@ntoxicator said:

So What is it that K12 environments use for user profiles and user data? Being that no user files are saved to workstations.

They teach users to save to network drives, and they learn quickly else they lose data. Very few environments have a true need for roaming profiles and they usually suck anyway.

There's also cloud storage type options too own cloud, Pydio etc.

Your over complicating this. Just because someone is getting GPOs applied doesn't mean the server needs to be right there. It's Minimal traffic, and most of those things you mention like printers aren't going to be changing often, it will sync the GPO locally to the computer and apply it, it will only need to update if the GPO gets updated in the domain after that

@Dashrender said:

Why does this user get to dictate what they use for email access?

We let them use it if they have a mac but, we don't support it. If they complain that's their own fault.

Comodo provides them

https://www.carbonblack.com/ they are good for executable whitlisting. Though a developer there once had his computer compromised by not having the software installed, and got malware pushed out with the product because he didn't tell anyone. But let's not talk about that haha.

@Dashrender said:

Can an entire cryptoware solution be done purely in VBScript? If so, then disabling Macros seems like a requirement as a next step.

Good luck with that. Many people write their own macro's in excel to help with their jobs.

@Dashrender said:

@Jason said:

How are those Doc Files getting in anyway? does your solution not include a cloud spam/email filter to pull out things like that?

Pull out things like what? Zeroday exploits?

Files that have macro's in them. No reason those would be emailed from the outside.

Same here. Maybe your MSP file for deploying office has it set to off.

If you mean the SAN (as in Storage Area Network, not the SAN Devices) was all static, that is completly normal. You don't normally put DHCP in SANs

Why does it need to be secure? the PSTN you connect to for most calls isn't even remotely secure.

Also many phones support using SSL certs to connect to the PBX without a VPN. Pretty sure Yealink has ones that do. I think Grandstream can to. You can also use SFTP for config.

Autodesk audits are nothing run a tool to pull network licesnse servers info and standalone seats on the network and done. No where near anything like Microsoft. We get hit with auto desk audits almost yearly. Nothing complex or confusing about it so as long as you are only using what you paid for you're good to go.

@Dashrender said:

@Jason said:

@MattSpeller said:

Dell, i5, 8gb, small ssd = happy users

I avoid the small form factor cases because they don't have good airflow.

Small SSD? You can get after market 512gb for around $100

Why spend $100 when $60 will do for a 120 or even 256? By company policy, no one is suppose to have any data on the local machine. My new Windows 10 images take around 25 GB, anything more than that is just a waste of space and money.

No data at all on local computers? What about your outlook profile? That's always local and can easily be 50GB+..

120GB will not do. Not for us. Maybe if all you install is windows and office that's fine.

Yeah we have required legal retention on email in our archive so what the user keeps does n;t matter.

We use WDS approx 30,000 users. The number of users wouldn't really affect how you image if you plan it right. It's not like every user has their own image.

SCCM isn't worth the trouble. You really don't gain much when you count all the time you have to put into it.

Dell KACE is probally one of the best/most flexible options out there. Not cheap though..

I know you can fully disable it with GPO that's not what I want. We have an app which needs a laucher to work. It's called in the desktop shortcuts but if they pin it after being opened it will go to the EXE after the launcher directly. Is there a way to block shortcuts calling certian exe's from the taskbar? even if it's powershell or something..

@coliver said:

Powershell has changed drastically. Every version is different then the previous one. The one thing that seems to remain the same is the awful Verb-Noun commands. Don't get me wrong, the changes are for the better, but they are still fairly dramatic changes.

Not only that.. Linux Bash is easy and logical..

Powershell is not something you can just think of like linux you have to memorize every command because they are not logical or easy to remember at all.

Which does against the nature of any command line interface, even switches/routers like Cisco IOS.

Cisco network assistant does stuff like this for smaller setups. Not sure if it works with the fake cisco/SMB SG Line though.

http://www.cisco.com/c/en/us/products/cloud-systems-management/network-assistant/index.html

@LAH3385 said in [need program deployment (GPO) suggestion... Not how to but more

Because "they" want to use what we already have.

But, you don't really have it if you have to keep moving it around. I would not be surprised if this is a violation of the license as well.

@DustinB3403 said in I am paranoid?:

Odds are it was a Google crawler

Um.. No. Google crawler or anything like that does not try to login via SSH or anything..

Likely a botnet trying to break in the system they are non stop checking for standard ports to hack (SSH, RDP etc).

Why not setup an RDS server, get 10 RDS CALs. Configure Adobe Acrobat as a remote app. Lock the RDS users down to a security group. Change users of said security group every 30 days.

What Citrix product are we talking about? Xenserver? It's been open source for many years now.