Wrapping real time UDP based protocals with TCP is in general a waste of bandwidth (your going to retransmit data that will actually make the quality worse if it is processed out of order).

@Minion-Queen N-Able has package management, but for SMB stuff Chocolatey is likely a better fit (N-Able can run a caching server which is nice in T1 hell holes).

Wrapping real time UDP based protocals with TCP is in general a waste of bandwidth (your going to retransmit data that will actually make the quality worse if it is processed out of order).

@NetworkNerd I'd like to point a few things. 1

1. QoS over the internet means nothing. Your carrier is not going to respect your tags unless its on a P2P or MPLS circuit.
2. Your carrier can't read tags on traffic if you encrypt it all together.

@Dashrender Spot on. If you manually uninstall the trusted certs (considering most browsers have half a dozen under the control of national security agencies, and national telecoms around the world this doesn't surprise me) in theory certificates will work fine. Remember its not about being unbreakable (XKCD points out that a $20 wrench will force most people to hand over their passwords) but about making it so that people can't DVR 5 years of your activities and go look back at them after the fact.

@Nic 56K speeds for Youtube (my favorite policy to set in Meraki wifi).!

@Nic Cool how you guys do both web/content as well as antivirus in the same service. For traveling laptop users that roam home, and outside the corporate firewall the "let my 5 yr old play games on it at home" seems to be a solid attack vector that this can stop.

@RoguePacket You can do Windows Enterprise now WITHOUT SA (its not cheap, but its doable).