[ipad] Mo' iPads, Mo' Problems

[seaweed]

Our school only has around 35 iPads for students and they are only for ICT lessons and after school clubs. I just log them in all in one single apple id and turn on icloud drive sync only. The ICT teacher asks the students to take screenshot of their work, put them on Page and save it with their name. Since icloud sync is on all the work saved will just appear in the drive and the ICT teacher just downloads it on one iPad or she would ask the students to upload work on purple mash. Recently started using Mosyle to manage all the iPads but it's not really necessary. Basically just using it to monitor iPads batteries and storage.

[Koldov]

I had a similar experience with a 'scheme of work', if you could call it that...

 

A few of years ago SLT purchased a set of books from 'Rising Stars' called... 'Switched on ICT' and these apparently sat in the cupboard until somebody thought we should actually get on and do the 'computing curriculum'...

 

Anyway, they thought they could just do everything in the books straight of the bat without consulting me... turns out they couldn't because the books reference a huge array of 'free' software that needs to be installed.

 

When it finally landed on my desk I started checking through some of the various software titles and found that versions had changed and instructions weren't correct, they were no longer free, needed licenses, or required accounts or a ridiculous amount of setting-up before they would work properly (permissions etc.) and then some of them just wouldn't...

 

We ended up with Purple Mash, which is just colour by numbers computing and web based, but at least the teachers don't need to think!

[LeMarchand]

A few of years ago SLT purchased a set of books from 'Rising Stars' called... 'Switched on ICT'

 

 

We ended up with Purple Mash, which is just colour by numbers computing and web based, but at least the teachers don't need to think!

 

The Rising Stars stuff may well have been the same scheme. My other two sites went for Purple Mash. Like you say, it's fairly basic, but - unless you have a super IT teacher to drive something more complex - it does its job adequately.

[Brimstone]

Our school only has around 35 iPads for students and they are only for ICT lessons and after school clubs. I just log them in all in one single apple id and turn on icloud drive sync only. The ICT teacher asks the students to take screenshot of their work, put them on Page and save it with their name. Since icloud sync is on all the work saved will just appear in the drive and the ICT teacher just downloads it on one iPad or she would ask the students to upload work on purple mash. Recently started using Mosyle to manage all the iPads but it's not really necessary. Basically just using it to monitor iPads batteries and storage.

1. You are breaking the T & C's of App licensing by having a single Personal Apple ID on all the iPads

2. If that Apple ID gets compromised in any way e.g. Phishing email the hacker now has access to schools data and possible photo's of children and can erase the iPads at will. Even if you have stop that if too guesses are made for the Apple ID password the account will get locked causing all sorts if misery for everyone.

3. If configured the right way students can just Airdrop the files to the teacher

 

This has happended in plenty of schools years ago where an individual Apple ID was required and the technican "thought" he could cheat.

 

You can't and this will bite you at some point.

[LeMarchand]

AAAAARRRRGGGGHHHH!!!

 

This is probably down to my imperfect understanding of Lightspeed and ASM but got a pad, told Lightspeed to "forget" it, which it has. However it still thinks it's managed and I cannot get it to re-enrol with the new, hopefully doing everything as discussed above, profile (or re-enrol at all). Still showing in ASM.

 

:frusty:

[seaweed]

1. You are breaking the T & C's of App licensing by having a single Personal Apple ID on all the iPads

2. If that Apple ID gets compromised in any way e.g. Phishing email the hacker now has access to schools data and possible photo's of children and can erase the iPads at will. Even if you have stop that if too guesses are made for the Apple ID password the account will get locked causing all sorts if misery for everyone.

3. If configured the right way students can just Airdrop the files to the teacher

 

This has happended in plenty of schools years ago where an individual Apple ID was required and the technican "thought" he could cheat.

 

You can't and this will bite you at some point.

 

We don't really use any paid apps, only free apps like Scratch jr and Tynker. Not sure if that still violates app licensing but I just took over whatever the last IT guy has left me.

We do have two factor authentication on and we never had apple id getting locked. Even if it does, wouldn't the iPad still works? It's only the icloud service and appstore being affected right?

I generally turn Airdrop off because kids in class would just airdrop all kinds of silly pics to their classmates.

I actually do have VPP set up and was thinking about transferring to it but all the iPads are not fully enrolled so I just left it until I have time to look into it.

So if I had transferred to VPP instead of one account for all. Do I not need to sign in anything on the iPads? Will iCloud still be usable?

[tmoon-mint]

We don't really use any paid apps, only free apps like Scratch jr and Tynker. Not sure if that still violates app licensing but I just took over whatever the last IT guy has left me.

We do have two factor authentication on and we never had apple id getting locked. Even if it does, wouldn't the iPad still works? It's only the icloud service and appstore being affected right?

I generally turn Airdrop off because kids in class would just airdrop all kinds of silly pics to their classmates.

I actually do have VPP set up and was thinking about transferring to it but all the iPads are not fully enrolled so I just left it until I have time to look into it.

So if I had transferred to VPP instead of one account for all. Do I not need to sign in anything on the iPads? Will iCloud still be usable?

 

Your setup would be much better using VPP and a managed Apple ID instead of a personal one for iCloud storage.

[Koldov]

AAAAARRRRGGGGHHHH!!!

 

This is probably down to my imperfect understanding of Lightspeed and ASM but got a pad, told Lightspeed to "forget" it, which it has. However it still thinks it's managed and I cannot get it to re-enrol with the new, hopefully doing everything as discussed above, profile (or re-enrol at all). Still showing in ASM.

 

:frusty:

 

I can only imagine that the Lightspeed option 'forget it' does exactly that, but only as far as the Lightspeed MDM is concerned, however... I don't think this removes any profiles on the iPad, so it is still configured the same as it was previously.

 

Not that it's much help now but removing all the profiles on it first (from within Lightspeed) or creating a new 'Test' OU for it and moving it there might have been a better 'first step'. I don't think you even need Lightspeed to 'forget it' as you can just use Lightspeed to reconfigure it (I learnt this lesson from Sophos when deleting a client from the portal without getting the anti-tamper settings removed)...

 

Unless, there may be other settings that have 'remove profile if it falls out of scope', you might be out of luck... but it might also 're-register' itself after a restart or something?

 

Can you reset the iPad (remove all contents and settings) or DFU it (hopefully someone more knowledgeable will come along before you do anything that drastic)...

[LeMarchand]

I can only imagine that the Lightspeed option 'forget it' does exactly that, but only as far as the Lightspeed MDM is concerned, however... I don't think this removes any profiles on the iPad, so it is still configured the same as it was previously.

 

Not that it's much help now but removing all the profiles on it first (from within Lightspeed) or creating a new 'Test' OU for it and moving it there might have been a better 'first step'. I don't think you even need Lightspeed to 'forget it' as you can just use Lightspeed to reconfigure it (I learnt this lesson from Sophos when deleting a client from the portal without getting the anti-tamper settings removed)...

 

Unless, there may be other settings that have 'remove profile if it falls out of scope', you might be out of luck... but it might also 're-register' itself after a restart or something?

 

Can you reset the iPad (remove all contents and settings) or DFU it (hopefully someone more knowledgeable will come along before you do anything that drastic)...

 

I was following something on the Lightspeed site, so pretty annoyed! No luck with a restart and none of the reset options I can find exist or work .

 

DFU them? At this stage, I'd love to destructively them up!

[DavR]

Have you got the option to remove the profile under Settings | General | Device Management?

 

IIRC you can remove these profiles on non-DEP devices, but not on DEP.

[tmoon-mint]

I was following something on the Lightspeed site, so pretty annoyed! No luck with a restart and none of the reset options I can find exist or work .

 

DFU them? At this stage, I'd love to destructively them up!

 

I am struggling to understand what it is you're trying to do so forgive me if im completely wrong but are you saying you're resetting the devices and they're automatically enrolling back into Lightspeed?

 

If so and you dont want them to do this you will need to login to Apple School Manager and change the MDM server the device is assigned to.

[Koldov]

No, I think they've removed the iPad from Lightspeed but the iPad still has the profile on it that 'maybe' won't allow them to reset/wipe it (also Lightspeed cannot reconnect to the iPad to configure it as it has 'forgotten' it).

 

If that is the case, I'm surprised as to why the iPad isn't trying to reconnect back to Lightspeed though...

Edited February 10, 2022 by Koldov

[LeMarchand]

Have you got the option to remove the profile under Settings | General | Device Management?

 

IIRC you can remove these profiles on non-DEP devices, but not on DEP.

 

Unfortunately not, possibly because they're DEP.

 

I am struggling to understand what it is you're trying to do so forgive me if im completely wrong but are you saying you're resetting the devices and they're automatically enrolling back into Lightspeed?

 

If so and you dont want them to do this you will need to login to Apple School Manager and change the MDM server the device is assigned to.

 

At the moment, they are all on a Lightspeed "shared device" profile. I wanted to test one device without that stipulation, so told Lightspeed to "forget" it, which it duly did. I assumed that, once forgotten, I could just re-enrol it with the revised profile. Unfortunately the device is less fickle and won't forget it's controlled by Lightspeed. I did use ASM and set it to "unassigned", but this didn't help.

[tmoon-mint]

Unfortunately not, possibly because they're DEP.

 

 

 

At the moment, they are all on a Lightspeed "shared device" profile. I wanted to test one device without that stipulation, so told Lightspeed to "forget" it, which it duly did. I assumed that, once forgotten, I could just re-enrol it with the revised profile. Unfortunately the device is less fickle and won't forget it's controlled by Lightspeed. I did use ASM and set it to "unassigned", but this didn't help.

 

It sounds like you have a restriction in place somewhere in Lightspeed removing access to "erase all content and settings" from within the settings app. If the devices have been added to Lightspeed via ASM then the end user not being able to remove the MDM profile is expected behaviour. If Lightspeed has forgotten the device but it still has the MDM profile on it might not receive any setting changes anymore so your best bet sounds like to put the iPad into recovery and reset it from there.

[DavR]

You could always put it through a complete wipe all content and reset through iTunes, if you've been locked out of those options in Settings app.

 

If reassigned the device to the correct DEP server, you should then be able to re-enroll to Lightspeed, and you'll be back to where you started at least. That's based on my experience making similar mistakes in Meraki(!) and assuming the same general rules would work with other MDMs.

[LeMarchand]

You could always put it through a complete wipe all content and reset through iTunes

 

That was going to be my next step, though I was hoping to have to avoid polluting my machine with iTunes.

[Brimstone]

AAAAARRRRGGGGHHHH!!!

 

This is probably down to my imperfect understanding of Lightspeed and ASM but got a pad, told Lightspeed to "forget" it, which it has. However it still thinks it's managed and I cannot get it to re-enrol with the new, hopefully doing everything as discussed above, profile (or re-enrol at all). Still showing in ASM.

 

:frusty:

 

The iPad will still show up in ASM when you remove it from Lightspeed, however....

 

In ASM you can set an MDM up as your "default" server, in ASM under Settings>Device Managment if this is turned on, then when you reset the iPad it woll just enrol again, turn this setting off.

 

Forget device is the right setting in lightspeed, but as this is an Apple Shared iPad you should wipe it before you remove it, below is the Lightspeed support page for Shared iPad.

 

https://help.lightspeedsystems.com/s/article/device-management-shared-ipad?language=en_US

[LeMarchand]

Too late for a wipe via that method, alas. Have made the change you detailed and will try to do an iTunes wipe tomorrow afternoon.

[tom_newton]

Interesting thread. iPads always seem to involve wailing and gnashing somewhere. I've had to learn a bit about the accursed things as we built our new filter tool. One thing that's shone through is that microsoft intune is surprisingly decent as an MDM, and many schools already have it as part of their setup, whereas the other "free" MDM options are largely complete cack.

[LeMarchand]

Lightspeed ain't free, and I'm not overly impressed.

 

It's taken me an age to get anywhere near DFU, mainly due to a it not liking the cable I was using. Couldn't get it to restore, but I've had enough. Will try again on Monday!

[Brimstone]

Interesting thread. iPads always seem to involve wailing and gnashing somewhere. I've had to learn a bit about the accursed things as we built our new filter tool. One thing that's shone through is that microsoft intune is surprisingly decent as an MDM, and many schools already have it as part of their setup, whereas the other "free" MDM options are largely complete cack.

I utterly disagree with you.

 

iPads represent the smallest support footprint imaginable as long as you do your reading up and knowledge beforehand and buy the right solution to support them.

 

There are 2 very succesfully organisations in the UK managing thousands of schools iOS devices, all done completely remotely and just a handfull of extremely knowledgable engineers.

 

I'd stick InTune right at the bottom of largely complete cack you mentioned...

 

You have to wade through Microsoft's over complicated licencing for it, there are plenty of payload API's used by other MDM's very well that InTune doesn't even have, and most importantly it doesn't even support one of Apple killer Education free features "Apple Classroom" or (in the context of this thread) Apple's Shared iPad configuration.

[DalekSec]

Interesting thread. iPads always seem to involve wailing and gnashing somewhere. I've had to learn a bit about the accursed things as we built our new filter tool. One thing that's shone through is that microsoft intune is surprisingly decent as an MDM, and many schools already have it as part of their setup, whereas the other "free" MDM options are largely complete cack.

 

Intune is a good MDM for windows, iPads it does the very basics, macOS it does nothing!

 

How i'd judge Intune

 

Android - Not used enough to comment

iOS/iPadOS - 2/10

macOS - 1/10

Windows 8/10 (Still missing a lot of GPO settings!)

[LeMarchand]

Well; I managed to wipe the offending/offensive pad also discovered that iTunes messes up my custom media keys settings when open. That's as far as I got as it didn't want to rejoin the Lightspeed gang. Next there Wednesday.

[tmoon-mint]

Well; I managed to wipe the offending/offensive pad also discovered that iTunes messes up my custom media keys settings when open. That's as far as I got as it didn't want to rejoin the Lightspeed gang. Next there Wednesday.

 

I suspect you need to assign Lightspeed as the MDM server for the device in ASM again. Then it should enroll automatically during the setup assistant.

[LeMarchand]

I suspect you need to assign Lightspeed as the MDM server for the device in ASM again. Then it should enroll automatically during the setup assistant.

 

It was always set up in ASM for Lightspeed and never disappeared. I'll try removing/re-adding it on Weds.