Serverless Schools - Thoughts, Tips and the Reality!

[free780]

I'd be interested as my current testing with Intune just isn't as good as GPOs and Configmgr.

[Mr.Ben]

It is just different. I'm deploying only 3 scripts. One to enable bitlocker for the device, one to kick off known folder migration for the user and a final one to put shortcuts on the desktop for all users.

[chaplic]

Nothing too exotic and it's only 50 devices in total, but I've built it as I would in the day-job for tens of thousands of devices. So core build just has needed software and all config done via GPO, no manual config. There's a baseline win10 policy which all devices share and then a teacher device policy for a couple of bits of software and bitlocker. I also take care to poke registry settings in to stop programs nagging on first run or prompting to update etc.

 

Staff and Pupil have different user polices, pupils locked down, staff not really just things to make their life easier (like proxy settings). No one has admin rights.

[snagrat]

Interested in what you mean by locking down Pupils?

 

I’m hiding the c: drive, disabling Settings but that’s about it

[mavhc]

Can you set applocker/srp via intune? Seems like having to use reg script etc is a bit of a step backwards from GPO though.

[free780]

You can do applocker via intune but requires a reference PC/VM.

[ConceroEdu_Brad]

Hi @Mr.Ben

 

I just wanted to say that it is refreshing to read your approach to the serverless school.

 

I would appreciate the opportunity to have a chat if that was possible to pick your brains. I'm part of a large ship which takes time to change direction but I believe we're steering towards the the same direction as you.

 

With regards to licensing, I'm curious as to why you haven't gone for the Microsoft 365 approach?

[Mr.Ben]

Hi @Mr.Ben

 

I just wanted to say that it is refreshing to read your approach to the serverless school.

 

I would appreciate the opportunity to have a chat if that was possible to pick your brains. I'm part of a large ship which takes time to change direction but I believe we're steering towards the the same direction as you.

 

With regards to licensing, I'm curious as to why you haven't gone for the Microsoft 365 approach?

Hi @BradleyClegg

 

Not a problem at all - PM me some details and I'm more than happy to have a chat!.

 

I intend to go the 365 licencing next year - I'm just below EES numbers so we are looking to buy as a consortium with the local authority that I worked with before - it works both ways as with my numbers we would reach the 3000 units mark and this will keep the price down.

 

Two reasons for not going with it this year:

 

1) 365 doesn't include on prem rights, so until I'm closer to 'full' compliance I don't want to be a a position that I'm unlicensed. I might be wrong in that, but it's my interpretation!

 

2) We have a 2016 OVS with great pricing that it seemed sensible to extend. The desktop pack & EMS was less than 365. I can't do this next year as the agreements term will have ended.

Edited July 9, 2019 by Mr.Ben

[chaplic]

We are now on this journey too and Similar to Mr Ben with licenses. With Azure AD Premium, I've created a generic MFA rule in conditional access and applied it to everyone, excluding the schools IP ranges. Also blocked legacy protocols. Ipads are intuned-up, though I didn't realise we have ipad 1's, only supportng IOS9 which the intune company portal does not. Given by definition intune on ipads will be used by organisations looking to sweat assets this seems a mis-step by MS.

 

I've migrated the first fileshare to sharepoint, for this I created a team then migrated the content using the MS sharepoint migration tool. No plans to use teams but just seemed a bettter approach to use a sharepoint embedded in a team from the start. Finally I then configured onedrive to sync the teamsite to the PCs, so the user experience can be broadly similar.

 

 

I've been set a little back on my desire to be serverless, as none of the switches can be a DHCP server, plus I need somewhere to host a proxy.pac file, plus spiceworks/ prtg/ kms. However, what I can do is have a server that's almost 'stateless' in that it doesn't host any data, so I am looking at couple of old laptops as mini servers. They fit nicely in comms cabinets, come with built in UPSs. One can back the other one up, I don't need to worry about off site backup as if we lose both, meh, we've got bigger problems and all the data is in o365.

 

My windows autopilot/ no domain joined build is progressing, albeit slowly. There's a LOT more stuff in intune but tailoring a PC the way you want demands a much higher skill level than GPOs. Getting apps into intune is a bit fiddly too.

 

I've also realised that my older laptops I won't be able to natively autopilot as the drivers don't exist, so I need a MDT sequence that ends up with a Azure AD join prompt having installed drivers etc.

 

We have a SIMS server that I think uses old fashioned fileshares to access stuff and given my plans is to not use domain accounts that could be tricky, but I think I can Azure AD join the sims box, then share out the fileshare with AZUREAD\[email protected] perms.

[chaplic]

Posting my progress to share and encourage others to contribute.

 

The windows 10 build that automatically joins Azure AD only is just-about good-to-go, also installs pro-plus where I've elected to remove SkypeFB and move to teams. I had quite a lot of apps deployed to all via MSI, so incorporated them in the build.

 

For hosting proxy.pac, I am experimenting with having each PC run it's own webserver, then the IE setting points to http://localhost/proxy.pac. The pac file itself has a PROXY council.internet.proxy; DIRECT statement. This means it will work seamlessly outside the school environment. Not done much testing yet, but if it works well it's one less thing to host on a server and have to worry about high availability.

KMS is the other thing I need; I just went to the MS licensing portal to grab it to find it's not there, a bit of FAQ reading shows that they don't just hand them out any more so I've raised a ticket. However, it did get me thinking that MAK may be more convenient, and if I put the MDT build on a stick means a machine can be built anywhere and active without even going into the school. I'll make my decision when MS get back to me. Downside of MAK is that even though the limit is generous, I can see us busting it with rebuilds etc. What do you do?

 

 

I still haven't resolved how to do pupil laptops; right now we have a generic login per year group (it's a primary) then the senior pupils have their own login. Given we're using proplus I cannot use generic year group accounts as that will bust the activation limit on proplus. My initial plan was to use ProPlus device based activation which is available for edu, but further reading says it's only available in the US...

 

Current plan is to have a per-laptop account, so create AzureAD accounts called Laptop1.. Laptopn, then have them setup with windows hello PIN login of 1234, and then some conditional access rules to limit their use outside school. Data to be stored in a shared teamsite. I am not sure how to handle desktop (make read only?) and my documents (redirect into shared teamsite)?

 

I have also realised how many GPO customisations I've done (things like remove welcome screens from apps on first login etc) which all need to be ported to Intune. Windows Analytics is configured but nothing is reporting, I don't know yet how I'll do IP printing...

 

But getting there!

[mavhc]

> Por hosting proxy.pac, I am experimenting with having each PC run it's own webserver, then the IE setting points to http://localhost/proxy.pac. The pac file itself has a PROXY council.internet.proxy; DIRECT statement. This means it will work seamlessly outside the school environment. Not done much testing yet, but if it works well it's one less thing to host on a server and have to worry about high availability.

 

Confused, how will that work when the computer is at home? The pac file will still be available.

 

Seems kinda crazy to go to all that work to avoid having 1 device with an http server on the network.

 

> KMS is the other thing I need

 

https://docs.microsoft.com/en-us/windows/deployment/windows-10-subscription-activation

 

> right now we have a generic login per year group (it's a primary).

 

Make it easier for primary kids to login with biometric/qr codes/etc?

 

> I don't know yet how I'll do IP printing...

 

Can always just print straight to the printer itself.

[chaplic]

> Por hosting proxy.pac, I am experimenting with having each PC run it's own webserver, then the IE setting points to http://localhost/proxy.pac. The pac file itself has a PROXY council.internet.proxy; DIRECT statement. This means it will work seamlessly outside the school environment. Not done much testing yet, but if it works well it's one less thing to host on a server and have to worry about high availability.

 

Confused, how will that work when the computer is at home? The pac file will still be available.

 

Seems kinda crazy to go to all that work to avoid having 1 device with an http server on the network.

 

 

The pac file returns two settings to the browser; the first being the proxy server, the second a DIRECT command (i.e. don't use a proxy). When at home the proxy isn't there, so it goes to the second setting, DIRECT.

 

I was worried there would be a performance hit, but seems OK. You're right a simple HTTP server is hardly a big deal, however I do this practically voluntarily so am not always available to troubleshoot, plus I detest single points of failure. I can choose when to work to design in availability to avoid support effort when I may not be free.

 

Right now, the PAC file is located on two servers which are also DNS servers. The PAC file is set to http://pac.proxy.pac/proxy.pac on the clients.

when the DNS server is queried for pac.proxy.pac, it only returns itself, so I have crude form of load balancing where if the server is down, clients grab the proxy pac from the other server. I don't want to make the service less available.

[Mr.Ben]

Posting my progress to share and encourage others to contribute.

 

The windows 10 build that automatically joins Azure AD only is just-about good-to-go, also installs pro-plus where I've elected to remove SkypeFB and move to teams. I had quite a lot of apps deployed to all via MSI, so incorporated them in the build.

 

For hosting proxy.pac, I am experimenting with having each PC run it's own webserver, then the IE setting points to http://localhost/proxy.pac. The pac file itself has a PROXY council.internet.proxy; DIRECT statement. This means it will work seamlessly outside the school environment. Not done much testing yet, but if it works well it's one less thing to host on a server and have to worry about high availability.

KMS is the other thing I need; I just went to the MS licensing portal to grab it to find it's not there, a bit of FAQ reading shows that they don't just hand them out any more so I've raised a ticket. However, it did get me thinking that MAK may be more convenient, and if I put the MDT build on a stick means a machine can be built anywhere and active without even going into the school. I'll make my decision when MS get back to me. Downside of MAK is that even though the limit is generous, I can see us busting it with rebuilds etc. What do you do?

 

 

I still haven't resolved how to do pupil laptops; right now we have a generic login per year group (it's a primary) then the senior pupils have their own login. Given we're using proplus I cannot use generic year group accounts as that will bust the activation limit on proplus. My initial plan was to use ProPlus device based activation which is available for edu, but further reading says it's only available in the US...

 

Current plan is to have a per-laptop account, so create AzureAD accounts called Laptop1.. Laptopn, then have them setup with windows hello PIN login of 1234, and then some conditional access rules to limit their use outside school. Data to be stored in a shared teamsite. I am not sure how to handle desktop (make read only?) and my documents (redirect into shared teamsite)?

 

I have also realised how many GPO customisations I've done (things like remove welcome screens from apps on first login etc) which all need to be ported to Intune. Windows Analytics is configured but nothing is reporting, I don't know yet how I'll do IP printing...

 

But getting there![/quote @chaplic I've gone with MAK, Microsoft are happily upping the count each time I need it raised.

[mavhc]

Really the solution is for whoever's providing the proxy to a) have a transparent proxy option so you can host the pac file whereever and configure it to be available, and b) host their own pac file so you can configure your dns to return that as wpad, or whatever domain you return in dns.

 

The point of WPAD is when wpad server isn't available (ie you're at home) it goes to no proxy straight away.

[lmrogers]

Just want to quickly jump in on this one and ask a quick question. With devices that are running purely on Azure AD and run through AutoPilot are you using the MAK Key to license them or KMS Key? And are you licensing them through the Edition Upgrade profile in InTune?

 

Thanks

[free780]

Well I guess the proper way to do it is subscription licensing linked to the user for Windows 10.

[snagrat]

Just want to quickly jump in on this one and ask a quick question. With devices that are running purely on Azure AD and run through AutoPilot are you using the MAK Key to license them or KMS Key? And are you licensing them through the Edition Upgrade profile in InTune?

 

Thanks

 

I had to use the MAK.

We only use the KMS for ADBA so wouldn’t apply to the Intune devices.

 

I did it through the license upgrade section. I imaged machines (that weren’t brand new and enrolled in AutoPilot from manufacture) to Win10 Pro and then let the enrol process take it up to Education

[chaplic]

Posting an update here (previous updates on the previous page) to help others and encourage any input.

 

 

 

My plan was to roll this out (serverless end user computing) over the summer, I've somewhat missed that target! In my defence, I've been doing this in my spare time, probably doing 3-4 hours a week on it.

 

 

I concluded I do need a device in the school, so there' s an intel nuc in there running server 2019, just there to run test VMs and also be the MDT server (and run DHCP as I dont have another device capable of it). The schools business manager has a seriously beefy PC so when she wasn't looking I've installed hyper-v and its running minimal Server 2019 just as a DHCP server.

 

The build itself is just about there. There's a heck of a lot of powershell scripts in there to do customisations that would have been trivial to do in GPO.

 

For pupil laptops, and after consultation with teachers, I have them setup with one azure-ad-account-per-laptop, and that Azure AD account has Office365 ProPlus licensed. I've setup a Teamsite that's synced to the PC. A powershell script periodically checks for presence of the teamsite, then when it's present it pokes a few reg keys in to redirect mydocs, desktop etc to it, the theory being some saves a document to desktop or mydocs its available on all machines. I did read on here that someone abandoned something similar due to slow syncs and people logging off, so we'll see how it goes.

 

Taking development from test VMs to real laptops has been painful; we have two models of laptops on one of them it dies randomly during the MDT where it's transferring data (it works via a USB stick so I'm suspecting some sort of network driver issue). And on the model that does build, when I was building them at my home office no software was being deployed via intune. The Intune Management extension wasn't being deployed.

 

What I believe it to be is that the BITS client is not parsing proxy.pac properly; the proxy pac (hosted on the laptop) says 'Use the school proxy, if not available go direct)' but whilst IE etc is fine, the bits client carps about the proxy not being available. Furthermore, it looks like the intune management extension only deploys through the intiial first time login bit of autopilot). changing proxy settings afterwards doesn't cause IME to kick in to life (manually installing it works fine).

 

I also had an issue where I had a Azure AD group that deployed extra software to teachers PCs. However, regardless of group membership it was deploying to all devices. I raised an MS ticket but gave up the will to live with this one (missing having an MS account manager I can shout at) and assigned teacher software to teachers not their devices.

 

So overall it's been a bloody nightmare and a few times I've questioned why I'm doing this. The prize being the school network is basically little more than an internet connection, the DR plan becomes trivial, I have less maintenance to do, and Intune/ Win10 is only going to get better (like many of us I remember GPOs before GPP!). It's also the way the industry is going, so getting in at the first level is beneficial for me.

[mavhc]

Bit odd to run dhcp on some random desktop machine, it's a very simple protocol, surely one of your switches or WLCs or routers does it

[free780]

Why only 1 azure ad account per laptop? You can have shared devices within intune with edu policies. Granted the Onedrive Sync client is disabled. How does filtering work as when I asked Smoothwall they said theres no mechanism for Smoothwall to talk to AzureAD? I'm guessing Impero or similar doesn't work properly on these laptops? It's the shared device/safeguarding etc that isn't there yet in a pure cloud environment.

[snagrat]

Why only 1 azure ad account per laptop? You can have shared devices within intune with edu policies. Granted the Onedrive Sync client is disabled. How does filtering work as when I asked Smoothwall they said theres no mechanism for Smoothwall to talk to AzureAD? I'm guessing Impero or similar doesn't work properly on these laptops? It's the shared device/safeguarding etc that isn't there yet in a pure cloud environment.

 

For us we use Netsweeper that can authenticate against AAD.

[chaplic]

Bit odd to run dhcp on some random desktop machine, it's a very simple protocol, surely one of your switches or WLCs or routers does it

 

 

Someone suggested that and I thought' 'of course' - but I checked them all (all three of them) and no. All manageable, have SNMP and what-have-you but no DHCP service.

 

 

Why only 1 azure ad account per laptop? You can have shared devices within intune with edu policies. Granted the Onedrive Sync client is disabled. How does filtering work as when I asked Smoothwall they said theres no mechanism for Smoothwall to talk to AzureAD? I'm guessing Impero or similar doesn't work properly on these laptops? It's the shared device/safeguarding etc that isn't there yet in a pure cloud environment.

 

it's a primary school and all device use is supervised. Right now there is a generic account per year. So if I was to maintain the status quo, Id get caught in too many office activations trap. Device based activation would solve that issue but that doesn't appear available either..

Edited January 18, 2020 by chaplic

[Mr.Ben]

How are you deploying office?

[snagrat]

How are you deploying office?

 

Intune will deploy Office

[chaplic]

Intune will deploy Office

 

 

Yeah, that's a quite nice part of intune an about the only thing that that doesn't make me think MS hate us lot. Click a couple of buttons and you've got an up to date office on your machines.

 

That said, I still use MDT as none of the machines have drivers built into windows so a pure autopilot doesn't work, so at one stage I remove it from intune and added it as the first part of a 2 stage image and figured I may as well save the time of a 300MB office download every time. On reflection that was possibly a mistake as credit due, intune does pull down and install the apps pretty quickly.