



Donít use domain admin for file security. Make a separate ďFile AdminĒ group

Zaepho
Oct 31, 2013


lol internet. posted:

I have a home drive file server. Domain admin has full access to it on the permissions.

If I login to the file server and try to access that folder by going to D:\Blah\Homedrive. It literally adds my single account onto every folder. Why is this?

Domain Admin group gets dropped from your token by UAC after you log in because it's a well known high security group. Therefore, when you try to access the files and don't have rights, it gives you the option to elevate and add yourself to the structure.

The Fool posted:

Don’t use domain admin for file security. Make a separate “File Admin” group
Definitely do this. Domain admins should only be used when absolutely necessary.

lol internet.
Sep 4, 2007
the internet makes you stupid

Thanks. Will do.

Adbot
ADBOT LOVES YOU

lol internet.
Sep 4, 2007
the internet makes you stupid

Anyone have edge chrome deployed in the enterprise?

Trying to configure setting\bookmark sync with O365 account via GPO automatically. Anyone have any luck?

We're in a hybrid deployment, computers are not hybrid joined or azure AD joined. No Intune. It looks like the computers are "Azure AD Registered" and I believe it's from when I have users signing into the Microsoft app store. There's a prompt which says Allow your company to manage/sync settings of device.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply
«230 »