SYNACK

Watched the presentation with great interest but have not been able to get a response from them. Tried a couple of times to enquire and sign up. Do they have a representative on the forum?

Tried one of these and seemed to work alright during brief testing https://www.amazon.com/dp/B0BRSRWKCF

Had an issue where GWSMO (Google Workspace Sync for Microsoft Outlook) profile setup immediately fails and tells you to reinstall Outlook. The logs claim: 3f1c E:Generic profileeditor!MAPISubsystem::LoadMAPIFunctions @ 143 ()> Failed with 0x8007007e, last successful line = 123. 3f1c E:Generic profileeditor!MapiInit @ 5929 ()> Failed with 0x8007007e, last successful line = 5927. Internet came up dry so looked at it through procmon and found it was failing to find vcruntime140.dll All you need to do is install the latest Visual Studio Redistributables from here https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170 Publishing here in case someone else encounters it.

Teams is the absolute worst showing Microsoft has and displays a dangerous lack of caring for end users and managment. The client has always been a bag of hammers, 'conveniently' designed to run on a browser framework inside a container, inside an OS, inside an app container guaranteed to be slow on anything but a fresh new pc... That needs to update, as each individual user every 30 days or it will give them a 'you must upgrade' prompt with no button to fix it. The new AppX one has been around for some time now and is still unable to detect a computer in presentation mode, or focus mode and will helpfully spew chat notifications on screen while projecting to a wireless display. Sure you can go into options and manually turn it off, but that is the only option. No shortcut, nothing. In the past Microsoft at least had the decency to release an API so if they forgot something, or could not be bothered, you could script it or make a plug-in via the API. No such luck now, they really don't care, whoever is running the Teams development needs to be re-educated heavily by sysadmins from education and corporate alike for their complete lack of care in this regard. If you are not going to fix two year old feature requests then at least have an API to allow someone else to patch over your incompetence.

Alright I'm just going to plug my own post as I have looked it up on here several times now for various problems with Windows 11 updates and imaging. I don't know who is in charge of the code that modifies the uefi partition but they need some more code review. I have now had several machines that failed during major Windows updates that have been recovered by variations of this. It at least needs to be added into the startup repair tool remediations if they are going to keep cooking it.

Do they have any student licenses applied as well. Had to remove any student ones from a couple of users as it seemed to block copiolet despite their other license.

Good that they are working on it but why do they have to make it so complicated. You can do the same thing on the Apple side with a Mac by clicking a checkbox. https://support.apple.com/en-nz/guide/mac-help/mchl3b6c3720/mac It seems extremely gate keepy to have to set the whole thing up in azure just for some cache. Higher security - probably, easier to bill for definitely.

Scep certificates via intune is probably best, there are third party services that can run it or use the Microsoft offering with the connector. Be aware that it will have to be machine authentication only if using shared devices. If you use machine plus user it will not connect any new user as it needs internet to get a user cert but does not bother to grab one before jumping to user context. Unless you have an onboarding network configured that allows for certificate retrieval and patient users who will wait while it goes and grabs one it is not a good solution. Microsoft really needs to step up in that regard as cert based wifi is way more secure but Windows does not allow for just in time provisioning of certs for new user logons - happy to be corrected if I have missed something.

It's because Apple does not do shared SSO from the OS, you log on but then need to log on by an sso solution like MS apps with Authenticator which can then do sso to other apps. We have Apple classroom setup just to offer a picture list of all the junior classes, drilling down to users. As there is no bulk way the teachers initially log them in with 365 creds and set a pin. They also log on to a MS app that spins up SSO for all of them through Authenticator. If one of the solutions could tap 365 or Google SSO from the second logon it would make it work. Don't know of any that do though.

Couldn't find this online easily so thought I'd post a quick guide to help others. Ran into a situation where I needed security groups via student year and figured I could use the Grade SDS attribute to do it with dynamic security groups in AzureAD/EntraID. You can Use extended attributes in dynamic groups to it was just a case of finding the name and using it in a rule. Some searching found a PowerShell script to pull the attributes back out of Azure so I had an easy reference for the extension names. https://github.com/OfficeDev/O365-EDU-Tools/blob/master/SDS%20Scripts/Get-All_SDS_Attributes.ps1 In the dynamic rule builder, I just added an expression to pick out the year level for each group and made sure the accounts were live: Year1: Rule Syntax: (user.accountEnabled -eq True) -and (user.extension_fe2174665583431c953114ff7268b7b3_Education_Grade -eq "1")

I have been having a major issue with Windows updates for a month or so. Cumulative updates that would get almost all the way through then choke and revert at the last moment. I thought this was due to Windows 11's obvious 'quality' but then it started effecting the fresh Windows 10 builds as well. After running all the DISM checks, SFS and clearing the Windows update cache the problem persisted. Thankfully Windows 10 managed to provide an actual clue in its Windows update logs - helpfully left in ETL files till you run the Powershell command Get-WindowsUpdateLog . Burried deep in those logs - Running a find from the bottom up for the exception (0x800f0922) eventually landed me here: Installer ID: {c5f0e9d7-e844-4507-89e4-701b5a747221} Installer name: 'Boot File Servicing (BFSVC) Installer' 2024-07-25 17:12:54, Info CSI 00000863 BFSVC: 'ServiceBootFiles MuiOnly:n Res:n Fonts:n BootMgrOvw:n BootStatOvw:n DbgTrn:n SuspendBDE:n Offline:n' 2024-07-25 17:12:54, Info CSI 00000864 BFSVC: 'Not using Ex bins.' 2024-07-25 17:12:54, Info CSI 00000865 BFSVC: 'Using source OS version a00004a610001' 2024-07-25 17:12:54, Info CSI 00000866 BFSVC: 'Copying boot files CopyBootManager(Yes) C:\Windows\boot\EFI -> \\?\GLOBALROOT\Device\HarddiskVolume1\EFI\Microsoft\Boot ' 2024-07-25 17:12:54, Info CSI 00000867 BFSVC: 'Error creating \\?\GLOBALROOT\Device\HarddiskVolume1\EFI\Microsoft\Boot\es-ES\ path! Last Error = 0xb7' 2024-07-25 17:12:54, Info CSI 00000868 BFSVC: 'Error copying boot files from C:\Windows\boot\EFI to \\?\GLOBALROOT\Device\HarddiskVolume1\EFI\Microsoft\Boot! Last Error = 0xb7' 2024-07-25 17:12:54, Info CSI 00000869 BFSVC: 'ServicingBootFiles failed. Error = 0xb7' 2024-07-25 17:12:54, Info CBS Progress: UI message updated. Operation type: Update. Stage: 1 out of 1. Percent progress: 94. 2024-07-25 17:12:54, Error CSI 0000086a@2024/7/25:05:12:54.647 (F) onecore\base\wcp\plugins\bfsvcai\bfsvcai.cpp(479): Error HRESULT_FROM_WIN32(14077) originated in function Windows::WCP::WCF::BfsvcInstaller::CommitChanges expression: Result [gle=0x80004005] 2024-07-25 17:12:54, Info CBS Could not get active session for current session file logging [hrESULT = 0x80004003 - E_POINTER] 2024-07-25 17:12:54, Info CBS Could not get file name for current session file logging [hrESULT = 0x80004003 - E_POINTER] 2024-07-25 17:12:54, Info CBS Added C:\Windows\Logs\CBS\CBS.log to WER report. 2024-07-25 17:12:54, Info CBS Added C:\Windows\Logs\CBS\CbsPersist_20240724122557.log to WER report. 2024-07-25 17:12:54, Info CBS Added C:\Windows\Logs\CBS\CbsPersist_20240724060753.cab to WER report. 2024-07-25 17:12:54, Info CBS Added C:\Windows\Logs\CBS\CbsPersist_20240722200643.cab to WER report. 2024-07-25 17:12:54, Info CBS Added C:\Windows\Logs\CBS\CbsPersist_20240719210636.cab to WER report. 2024-07-25 17:12:54, Info CBS Added C:\Windows\Logs\CBS\CbsPersist_20240627004301.cab to WER report. 2024-07-25 17:12:54, Info CBS Not able to add pending.xml.bad to Windows Error Report. [hrESULT = 0x80070002 - ERROR_FILE_NOT_FOUND] 2024-07-25 17:12:54, Info CSI 0000086b@2024/7/25:05:12:54.937 CSI Advanced installer perf trace: CSIPERF:AIDONE;{c5f0e9d7-e844-4507-89e4-701b5a747221};(null);903569us 2024-07-25 17:12:54, Info CSI 0000086c End executing advanced installer (sequence 0) Completion status: HRESULT_FROM_WIN32(14077) 2024-07-25 17:12:54, Error [0x018049] CSI 0000086d (F) Failed execution of queue item Installer: Boot File Servicing (BFSVC) Installer ({c5f0e9d7-e844-4507-89e4-701b5a747221}) with HRESULT HRESULT_FROM_WIN32(14077). Failure will not be ignored: A rollback will be initiated after all the operations in the installer queue are completed; installer is reliable[gle=0x80004005] 2024-07-25 17:12:54, Info CBS Could not get active session for current session file logging [hrESULT = 0x80004003 - E_POINTER] 2024-07-25 17:12:54, Info CBS Could not get file name for current session file logging [hrESULT = 0x80004003 - E_POINTER] Looked like it could not find or update the boot files. A quick trip into Windows RE and some failed attempts to run bootrec /fixboot telling me access was denied I eventually stumbled across this: https://answers.microsoft.com/en-us/windows/forum/all/windows-10-bootrec-fixboot-access-is-denied/747c4180-7ff3-4bc2-b6cc-81e572d546df diskpart select disk 0 {or your boot disk} List part Select part 2 {whatever the 100MB or so UEFI partition is} assign letter=v: exit format v: /FS:fat32 bcdboot c:\windows /s v: /f UEFI This rebuilds the UEFI partition and then it can install updates again. I believe this is down to my imaging method creating template VMs in Hyper-V then mounting the VHD and injecting drivers then capturing an FFU. This used to work fine but it seems something - the mounting of VHDs by Server 2022 or the DISM tool - has changed causing this lovely aberration and requiring this manual fix on all effected machines. My displeasure with Microsoft over this is incandescent. EDIT: After much messing I figured out you can perform the fix on a live system (in seconds), it will not let you format the EFI partition but you can nuke and recreate it with admin privileges as below, just save as a .cmd or .bat file and runas Administrator: mountvol x: /s x: rd /s /q EFI attrib -a x:\EFI\Microsoft\Boot\BCD bcdboot c:\windows /s x: /f UEFI pause

Perhaps an in place bios reader/writer to copy from one to the other. Will dupe the serial dmi though https://www.amazon.com/Organizer-Socket-Adpter-Programmer-CH341A/dp/B07R5LPTYM/ref=mp_s_a_1_4?keywords=bios+programmer&qid=1680247603&sr=8-4

You can do it manually via the csv import method, not great but workable. Powershell can help tame the files into the required format with a bit of work.

Devils advocate, do they need to know. Just need a decent enough router/switch to run 1:1 SNAT on the interface that they see, structure it how you like and as long as you don't go over the allocated number of IPs it can be properly segmented if overly complicated. Unfortunately most providers are awful when it comes to stuff like this, ideally they should give you an ip pool you can divide up as you see fit and just define a summary route from the school with division and routing handled in house.

Have just done 200 with configurator before Apple broke it with the latest osx. Used two 5 port powered USB hubs to do 10 at a time and upgraded to an ssd in the Mac mini as the brain dead software will 'download' the software every single time. It's like they don't realize that not everyone works at Apple. Once they are on the Apple school manager it is way easier but the enrolment stage is rubbish. The MSP people I have talked to use huge powerd hubs and a few more redos when they fail. I had to use a PC with iTunes to restore an iPad recently as the latest osx refused with the usual nothing is wrong error messages.