Windows 11 Edu - I'm at a loss please help

[BrennanNCS]

Hello,

 

First-time poster, long-time lurker (before I created this account to post). I'm hoping some of you might be able to shed light on a few issues I’m dealing with - things I might not have considered yet.

 

I’m 24 and recently stepped into my first role as an IT Manager, though I’ve been working in IT for the past six years. Long story short, I’ve inherited a school network that desperately needs a complete overhaul and is an absolute mess. When I took the job, I assumed the school would be up and together with things as they had a competent MSP supporting them. I was very wrong. I’ve since cut ties with the MSP, and I have no intention of working with them again.

 

Here are some of the key issues I’m facing:

- The majority of machines (about 260 PCs with 3rd/4th gen i5s) are not Windows 11 compatible.

- Around 100 machines that do support Windows 11 were reimaged with Win10 and are still running Windows 10.

- There’s no KMS service running - looks like the MSP deleted the VM and any trace of it (no idea why).

- There’s no current OVS agreement, so all devices are using individual activation keys, which is a nightmare for rebuilds.

- I’m the only person in the IT team.

- Thankfully, we have A3 licenses for staff and students, so I could potentially use those for activation but I understand that’s user-based, not device-based, and I’m not entirely sure how that works without spending the time setting up Intune.

 

I have spoken to a few former IT managers I’ve worked with, and they’ve suggested I just install Windows 11 where possible and deal with issues as they arise. I get where they’re coming from, but everything I’ve read online and speaking to other externals says not to do this and I understand why.

 

I’ve looked into Windows 10 LTSC since it’s supported until 2027, but there’s no way I can reimage 260 PCs before October 14th, especially while also managing the 100 Windows 11-capable machines. Plus, LTSC seems to come with licensing costs per machine and isn’t really intended for high-use environments like schools.

 

I’m in the process of sorting out a new OVS agreement, which would help massively, but Microsoft support is moving slowly since I don’t currently have a valid agreement in place.

 

This whole situation is incredibly stressful, and that’s without everything else going on. I think I've actually made myself feel more stressed by writing this out! 

 

I’m really stuck, what am I supposed to do?

 

Cheers, Brennan.

[PrimaryNetMan]

If you haven't got any OVS agreement in place and are looking to set one up, look at the possibility of an EES agreement that will allow you to purchase Extended Support for Win 10 ( £1 per device for the first year) That will kill 2 birds with one stone and buy you time while you come up with a digital strategy. 

[CHiLL]

Once you get your licensing sorted, install KMS on your server and use Active Directory activation (I'd recommend installing it on a non-domain controller). You may need to contact Microsoft support after your agreement is active to obtain KMS keys for your Windows client and Server OSs. Add the new KMS key(s) into your KMS server and activate it with Active Directory. That should sort new installs out automatically and you can then look at changing the activation via script on the existing machines.

 

There are ways to activate Windows 11 on non-certified hardware...it's not recommended by default, but we do it here - we can't afford to buy new machines.

 

If there isn't a SCCM server, or at least MDT, then I'd probably look at setting up WDS and MDT for making the imaging process easier.

Edited June 27, 2025 by CHiLL

[flipthebit]

Do you have a MDT server to make rebuilding PCs less effort? Spending some time setting one up with all the appropriate OSes, drivers, etc will save time manually rebuilding PCs (if that's what you're doing). You could rebuild 100 in a day using that easily.

 

[simpsonj]

My advice would be to find an MSP that you can work with, one that will support you and your digital strategy and not take over. A school network is a lot to take on, and finding support is vital, particularly in the early days.

[BrennanNCS]

32 minutes ago, PrimaryNetMan said:

If you haven't got any OVS agreement in place and are looking to set one up, look at the possibility of an EES agreement that will allow you to purchase Extended Support for Win 10 ( £1 per device for the first year) That will kill 2 birds with one stone and buy you time while you come up with a digital strategy. 

Is it a case of using only one or the other or do they coincide? If it's an EES agreement that I need to get sorted instead of OVS that does sound like a much better solution, it's not something that has come up in any of the conversations I have had with Microsoft resellers/partners unfortunately. Thank you for the response.

 

Edit: Do I need to reimage any machines in order to make sure that the Win10 machines are supported or are they okay as they are? 

Edited June 27, 2025 by BrennanNCS

[Sephiroth]

As above have commented, I would recommend looking to automate the installation and activation processes. If there's no SCCM server then MDT / WDS is quick to set up and very powerful for automation, especially if you utilise the database features in MDT.

 

Does the school have a Microsoft 365 tennant? If so, InTune might be something to look at as an alternative to on-prem deployments. I can't recommend starting to look at it if it's not already at least half set up though.

 

I also agree that you should get an MSP involved to assist. I would stress, however, that you ensure they are brought in to help you get things set up, rather than rely on them to sort it out. This will mean that you have the knowledge behind you and a second opinion if necessary, as well as a guiding hand specific to your situation. You may be able to rely on support on forums like this (and we will, of course, help you as much as we can), but sometimes it's impossible unless you get hands on.

 

Does the school have Google Workspace access? If so, Google Chrome OS might be a viable alternative to windows on some hardware.

 

Have you considered refurbished hardware from somewhere like ICT-Direct? This will enable you to get some hardware replaced for a decent price to meet Windows 11 hardware requirements.

 

Windows 10 LTSC is technically not supported outside of specific use cases, so I wouldn't recommend going down that route. Similarly, I can't recommend installing the production OS on unsupported hardware, It's a ticking time-bomb for when Microsoft change something that kills it, either in a patch or update, or as part of it's processes.

 

Another option is to look at desktop virtualisation with something like HiveIO. If you have the server capacity, this could smooth out some of the more problematic areas, buying you time to consider better options later on down the line. A single high power server is cheaper than 300 desktops, especially if you go down the refurb route.

 

I know there's a lot to think about here, but hopefully this give you some options to go through.

 

Welcome to the forums, good luck, and keep us posted!

[BrennanNCS]

32 minutes ago, CHiLL said:

Once you get your licensing sorted, install KMS on your server and use Active Directory activation (I'd recommend installing it on a non-domain controller). You may need to contact Microsoft support after your agreement is active to obtain KMS keys for your Windows client and Server OSs. Add the new KMS key(s) into your KMS server and activate it with Active Directory. That should sort new installs out automatically and you can then look at changing the activation via script on the existing machines.

 

There are ways to activate Windows 11 on non-certified hardware...it's not recommended by default, but we do it here - we can't afford to buy new machines.

 

If there isn't a SCCM server, or at least MDT, then I'd probably look at setting up WDS and MDT for making the imaging process easier.

 

KMS is something I will get sorted as soon as I have licensing definitely! I'm honestly struggling to figure out why KMS was ever depreciated before I came in as it had clearly licensed my current servers effectively at some point, and it probably worked for some desktops too as not all have keys printed on the side. DNS records still all point to the old KMS server but I don't dare do any further digging in case they start saying not activated.

 

31 minutes ago, flipthebit said:

Do you have a MDT server to make rebuilding PCs less effort? Spending some time setting one up with all the appropriate OSes, drivers, etc will save time manually rebuilding PCs (if that's what you're doing). You could rebuild 100 in a day using that easily.

 

 

Yes, thankfully MDT was already set up when I stepped into the role. However, the MSP hadn’t touched it in terms of maintaining or updating the deployment images. Honestly, I hadn’t had the time to properly update those images myself until recently. I finally got a Windows 11 image on there, but then realised that nothing was licensing properly beyond Windows 10.

[mavhc]

I don't bother with KMS and just use the built in windows pro licence we bought with the machine, makes reimaging much simple and cheaper (£0)

[flipthebit]

If you have keys to cover Windows, Office, etc, you can also activate them using a start up script via a GPO if KMS is an issue. Get it to report back the status to a central log somewhere as well.

 

 

[k-strider]

here is the help on AD based Activation which may be the reason the old KMS server is gone was it migrated over to AD based activation

https://learn.microsoft.com/en-us/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client

we got rid of our KMS server a long time ago i want to say windows 2012 era 

from memory you just add youre KMS key for serevr 2022/25 and it will then activate all servers and clinets windows 10+11

[buzzard]

15 minutes ago, mavhc said:

I don't bother with KMS and just use the built in windows pro licence we bought with the machine, makes reimaging much simple and cheaper (£0)

We did this and I run the below script in MDT which I've not had issues with on W10 boxes when reimaging to W11. (I'm sure I may have posted this a few days ago on another thread!?) If you have no other choice to use the older unsupported hardware this may be a way around the licencing. If its activating via MS then you're fine

 

<# 
Reads Windows OA3 product key from BIOS/UEFI and installs the key and activates Windows
Written by Ben Drew 2017
#>

$ProductKey = (Get-WmiObject -Class SoftwareLicensingService).OA3xOriginalProductKey
Invoke-Expression "cscript /b C:\Windows\System32\slmgr.vbs -ipk $Productkey" 
Start-Sleep 5
Invoke-Expression "cscript /b C:\Windows\System32\slmgr.vbs -ato"

 

[machy]

You are lucky in some aspects, you have 6 weeks coming up where you can break most the network and fix it!

 

From a technical POV Get MDT Setup, Get a deployment server set up using something like the trial version of PDQ or something similar, know what needs to be installed and working and spend the next couple of weeks testing the heck out of it.

 

Then in a perfect world, your whole site is reimaged in the first week of the hols and then you have plenty of time to fix things and test things. 

 

I'd make sure BACKUPS, monitoring, filtering and AV Is working properly too

 

The school is going to have to spend alot of money on new computers very soon, and they need to be prepared for that (have in your head £500/Device, its a little cheaper than that but is a nicer number)

 

I think you can change keys from normal windows 10 to LTSC to save reimaging, but its not something i have done 

Chrome Flex OS May be an option if you already have some google workspace

 

 

From a personal point of view, make sure you are religiosity working to rule when it comes to your hours. If your suppose to be finishing at 4, make sure you are walking to your car by then.

No emails etc on your personal devices

No working out of hours

If you need to do something after "4" then come in late that day or the day after

If the site is in as much as a state as it sounds then your gonna burn out very quickly if your not careful 

 

Also, if you are "network manager" you should really have a tech or apprentice to help... 

 

 

[PotNoodleTech]

Hmm that's a tough one to walk in to.

 

My advice as others have said above set up a quick and dirty MDT/WDS server and get a Windows 11 image on it and the main apps that you need. (it's technically obsolete and unsuppoprted but it is BY FAR the fastest and most reliable way to reimage potentially hundreds of PCs).  You can literally reimage 30+ PCs per hour.

 

Second thing you need to do is to not bodge windows 10 any longer or you'll be doing the school a disservice - forget LTSC etc - the school HAS TO move to Win 11 they can't keep burying their head in the sand as they appeared to have for the last 10 years.  You are the person that has to wake them up from this long slumber.

 

Buy new Lenovo/Optiplex PCs that support Win 11. If budget is super tight go second hand/refurbished from places like ICT Direct bargain Hardware etc.

 

Then roll out Win 11 on to all the existing half decent, and new/refurbished PCs.

 

That will stand you in good stead as a first step.  You can then spend more time looking at everything else to see what else needs upgrading/replacing.  Eventually do a full audit of what you got, when when it EOLs

[TheHyperTechie]

If budget is a concern (I know it's the end of the year and it can be tight) I would suggest what others have mentioned, replacing the outdated hardware with W11 compatible ones - then blast through them with MDT. But obviously at £150-200 (per refurbished) machine you would be looking at nearly £40,000+ (Very justified spend though!) 

 

If budget doesn't allow for this, you would either have to look down the extended support route (W10 LTSC) or utilising something like Chrome OS Flex with a roughly ~£30 license fee per machine. Even then you are looking at a large chunk of money to even get them operational and supported. So I would argue that replacing the kit would be obviously worth it in the long run.

[flipthebit]

If you don't have it already, put together an accurate equipment/asset list. If you have no tools to do this you can make a GPO deployed startup script to pick up from the PC the Make/Vendor, Model, Serial Number, Name, Drive Sizes, Memory, location in the AD, OS, and anything else you might need, to check what's compatible or not, drivers required, etc.

 

chatgpt, etc can be a help in putting a script together.

 

 

[SteveM555]

For the A3 licensing you'll need OEM licenses for at least Windows 10 Pro, RTM Core (aka Home) is not supported.

 

The licensing also won't happen unless the devices are Entra hybrid joined, as A3 is an 'upgrade' license and not used as a replacement for a Windows license. Like others have said, Id get an WDS/MDT server up and running to automate deployment, there's Powershell scripts that can run in a task sequence to pull the OEM key from the machine and activate it, so it wouldn't be a manual process with those PCs.

 

When all the machines are Windows 11 compatible Id look at Autopilot/InTune & MECM for deployment.

[Rob_D]

1 hour ago, PotNoodleTech said:

Buy new Lenovo/Optiplex PCs that support Win 11. If budget is super tight go second hand/refurbished from places like ICT Direct bargain Hardware etc.

The last time we looked VeryPC were practically the same price as refurbs. 

 

47 minutes ago, HyperTech said:

If budget is a concern (I know it's the end of the year and it can be tight)

OP might be lucky as have an April financial year-end like us.

[VeryPC_Nicole]

2 hours ago, Rob_D said:

The last time we looked VeryPC were practically the same price as refurbs. 

 

Spotted that we've been mentioned here - thanks for the shoutout Rob!
VeryPC is always happy to help with new machines that support Windows 11 or if you have any general questions about Windows 11.

Feel free to drop us an email or give us a call. We’re here to help!

[5nowman]

I get ticked off licensing office on machines, windows 11 licenses and activation

 

if you have an OVS agreement.. free space on the server.

ability to create to create a virtual machine in hyper V.. create a windows 11 machine and follow the steps to make it a VAMT.

 

you can enter the key for office and windows in this app 

search for all machines in active directly.

with 1 button it can push windows 11 key to all the machines

with another button.. it can active them all! and give results on any failures.

with 1 button push office key

with button 2 it can activate.

 

VAMT is microsoft too!

 

 

[mavhc]

On 27/06/2025 at 13:46, flipthebit said:

If you don't have it already, put together an accurate equipment/asset list. If you have no tools to do this you can make a GPO deployed startup script to pick up from the PC the Make/Vendor, Model, Serial Number, Name, Drive Sizes, Memory, location in the AD, OS, and anything else you might need, to check what's compatible or not, drivers required, etc.

 

chatgpt, etc can be a help in putting a script together.

 

 

WuFB will tell you which machines aren't win11 compatible, and why

[Olliedawg]

1st off - welcome to the forum. Lots of very knowledgeable people here with great advice.

 

I've been in a similar spot myself. I'd probably advise getting an EES sorted so that you can utilise the £1 Windows 10 ESU licences, which will buy you (up to) 3 years worth of time to plan out upgrades.

 

It's not vital to run KMS. You can get MAK keys instead which are multi-use, and deploy these during the imaging process.

 

Please remember you are only human, don't let the stress take over otherwise you will burn out (been there).

 

Would they consider taking on an IT tech, or apprentice to help out?

 

I'd recommend looking at an MDM/remote patching tool to remotely manage the machines if you don't have one already. Action1 is what we use & it's free up to 200 endpoints.

Edited June 30, 2025 by Olliedawg

[mikes]

We got refurbed Lenovo TinyPC's that support Windows 11 for £90 - £110 per unit.  Also long shot you aren't in Wales by any chance as we get a Wales KMS key for Windows from the Welsh Govt

[6Foot3]

I feel your pain, I was 23 when I took over five Schools from a leaving IT Manager.

 

It does get easier.

 

If it's Microsoft I would go with intune for a longer term solution, I would be happy to help with the setup if needed. (Remotely)

 

I would factor in how old is the server? Is it due to be replaced soon.

 

What's your broadband like, do you have a backup line etc.

 

Happy to speak over teams etc.

 

 

 

Edited July 1, 2025 by alordcharlie

[Synkrox]

I'd mirror what @alordcharlie says, and have been in a similar situation myself 3 times over the years.

 

If you are doing hardware and software refresh I would jump straight to intune and manage everything that way. It'll give you a clear cutover of "these are my old devices" and "these are my new devices" and frankly it's the way everything is going anyway so get on board now.  Get your A3/A5 licenses in order and just get deploying. IMO The complexity level is reduced compared to onprem deployment, even if it's unfamiliar to you now, it's much easier than trying to hybrid migrate your way out of on-prem later on. Anything other than a Win11 Cloud-managed setup is going to be a mounting technical debt over time.

 

Don't panic. Chop this into bitesize pieces and it'll be unrecognisable by Sept.

 

Watch "the intune channel" on YT and they'll walk you right through the whole initial setup.

 

Good luck and welcome to the party