QUOTE(modslave @ Dec 4 2009, 05:14 PM)

So on a recovered banned console it would be advisable only to do the Nand protect, to enable dash upgrade when needed without screwing secdata.
But for exploitable consoles you should do both the Nand AND remove R6T3?
(Of coarse using a toggle switch so nand is not protected all the time)
No, you should *not* write protect the NAND on a box that is connected to Live and gets updated! This is dangerous misinformation I'm afraid. If you leave R6T3 in place but write protect the NAND, then you risk bricking the console: CB updates first blow an efuse, and *then* reflash the NAND, so it will disable your current CB version and then fail to install the new one, leaving you with a box that doesn't boot at all and must be manually recovered by rebuilding a new NAND image for it (this seems to be *very difficult* for current kernels).
There is no sensible way to protect an xbox that keeps connecting to live and updating from being crippled. The best you can do is to take a backup of the NAND to use to uncripple it, and then after each update back up the NAND again. If you get banned, you can use the most recent backup to uncripple the xbox without any messing around with having to find an old copy of secdata.bin, as long as your backup is the same version of the kernel/dash as the one currently on the box.
If you have an exploitable console there is no real need to write protect the NAND, but you can if you want. Removing R6T3 is sufficient to stop updates, because the first thing the update does is try to blow the CB lockdown efuse and if that fails it will stop with an error. Even if something *does* write to the NAND you always have the ability to reflash it from a backup.