Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
skipdogg
Nov 29, 2004
Resident SRT-4 Expert

Wouldn’t it be easier to just run an AD report on your win7 computers, or is tracking down who has them the issue?

Adbot
ADBOT LOVES YOU

Wizard of the Deep
Sep 25, 2005

Another productive workday
Yea, you should just be reviewing AD, and making people get new equipment.

If that's not politically feasible, Welsh is a language pack available in Windows 7.

mllaneza
Apr 28, 2007

Veteran, Bermuda Triangle Expeditionary Force, 1993-1952




charity rereg posted:

Like I still think this is the difference between "really really big office" and "enterprise" - the costs for even 3 years of support on a lot of this stuff are rounding errors to us.

Yeah. I multiplied the $20 cost for extended Win 7 support by the number of Win 7 machines connected to instruments and... we have workstations that cost more than that[1]. We'd spend more than that in Change Control meetings[2] to plan the implementation of me deploying the .exe that registers a machine for extended support by pushing acouple of buttons in KACE[3]


[1] Computational Biology has some compute nodes with 2 TB RAM.
[2] We spend a lot on catering.
[3] It also involves some copy & paste in the generic "deploy an executable" script. I only have to touch two variables defined at the top of the script.[4]
[4] I should make the command-line switches a variable.

nielsm
Jun 1, 2009



klosterdev posted:

Now that W7 is mostly migrated, I need a way to get any remaining W7 laptops on the domain out of the woodwork.

What's a GPO I could hit W7 systems with that would cause a situation that would be annoying enough that the users will have to give us a call, but is remotely reversible (so no breaking the NIC) once I can get their info down and a promise to bring their laptops to HQ?

Hot Dog Stand color theme.

buffbus
Nov 19, 2012
Or just a group policy scheduled task to give them a popup every hour or something. Can either WMI filter the GPO or toss it in an existing GPO and use ILT on the task preference.

klosterdev
Oct 10, 2006

Na na na na na na na na Batman!

skipdogg posted:

Wouldn’t it be easier to just run an AD report on your win7 computers, or is tracking down who has them the issue?

Wizard of the Deep posted:

Yea, you should just be reviewing AD, and making people get new equipment.

I'm fairly sure there are several laptops that are sitting in random employee drawers that they were assigned before we had any inventory control system that only ever get used once in a blue moon. Gonna do a review of recently authenticated W7 systems soon once we're sure all W7 systems we can find are out, but I can't just go by all W7 objects themselves because nobody used to delete the computer objects when they were decommed.

So if I can just make something obnoxious happen that teeechnically doesn't prevent them from working when they authenticate a few months from now, it's another thing I won't have to think about until they call.

bobua
Mar 23, 2003
I'd trade it all for just a little more.

Not sure where to ask this.


I've got 2 guys with ipads that want to access files from a windows smb share when out and about. They have vpn, and an app that supports smb folders, but its pretty terrible. No shortcuts, browsing folder interface is just a poor experience, lots of steps. The files are 99% accessed by other users via windows shares locally so I can't just toss them in a drop box or one drive for these couple of guys. There are a lot of players in this space, anyone have some good recommendations?

EoRaptor
Sep 13, 2003

by Fluffdaddy

bobua posted:

Not sure where to ask this.


I've got 2 guys with ipads that want to access files from a windows smb share when out and about. They have vpn, and an app that supports smb folders, but its pretty terrible. No shortcuts, browsing folder interface is just a poor experience, lots of steps. The files are 99% accessed by other users via windows shares locally so I can't just toss them in a drop box or one drive for these couple of guys. There are a lot of players in this space, anyone have some good recommendations?


I used Acronis Access (now Files Advanced?) in the past with good success. Easy to set up and deploy, correctly impersonates the user for access rights, does need a port forwarded through your firewall, but can use any one.

Thanks Ants
May 21, 2004

#essereFerrari


Acronis is way to go, definitely don’t mess around with WebDAV

Precambrian Video Games
Aug 19, 2002



Thanks Ants posted:

I think you’d need to put Windows 8.1 on, let it activate from the key stored in the BIOS and then do a Windows 10 upgrade if that’s still a thing. Been ages since I used a Windows client that wasn’t 10 so I’m very rusty.

For the record, this did in fact work. Thanks for the suggestion. The 8.1 upgrade required downloading the full ISO whereas 10 used the media creation tool but both worked and never asked for the key.

The 5 minutes I spent in 8.1 reminded me why I downgraded in the first place. What a shitshow that was.

AlternateAccount
Apr 25, 2005
FYGM

bobua posted:

Not sure where to ask this.


I've got 2 guys with ipads that want to access files from a windows smb share when out and about. They have vpn, and an app that supports smb folders, but its pretty terrible. No shortcuts, browsing folder interface is just a poor experience, lots of steps. The files are 99% accessed by other users via windows shares locally so I can't just toss them in a drop box or one drive for these couple of guys. There are a lot of players in this space, anyone have some good recommendations?

Does the native Files app not do this in a satisfactory way?

peak debt
Mar 11, 2001
b& :(
Nap Ghost

eXXon posted:

The 5 minutes I spent in 8.1 reminded me why I downgraded in the first place. What a shitshow that was.

I get PTSD every time I have to work on a 2012 server.

Mr. Clark2
Sep 17, 2003

Rocco sez: Oh man, what a bummer. Woof.

Anyone here using Intune to manage Android Enterprise (Samsung) phones and Managed Google Play? I've set up the connector between Intune and the managed play store and when I approve apps, they subsequently show up in Intune and I can assign them to groups, etc. The problem that I'm running into is that the apps never show up on the phone itself. When I open up the play store on the phone, I only see the Intune app and MS Authenticator and both of those are auto-installed during enrollment. Searching the play store for an app assigned to the device yields no results. The Intune dashboard always shows the managed app status as "Waiting for install status".
Things seem to be working OK otherwise. I can remotely lock the phone/change passcode and when I make changes to the config policy in Intune, they get pushed down to the phone so I know that the the phone and Intune are at least communicating.

Internet Explorer
Jun 1, 2005





Yes, been dealing with Intune/Android Enterprise lately. How long have you waited between approving the app to the user/device and it not showing up on the device? I have seen it take 6+ hours before. Honestly, the syncing of policies and things seems to take for loving ever in Intune and manually syncing it in the portal or on the device doesn't seem to help. There's an article where Microsoft goes over sync intervals, but either the process is so awful that I can't make heads or tails of it, or it just doesn't work properly.

https://docs.microsoft.com/en-us/intune/configuration/device-profile-troubleshoot

Mr. Clark2
Sep 17, 2003

Rocco sez: Oh man, what a bummer. Woof.

Internet Explorer posted:

Yes, been dealing with Intune/Android Enterprise lately. How long have you waited between approving the app to the user/device and it not showing up on the device? I have seen it take 6+ hours before. Honestly, the syncing of policies and things seems to take for loving ever in Intune and manually syncing it in the portal or on the device doesn't seem to help. There's an article where Microsoft goes over sync intervals, but either the process is so awful that I can't make heads or tails of it, or it just doesn't work properly.

https://docs.microsoft.com/en-us/intune/configuration/device-profile-troubleshoot

I enrolled a phone last Friday and when I checked it on Monday it had received the appropriate compliance policy and config profile...but no apps. I just wiped and re-enrolled the phone again today, I'll leave it on overnight and see what happens.

Internet Explorer
Jun 1, 2005





And those apps were synced from Play to Intune and the app was approved for that user/device on Friday? Should have pushed down.

If you're not pushing the app and just making it available, I have seen odd things with the Work Profile Play Store, where it doesn't show all the apps but if you search or force close and reopen they will show up.

Mr. Clark2
Sep 17, 2003

Rocco sez: Oh man, what a bummer. Woof.

Yep. I approved the app, assigned it to a group (I've tried both required and available) confirmed that the phone is in the group with the app assigned to it and....nothing. Open up the play store on the phone and the app isn't there. Checked under 'My work apps', nothing there either. Search for the app, no results found. Restarted the phone several times now with the same result. Config changes made through Intune at the same time get picked up by the phone, so the sync does seem to work to some degree, just not for apps. I've opened a ticket with Intune support so we'll see where that leads.

kiwid
Sep 30, 2013

I have a question regarding SPF for email.

Previously we had a web app configured to send email through Mandrill both with authentication and encryption. Our SPF record included Mandrill's SPF and all was good and SPF was passing.

Then our parent company acquired us and had us change our email to go through their ProofPoint relay without authentication or encryption over port 25. Our SPF record was changed to use ProofPoint's SPF but it was failing because our web server IP wasn't in the SPF record. If we are using ProofPoint's SMTP then why would it appear to be sending from our web server and need our web server IP in the SPF record? Is it because of no authentication or something?

BangersInMyKnickers
Nov 3, 2004

I have a thing for courageous dongles

kiwid posted:

I have a question regarding SPF for email.

Previously we had a web app configured to send email through Mandrill both with authentication and encryption. Our SPF record included Mandrill's SPF and all was good and SPF was passing.

Then our parent company acquired us and had us change our email to go through their ProofPoint relay without authentication or encryption over port 25. Our SPF record was changed to use ProofPoint's SPF but it was failing because our web server IP wasn't in the SPF record. If we are using ProofPoint's SMTP then why would it appear to be sending from our web server and need our web server IP in the SPF record? Is it because of no authentication or something?

I'm guessing your webserver is still configured to use mandrill as its smtp relay, but you'll need to check the configs and logs there. Should just be a matter of pointing it at your Proofpoint cluster and configuring the PP cluster to accept relay mail from the webserver IP. If the webserver is delivering directly to the world without bouncing through PP then your record will need to look like this:

code:
domain.com	text = "v=spf1 a include:spf-[cluster#].pphosted.com -all"
The a statement will do an A record lookup for domain.com and allow your webserver to send out email. Keep in mind that SPF is looking at the last IP address that touched the message before it arrived at the recipient domain doing SPF inspection. But you really should be configuring your Proofpoint box as the relay for your webserver and deliver through there so you have a singular mailflow.

FYI Proofpoint does support encrypted SMTP. When the mail daemon makes its initial EHLO it responds with the extensions it supports. This is off a 8.13.8 cluster:

<<< 250-ENHANCEDSTATUSCODES
<<< 250-PIPELINING
<<< 250-8BITMIME
<<< 250 STARTTLS

It's opportunistic encryption and generally certs aren't validated because email is a legacy clusterfuck, but you can do the work to enforce it for certain domains.

kiwid
Sep 30, 2013

BangersInMyKnickers posted:

I'm guessing your webserver is still configured to use mandrill as its smtp relay, but you'll need to check the configs and logs there. Should just be a matter of pointing it at your Proofpoint cluster and configuring the PP cluster to accept relay mail from the webserver IP. If the webserver is delivering directly to the world without bouncing through PP then your record will need to look like this:

code:
domain.com	text = "v=spf1 a include:spf-[cluster#].pphosted.com -all"
The a statement will do an A record lookup for domain.com and allow your webserver to send out email. Keep in mind that SPF is looking at the last IP address that touched the message before it arrived at the recipient domain doing SPF inspection. But you really should be configuring your Proofpoint box as the relay for your webserver and deliver through there so you have a singular mailflow.

FYI Proofpoint does support encrypted SMTP. When the mail daemon makes its initial EHLO it responds with the extensions it supports. This is off a 8.13.8 cluster:

<<< 250-ENHANCEDSTATUSCODES
<<< 250-PIPELINING
<<< 250-8BITMIME
<<< 250 STARTTLS

It's opportunistic encryption and generally certs aren't validated because email is a legacy clusterfuck, but you can do the work to enforce it for certain domains.

Proofpoint is definitely configured as the relay. We completely deleted our Mandrill account so it couldn't possibly be sending through there anymore. I believe this might just be an issue with rules they have setup instead of SPF. Email delivered to external people SPF (and also DMARC) are passing with Proofpoint as the relay. Though internally the email gets rejected because of SPF hardfail with our web server IP as the sender. I'm starting to think it's another problem masquerading as an SPF fail, like something configured wrong.

Thanks for the help.

BangersInMyKnickers
Nov 3, 2004

I have a thing for courageous dongles

kiwid posted:

Proofpoint is definitely configured as the relay. We completely deleted our Mandrill account so it couldn't possibly be sending through there anymore. I believe this might just be an issue with rules they have setup instead of SPF. Email delivered to external people SPF (and also DMARC) are passing with Proofpoint as the relay. Though internally the email gets rejected because of SPF hardfail with our web server IP as the sender. I'm starting to think it's another problem masquerading as an SPF fail, like something configured wrong.

Thanks for the help.

Yeah, you need to scope the SPF module so its only firing on your inbound mailflow, not on allowed relay traffic which would cause what you are seeing.

kiwid
Sep 30, 2013

BangersInMyKnickers posted:

Yeah, you need to scope the SPF module so its only firing on your inbound mailflow on not on allowed relay traffic which would cause what you are seeing.

That's probably it, I'll see if I can pass that along to the team working on this.

mllaneza
Apr 28, 2007

Veteran, Bermuda Triangle Expeditionary Force, 1993-1952




AlternateAccount posted:

Does the native Files app not do this in a satisfactory way?

Does files do that on a modern iPad ? 'cause that'd be super handy for a thing at work.

The Fool
Oct 16, 2003


mllaneza posted:

Does files do that on a modern iPad ? 'cause that'd be super handy for a thing at work.

Yes. As of iOS 13

incoherent
Apr 24, 2004

01010100011010000111001
00110100101101100011011
000110010101110010
What a loving poo poo-show this windows 7 cannot shutdown has become.

GreenNight
Feb 19, 2006
Turning the light on the darkest places, you and I know we got to face this now. We got to face this now.

Good. I hope Microsoft breaks Windows 7 more and more.

kiwid
Sep 30, 2013

Nooo, my Mom's DVR is still running Windows 7 cause they killed off WMC, the best thing to ever come out of Microsoft.

Sudden Loud Noise
Feb 18, 2007

kiwid posted:

Nooo, my Mom's DVR is still running Windows 7 cause they killed off WMC, the best thing to ever come out of Microsoft.

I hear Plex is a good alternative now?

The Fool
Oct 16, 2003


Plex or Kodi would be the two best modern alternatives.

Thanks Ants
May 21, 2004

#essereFerrari


Or a DVR that can do Netflix or whatever other apps might be needed. A full PC setup might be overkill.

H2SO4
Sep 11, 2001

put your money in a log cabin


Buglord
If they're using something like a cablecard then just get them a tivo. I don't think there's anything else that will allow you to record copy protected content outside of OTA broadcast.

klosterdev
Oct 10, 2006

Na na na na na na na na Batman!
Any good recommended processes/resources to learn more about ticket auditing? Looking to improve our process and avoid (usually complicated) tickets falling through the cracks and sitting in purgatory, often caused by failure to escalate.

The Fool
Oct 16, 2003


Maybe ITIL ticket lifecycle/incident/request management? There's a pretty strongly defined process there that you might be able to adapt.

nexxai
Jul 17, 2002

quack quack bjork
Fun Shoe
Cross-posting from the [SPAM] thread:

Got a question for those of you on bigger teams - have you heard of software that can be deployed to a service desk that does some kind of conditional question asking?

Our offshore service desk doesn't do a great job of following instructions when they're all laid out in a single document and so what we're looking for is something that they can use that asks one question at a time, and then based on their answers proceeds through the troubleshooting steps like a choose your own adventure.

I feel like something like this has got to exist, but then again, maybe not?

MF_James
May 8, 2008
I CANNOT HANDLE BEING CALLED OUT ON MY DUMBASS OPINIONS ABOUT ANTI-VIRUS AND SECURITY. I REALLY LIKE TO THINK THAT I KNOW THINGS HERE

INSTEAD I AM GOING TO WHINE ABOUT IT IN OTHER THREADS SO MY OPINION CAN FEEL VALIDATED IN AN ECHO CHAMBER I LIKE

nexxai posted:

Cross-posting from the [SPAM] thread:

Got a question for those of you on bigger teams - have you heard of software that can be deployed to a service desk that does some kind of conditional question asking?

Our offshore service desk doesn't do a great job of following instructions when they're all laid out in a single document and so what we're looking for is something that they can use that asks one question at a time, and then based on their answers proceeds through the troubleshooting steps like a choose your own adventure.

I feel like something like this has got to exist, but then again, maybe not?

At last job this was integrated into our ticket system, you'd select the high level issue and then the system walked you through questions/steps based on different selections.

Also some sections forced you to put notes in i.e. answering a question, so that if the ticket got escalated the person that picked it up would have a running start without having to badger the phone agent.

MF_James fucked around with this message at 21:42 on Feb 17, 2020

nexxai
Jul 17, 2002

quack quack bjork
Fun Shoe

MF_James posted:

At last job this was integrated into our ticket system, you'd select the high level issue and then the system walked you through questions/steps based on different selections.

Also some sections forced you to put notes in i.e. answering a question, so that if the ticket got escalated the person that picked it up would have a running start without having to badger the phone agent.
Do you remember what ticketing system this was part of? We currently use FreshService, so I don't know that we'd change, but I can't even come up with a proper Google-able search string to help me find any options, and so the ticketing system's website might have something that I can use to find a similar, broken-out piece.

The Fool
Oct 16, 2003


nexxai posted:

Do you remember what ticketing system this was part of? We currently use FreshService, so I don't know that we'd change, but I can't even come up with a proper Google-able search string to help me find any options, and so the ticketing system's website might have something that I can use to find a similar, broken-out piece.

Freshservice has "dependent fields" they'd probably be a pain to set up for more complicated issues, but might help.

nexxai
Jul 17, 2002

quack quack bjork
Fun Shoe

The Fool posted:

Freshservice has "dependent fields" they'd probably be a pain to set up for more complicated issues, but might help.
Yeah, that's kind of the system we're using right now, but for massive decision trees, it's effectively impossible to manage.

The Fool
Oct 16, 2003


After some quick googling, https://zingtree.com/ advertises itself as integrating with FreshDesk not sure if that carries over to FreshService or if it will really do what you want.

Adbot
ADBOT LOVES YOU

nexxai
Jul 17, 2002

quack quack bjork
Fun Shoe

The Fool posted:

After some quick googling, https://zingtree.com/ advertises itself as integrating with FreshDesk not sure if that carries over to FreshService or if it will really do what you want.
Goddammit, I should have just Googled "decision tree software". Thanks for this; looks exactly like what we need.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply