To troubleshoot, if you get a voltmeter, make sure to use an old analog one. The voltage dip may be too quick for a digital one to detect. With a good analog one, you can watch the needle drop for a second if there is a quick dip.

I'm going Hyper-V. It has more features than even the paid Essentials Edition of VMware. Since pretty much all my production machines are Windows, I'm more comfortable in front of a Microsoft OS.

If you replace the battery, do yourself and the next guy a favor and write the date that you installed it on the battery or the battery cover, so the next time this happens you know how old the battery is.

If it's not one of the smart ups models with the software, you can just unplug it to see if it will carry the load. This isn't the safest thing to do since you're unplugging the ground when you do this, but it's a down and dirty way to test the UPS.

When the printer tries to heat up the fuser from being in power save mode, it probably causes a voltage drop on that circuit.

It sounds like the battery in your UPS is shot or something. If it's more than 3 years old just replace it. If you have the PowerChute software (or what ever it is for your model) you can run a load test and see if the battery can carry the load.

@wrx7m said in supporting an office of computers with full drive encryption:

I saw this marked as solved but can't seem to find the post that mentions the solution/what the OP ended up doing.

I was wondering how much time it would add to my job if I took on a client that was using full disk encryption. After a few posts it was clear that it would be additional overhead.

@FATeknollogee said in Home Lab Hypervisor?:

Any of you Hyper-V guys tried this at home? https://xenappblog.com/2017/setup-nano-server-as-nas-for-home-lab/
I set one up 3 days ago, was pretty easy & painless.
I then fired up a second instance & imported it to XenServer, it was almost too easy...

Do I understand it correctly that Nano Server uses the same license as standard server? (so Nano consumes the same license that a standard server would?)

If it was just printers I wouldn't think twice about just using some APs in bridged mode. For PCs I would make sure their (the users) expectations are set correctly and make sure you don't have a some database application that is real sensitive to latency running on the link. As cheap as it is to try, I would try it for one set up and then do the rest if it meets their expectations.

@scottalanmiller said in supporting an office of computers with full drive encryption:

You can include the program files on the D drive. It's not too hard to look at the apps that you will be using and see where they store data.

I was trying to figure out how to make your suggestion work.

@scottalanmiller said in supporting an office of computers with full drive encryption:

Just a general note about all operating systems made today and as long as I can remember... none of them would care WHERE a binary is run from, that does not affect to where it would write temporary files. IE being moveable or not is certainly not a factor in Windows. Nor would it be in Linux, BSD, Solaris, AIX, Mac OSX, etc. The location of a binary does not have that kind of influence. That's simply the space on disk that it comes from.

no, but in a two drive scenario if IE was on the encrypted drive, there would be no way for the user to launch it unless they decrypted the secure drive.

The requirement from the security policy reads:

*Any devices connected to your computer or network containing or accessing Confidential Information must use encryption software. In addition, any device that is used to login to (application name) or other web based software containing Confidential Information must use encryption software.

Encryption is necessary even if you only access (application name) or other websites. When accessing various types of data, such as viewing a PDF or accessing certain websites, a temporary file containing hidden data from the sources could be saved to your hard drive without your knowledge. Because temporary files are often saved to your computer in these scenarios, the most prudent assumption is that your hard dive WILL include some element of Confidential Information. This is the underlying reason the breach notification laws in some states require you to notify clients when an unencrypted device is stolen.*

This is why I think I need to encrypt the entire drive.

@scottalanmiller said in supporting an office of computers with full drive encryption:

Standard method is to have all user accessible space on a different volume. Like a D drive (partition.) That way the system can fire up, get patched and be used like a normal system but the data you need to protect can only be accessed with a password (or something) to allow it to decrypt.

I assumed the entire drive had to be encrypted, but you suggested I didn't have to encrypt the entire drive.

@scottalanmiller said in supporting an office of computers with full drive encryption:

You can include the program files on the D drive. It's not too hard to look at the apps that you will be using and see where they store data.

We're going back to this. My thought is that Internet Explorer is not movable and you can't force it to store temp files on an encrypted drive unless you encrypt the entire drive.

If the computer is stolen, they don't want confidential files left unencrypted on the drive.

@Tim_G said in Windows updates automatically rebooting outside of maintenance window:

I have a wsus 2016 guide / how-to on spiceworks.

Do you have a link? I couldn't find it.

The requirement is that temporary files from using the web based software are not left unencrypted. In the suggestion that the drive is not encrypted so that OS patches can happen I don't think that will work. If the user can launch IE without decrypting the secure drive, it fails the requirement.

@black3dynamite said in supporting an office of computers with full drive encryption:

That's just user profile data. Are you talking about redirecting the user profile?

No , the question is two fold. First, can you install internet explorer to a secure volume so it can't launch unless they unlock their secured drive? Second If IE can't be installed on an alternate path, if the path to their temporary files is unavailable, will Windows just dump them somewhere else?

Hyper-V. It's what I have been rolling for production so it only makes sense to have it in my lab so I can test stuff.

@scottalanmiller said in supporting an office of computers with full drive encryption:

Are you asking if IE just starts putting private data anywhere? That seems very unlikely. What makes you think that?

If you log in to windows and your profile isn't available, Windows creates a temporary profile for you and runs under that. This isn't the exact case since you would have to have to unlock your secure volume after you log in and your profile loads, but I'm thinking the behavior would be the same.

yes - hyper-v rebooted on two different physical hosts at different sites for different customers.

side note - I spun up a Windows 2016 server on Vultr Friday and installed WSUS on it. I took screen shots, so hopefully a guide will follow. I didn't find one - but on the other hand, this hasn't been very complicated either.