Staff Laptop Setup

[ITManLT]

Hi All,

 

Just wondering how the majority go about setting up a staff laptop?

 

We're looking at giving our staff laptops and replacing the computers in classrooms. Up until now only a few staff have staff laptops, so we've done a solution that works but wondering what people think is best now for moving to mass laptop use.

 

The laptops will be imaged through SCCM/MECM with drivers/software installed through the task sequence.

In terms of then users using the device both in school and at home, I'm aware of the 2 options below, but wondered what people think of these and if you guys do anything different:

 

Option 1:

Following the domain build, have the staff member log on to their device.

Log off of the device.

IT log on as admin and load up System Properties > Advanced > User Profiles, select the staff member and convert their profile to local.

With the above being done, the staff member can then log on both in school and at home.

 

Option 2 (less ideal, best for home use only really):

Following the domain build to install the relevant software, remove the device from the domain.

Create a local user account on the device for the staff member to use.

 

 

I'm looking to enable MECM/InTune Co-Management so that we can use this to manage laptops externally too.

What process to people use if none of the above for configuring staff laptops on mass?

 

Also - for the few staff who have laptops already, we have enabled Offline Files and sync their user area to the device, but Microsoft's offline files seems archaic and sometimes just doesn't sync. Not because the files are in conflict (edited both in school and at home) but the file shows 0bytes in the folder for example.

Are there any credible alternatives to offline files to help sync staff's user areas to the devices? (They will be bitlocker drive encrypted so security shouldn't be an issue).

 

 

Thanks in advance.

[chris_uk]

All teachers have a Surface Pro 8, redirection to OneDrive for desktop and documents etc. AOVPN for remote access. No offline files at all.

 

Nice and simple.

 

Chris

[CHiLL]

Laptop management has become less of an issue since we implemented Microsoft's Always-On VPN. Staff can just use it as if they are in school, with access to their documents, shared drives, etc, and the device still gets the GPOs and connects to MECM via the VPN.

 

We do still manually create local accounts on the laptops, just in case the VPN doesn't work, so they could log on with .\. We used to just use the same account called "Home", but for accountability/ease of viewing logs/captures, we've decided to create the local account with the same name as their AD account.

 

You used to be able to create local accounts via a GPP and you could target a specific local account on a specific laptop. However, due to password vulnerabilities, Microsoft removed the ability to set passwords on these local accounts a few years ago.

Edited July 7, 2022 by CHiLL

[jthompson]

Staff laptops here remain domain joined and use cached credentials and local profiles, to allow for continued use away from school. A mix of VPN, Google Drive for Desktop and Google Chrome sync helps with continuity of workflows between home and school.

 

In fact, all our school computers use local profiles, with folder redirections set for student users.

 

I can't think that your option 2 (unjoin from the domain and use local accounts) has much to recommend it, tbh.

[Danp]

Chromebooks

[jezi55]

We currently setup all our onsite and offsite laptops the same via MTD/WDS, once these have been imaged we make a local account so staff can login offsite (this is locked down so they cannot install any software etc), they can either use smoothwall VPN or remote access to access the school system. Seems to be working ok for us but will be looking at an Always-On VPN in the near future. This allows for the device to be used on and offsite. We also have chromebooks for students but not currently for staff.

[mavhc]

Just login with cached credentials, no need to make it complicated

[Sharkman]

Some of mine are Intuned which works really well. They just use SharePoint and OneDrive for files

[Cat_Jam148]

Domain joined laptops with cached credentials here - SSO on all accounts so OneDrive automatically configures. File sharing is done either via Sharepoint or OneDrive's sharing feature

[psydii]

Minimize dependencies on the availability of the network, particularly during the boot / logon phase. Don't use roaming profiles at all. With Windows 10 they are depreciated, and last time I checked, they are not supported at all if you are using OneDrive.

 

Minimize the sorts of restrictions you put on laptops via GPOs, much of the accepted wisdom for securing devices in education is based on myths from 1998.

 

Ensure the laptops can get updates when offsite - Windows Updates / Anti virus / Adobe etc.

 

cache commonly used documents and folders - works best if using OneDrive / SharePoint. If using traditional folder redirection then Offilne Files should kick in automatically - but be very wary of syncing busy network shares. As an advocate of the CSC /Offline files feature since it was called IntelliSync, OneDrive/Sharepoint is superior in almost all ways that matter.

[6Foot2]

Hi All,

 

Just wondering how the majority go about setting up a staff laptop?

 

We're looking at giving our staff laptops and replacing the computers in classrooms. Up until now only a few staff have staff laptops, so we've done a solution that works but wondering what people think is best now for moving to mass laptop use...

 

We made this change, with the campaign being widely publicized among staff well in advance, but when the solution was deployed (laptops issued, and classroom desktops removed) staff were really pleased that everyone now had a laptop but confused as to why the classroom desktops gad to go:

 

But I left my laptop at home today, now I can't teach.

 

Did you HAVE to take it away?

 

My laptop hasn't worked for weeks!

 

etc.

 

Staff were entrenched and reluctant to change. One point that was better than others they had made was that it ate into contact time when they had to pack away, move to another classroom and set their laptop up again. Some staff had room changes nearly every lesson.

 

[mavhc]

Weird, closing a laptop, carrying it with you and opening it again is way faster than logging off, moving, logging in, loading all your documents for the next lesson.

 

Just make sure it's only 1 cable to plug in, usb-c that connects to a dock that does power, audio, video, network

[6Foot2]

...Just make sure it's only 1 cable to plug in, usb-c that connects to a dock that does power, audio, video, network

 

Our network setup was quite archaic: All classrooms were equipped with interactive whiteboards ages ago at the same time (early Promethean types)

 

From then on there was little investment or development, despite my best efforts: "If it's still working, why do we have to replace it?"

 

This left us with a setup where there was no one way of connecting to the IWB/projector (a few rooms each year MIGHT get updated) The pace at which new/replacement install went in meant that rooms that had been modernized, really needed to be updated again before we had reached all rooms with an earlier update.

 

[Guest Guest]

Ours are domain joined and connect via AOVPN when off-site

[MatthewL]

Why you would want to create a local user is beyond me, seen this done in so many schools and its just generating more work for you.

 

Domain joined all the way, cached credentials to login to laptop but ideally a VPN solution, AoVPN is seemless doesn't require anything for user and they carry on the experience as in school.

 

Offlines files again, looking for trouble, if you need something like that use OneDrive/Drive these days.

[PrimaryNetMan]

Domain joined, cached creds, updates via WuFb for those few remaining laptops that aren't Chromebooks

[Roberto]

Why you would want to create a local user is beyond me, seen this done in so many schools and its just generating more work for you.

 

Domain joined all the way, cached credentials to login to laptop but ideally a VPN solution, AoVPN is seemless doesn't require anything for user and they carry on the experience as in school.

 

Offlines files again, looking for trouble, if you need something like that use OneDrive/Drive these days.

 

Couldn't agree more. This local login process seems overly complex, unnecessary and quite horrifying really. Deploy with SCCM or Autopilot, use Known Folder Redirect if you like storing data in O365 or always on VPN if you prefer, job done.

[FN-GM]

Hi All,

 

Just wondering how the majority go about setting up a staff laptop?

 

We're looking at giving our staff laptops and replacing the computers in classrooms. Up until now only a few staff have staff laptops, so we've done a solution that works but wondering what people think is best now for moving to mass laptop use.

 

The laptops will be imaged through SCCM/MECM with drivers/software installed through the task sequence.

In terms of then users using the device both in school and at home, I'm aware of the 2 options below, but wondered what people think of these and if you guys do anything different:

 

Option 1:

Following the domain build, have the staff member log on to their device.

Log off of the device.

IT log on as admin and load up System Properties > Advanced > User Profiles, select the staff member and convert their profile to local.

With the above being done, the staff member can then log on both in school and at home.

 

Option 2 (less ideal, best for home use only really):

Following the domain build to install the relevant software, remove the device from the domain.

Create a local user account on the device for the staff member to use.

 

 

I'm looking to enable MECM/InTune Co-Management so that we can use this to manage laptops externally too.

What process to people use if none of the above for configuring staff laptops on mass?

 

Also - for the few staff who have laptops already, we have enabled Offline Files and sync their user area to the device, but Microsoft's offline files seems archaic and sometimes just doesn't sync. Not because the files are in conflict (edited both in school and at home) but the file shows 0bytes in the folder for example.

Are there any credible alternatives to offline files to help sync staff's user areas to the devices? (They will be bitlocker drive encrypted so security shouldn't be an issue).

 

 

Thanks in advance.

 

I am confused as to why step 1 is being performed. Are you using roaming profiles or something?

[Aprice]

Domain joined with AOVPN / Direct Access on some of the sites, Cached Credentials still work should there be an issue with the VPN Connection.

 

Deployed through a mix of SCCM & MDT at different sites.

 

We've done several migrations of file servers to Sharepoint / Onedrive now but have noticed that the sync client is problematic, so are trialling Cloud Connect with a few at the moment, so far it looks promising.

[mavhc]

Our network setup was quite archaic: All classrooms were equipped with interactive whiteboards ages ago at the same time (early Promethean types)

 

From then on there was little investment or development, despite my best efforts: "If it's still working, why do we have to replace it?"

 

This left us with a setup where there was no one way of connecting to the IWB/projector (a few rooms each year MIGHT get updated) The pace at which new/replacement install went in meant that rooms that had been modernized, really needed to be updated again before we had reached all rooms with an earlier update.

 

 

Need to find a dock with vga and hdmi, then you'll be back to 1 way to plug them in again.

 

Just argue based on time wasted. You're paying a teacher say £30/hour, they're wasting 5 mins each lesson, that's £15/day, £75/week, the device will last 5 years and cost £75

[6Foot2]

Need to find a dock with vga and hdmi, then you'll be back to 1 way to plug them in again.

 

Just argue based on time wasted. You're paying a teacher say £30/hour, they're wasting 5 mins each lesson, that's £15/day, £75/week, the device will last 5 years and cost £75

 

Not my problem any longer. It is my understanding that since I left, they are now deploying interactive touchscreens now (the launch of which, apparently, went badly wrong: Boards not responding to laptops/not responding to touch)

 

Oh, well.