DeployR - Here we go

[geohanson]

Only just noticed this thread, as I don't visit Edugeek very often!
We're running the paid for Enterprise version of DeployR, (have been since December 2025) however I'm running the frontend script as a standard command line script not as a "Run Server side script" which I believe is Enterprise only. 

 

In reference to imaging a PC already in AD, it's my understanding that anything imaged with something other than DeployR will have to be manually deleted from AD, but once DeployR has imaged it once, it can be imaged again without being deleted from AD. https://documentation.2pintsoftware.com/deployr/reference/step-definitions/offline-domain-join

 

I've just spent the last few hours making some changes to this and trying to streamline it...

 

 

Our TS step to launch the above is

 

 

 

 

Hopefully that might help..... 

Edited June 22 by geohanson

[garethEds]

Cheers @geohanson - I was in your neck of the woods this week, staying in Burnley and visiting family in Haslingden (and Bacup). I've seen this ps script before somewhere. Will have to read back. I just wanted to avoid deleting everything.

 

I'm wondering if I could add the DeployR server as an owner to all current machines in the AD to see if that worked. Something like discussed here (even though it hasn't worked): Changing Owner on AD Objects via Powershell or DSACLS - Software & Applications - Spiceworks Community

 

Will have to check what the DeployR owner is called.

[geohanson]

@garethedmondson That could possibly work - we've just gone down the path of least resistance, and just delete the PCs from AD prior to building. Once they've been built once with DeployR then they're fine.

In AD, the owner for DeployR built machines is actually the server/VM rather than a user account. Not sure if changing the owner in AD would work but could be worth a try. 

 

The original version of the script is here: https://github.com/gwblok/2PintLabs/tree/main/DeployR/FrontEnd/FrontEndJSONDriven
One of the things I wanted was to be able to manually name machines and choose an OU/software as per MDT. Took a bit of work to get it working properly (some thanks to Gemini Ai!) but it works well. 

[itskdog]

How are people setting up an FQDN if you don't have a DNS server (e.g. an Intune school with DHCP pointing to ISP DNS)?

[AlexB]

20 hours ago, itskdog said:

How are people setting up an FQDN if you don't have a DNS server (e.g. an Intune school with DHCP pointing to ISP DNS)?

Have a look at what DNS domain is coming out of your ISP DNS (though possibly the router is providing DNS/DHCP rather than the ISP directly?). If it is a constant domain suffix, you should be able to use this.

We have a 5G router for simulating/testing against an external connections and it gives devices a FQDN of <hostname>.home  

Edited June 26 by AlexB

[itskdog]

1 hour ago, AlexB said:

Have a look at what DNS domain is coming out of your ISP DNS (though possibly the router is providing DNS/DHCP rather than the ISP directly?). If it is a constant domain suffix, you should be able to use this.

We have a 5G router for simulating/testing against an external connections and it gives devices a FQDN of <hostname>.home  

 

Thanks for the tip - shows blank here unfortunately.

 

We're with LGfL, who provide 3 pairs of DNS servers at their datacentre that does the Google SafeSearch and YouTube Restricted Mode enforcement for us (with each pair of DNS servers having different YouTube modes). I believe they block the ports to all other DNS servers on the firewall to make it harder for kids to bypass those safety settings by setting the DNS to 8.8.8.8 or 1.1.1.1. (though we also enforce through Intune policy as well)

 

Pinging another machine on the LAN does give me a ".local" suffix, I might try that and see if mDNS is supported in WinPE. (Though interestingly that's giving me IPv6 addresses, even though we don't have IPv6 service or DHCPv6)

[AlexB]

43 minutes ago, itskdog said:

 

Thanks for the tip - shows blank here unfortunately.

 

We're with LGfL, who provide 3 pairs of DNS servers at their datacentre that does the Google SafeSearch and YouTube Restricted Mode enforcement for us (with each pair of DNS servers having different YouTube modes). I believe they block the ports to all other DNS servers on the firewall to make it harder for kids to bypass those safety settings by setting the DNS to 8.8.8.8 or 1.1.1.1. (though we also enforce through Intune policy as well)

 

Pinging another machine on the LAN does give me a ".local" suffix, I might try that and see if mDNS is supported in WinPE. (Though interestingly that's giving me IPv6 addresses, even though we don't have IPv6 service or DHCPv6)

Sounds like it is worth a shot 🤞

[garethEds]

@geohanson - Having just posted on reddit about the pricing model of this software for schools, I wonder how you managed to convince the budget holders that this was worth the price you paid (how much did you pay?)

 

Cheers

[geohanson]

@garethEds We paid considerably less than the price that's now on the 2Pint website, but I think it was still in beta when we bought it. If the renewal is the price as per the website, I think I'd have to look at changing to the community version, which I think would still work for us.

 

The argument to the business manager was that we need an imaging solution that complies with the DfE Standards and Cyber Essentials. There isn't really much out there that does.

• MDT is now deprecated
• SCCM is too costly/complex
• SmartDeploy is expensive
• FOG doesn't work with secure boot and there's no paid for support
• Autopilot doesn't do bare-metal imaging

 

[garethEds]

4 minutes ago, geohanson said:

@garethEds We paid considerably less than the price that's now on the 2Pint website, but I think it was still in beta when we bought it. If the renewal is the price as per the website, I think I'd have to look at changing to the community version, which I think would still work for us.

 

The argument to the business manager was that we need an imaging solution that complies with the DfE Standards and Cyber Essentials. There isn't really much out there that does.

• MDT is now deprecated
• SCCM is too costly/complex
• SmartDeploy is expensive
• FOG doesn't work with secure boot and there's no paid for support
• Autopilot doesn't do bare-metal imaging

 

 

Thanks for coming back to me. In fairness to 2Pint - they have offered us a discount - but it's still too much money for what is not going to be used that often. I'm interested in what you paid and for how many endpoints.

Edited July 2 by garethEds

[AlexB]

We got our community licence yesterday. Just waiting for Infrastructure to spin up a perm home for it.

Hoping I'll be able to get it to do everything we need.

[garethEds]

1 minute ago, AlexB said:

We got our community licence yesterday. Just waiting for Infrastructure to spin up a perm home for it.

Hoping I'll be able to get it to do everything we need.

 

Well, if you get anywhere with the domain stuff of machines already in there - let me know. Gary sent me a script that works on enterprise but not on Community as it is a server side script 😞

 

Did you see my longest post ever on Reddit lOL?

[garethEds]

Wondering how others are getting on testing it. We installed the 1.2 version and got it working well. Then when we tired to install the latest over the top it failed and broke it all. So I've had to re-create the server. I've installed the latest version clean and it's not gone too well.

 

As it was a test server I didn't bother with a backup as I was happy to learn what is happening before migrating to a production server. Silly me. Didn't even take a snapshot.

 

Doing this remotely - so might start again when I get back to work in September.

Edited July 21 by garethEds

[AlexB]

Damn

 

I started fresh on 1.3 Community (after being trial 1.1 Ent) and the 2 1.3 upgrade installs have gone fine, but I think 1.3 had some major changes under the hood.