LewRichAIM

@Alawil I would be interested if you are able to share! Thanks in advance!

Sorry for the delay, so far it's working well, SCEPman CE is the certificate authority, then FreeRADIUS as the gateway. Intune policies pushed out are: SCEPman root certificate (10 year) FreeRADIUS certificate (10 year) SCEPman issued student device certificate SCEPman issued staff device certificate Secure WiFi profile for staff Secure WiFi profile for students SCEPman automatically issues the certificates to staff and student devices via the Intune policy, you point it at SCEPman. These have a validity period and are auto renewed when they get close to expiring. The CN for the cert either has STUDENT then the entra device ID or just the device ID. FreeRADIUS has some config which says if the CN on the certificate has STUDENT in front of it then drop it on the student VLAN. If not drop it on staff. Chromebooks are done via a username and password configuration in Dalo/FreeRADIUS, the users have reply attributes set which put the device on the student VLAN. The reason for this is the community edition of SCEPman only supports talking to Intune, the full paid for version does but that's very expensive. From some rough calculations this will cost around £80 a month in hosting costs, you could reduce this if you host FreeRADIUS on prem, but we have multiple sites so was easier to host in Azure. Today was the day we moved into production so the policies have been pushed out via Intune, we will give it a few weeks for everything to pick them up, then turn off out old WiFi networks. Chromebooks are already running on this as of Monday this week.

Not sure if you ever got anywhere with this, I am in the same boat, I too looked at paid for solutions and as you say they are crazy money. I have a test system setup which is FreeRADIUS with Dalo on top which is a GUI for it. Then the community edition of SCEPman. All hosted in azure. All working so far, one "secure" WiFi SSID with certificate authentication for Windows devices. Chromebooks will use a username and password as SCEPman CE doesn't work with them, only the paid version. All with dynamic VLAN assignment. My slight concern is how stable this will all be at scale. We are going to try it at one site and see how it goes. We also have a separate guest/byod network, which is Art of WiFi works a treat with unifi and it's cheap. You can host it with them, but we just run it on a Linux box in house.

This is a really old thread but I am currently working on this, we are moving towards fully Intune, therefore no more NPS. I have it working in a lab environment, free radius hosted in azure, plus SCEPman community edition, the only costs here are the Azure hosting fees which at present look around £80 a month. FreeRADIUS is currently running in a container, moving it to a VM next. Then I am going to expand the configuration so we have one "secure" WiFi network which depending on the type of device will drop it onto a specific VLAN. Managed windows devices will user certificate authentication, Chromebooks will use a username and password as we can't automatically deploy the certificates to them like intune. Guest & NYPD is a separate network managed by Art of WiFi allowing staff to sign in with their 365 account, guests use a code. Regards to the Dalo element, I may ignore that as it seems to add a layer of complexity. Might change my mind at some point!

That's a good idea! The amount of times I regenerated the WIM! Might host it in SharePoint, that's worked quite well for copying desktop icons for students 👍

That's it, inside Config >> Scripts, tbh I don't remember creating it, but it was a while ago! Then when you rerun the process everything is merged into the ISO/WIM, everything inside StartNet runs right after the network adapter becomes live.

I am no expert on this but I have done a lot of back and forward in Claude AI, to get a complete script working. The script is stored in the workspace in the StartNet folder, this launches automatically when you boot from the OSDCloud PE before OSDCloud does anything. We are moving fully to Autopilot and Intune, so no local AD. When we boot up it launches a powershell form, asks for a computer name, has some logic in it to set the site based on the start of the name e.g XXX-NAME sets the site as XXX etc, then you have an option of a staff or student device, then press go, the hardware hash is uploaded to Intune using an Azure app key and secret, group ID set which inturn sets and assigns a deployment profile. Then OSDCloud launches to wipe the HDD, install the OS and drivers. Machine then restarts, OOBE kicks in and does the rest. End result is a finished device at a login screen ready to go. I just asked it about your your scenario with the unattended.xml (not needed in my setup, as I need the OOBE for the autopilot phase). It came back with a pretty complete layout for it including a powershell script to start the process. Similar to the way I am doing it. Happy to share the script if anyone wants to have a play!

Have you used that profile before outside of OSDCloud does it work if you manually install the OS etc.

This is a good place to start https://www.learningittogether.com/posts/osdcloud-v2-getting-started/

Update on this, I managed to get enrolment working inside OSDCloud using this guide https://github.com/blawalt/WinPEAP modified the powershell script to set the device name too. So once it goes into autopilot it names the PC correctly. We have the asset number in the device name so it's important for us.

In the end we used applocker to block office and forced them to use wordpad and the old version of Photoshop

We are about to start using OSDCloud on mass, really basic config, we get the devices into autopilot using the autopilot info script before we wipe. Then boot from the USB to re install the OS, once finished autopilot takes over. I love the fact it does the drivers for us, we are mostly a Dell house. I did play with the autopilot info script within the OSDCloud PE image, but I don't think PE contains all the bits of powershell that are needed. Tbh once it's in autopilot it's there for life so not much of an issue.

I know it's pretty unusual, it's Graphic Communication it's a 10 hour exam over 2 days. It's just internet access they are not allowed, but are allowed to use everything else. Ps it's AQA. As every they don't really give any guidance apart from "disable the internet" I think I may reach out for further guidance.

Hi all, we have a couple of IT suites where students take their graphics exams on computers, they use their actual accounts as they need to access some resources from their coursework etc. however they are not allowed internet access, we achieved this buy using a GPO to block all sites in edge apart from the ones used to license the Adobe suite and office. However students have now figured out they can email each other, via the outlook desktop app, I can block that app using app locker. My question is how do you if at all stop them from sharing a PowerPoint between students and passing 'notes' that way using the collaborative nature of 365. They apparently need to use PowerPoint so blocking that won't help me unfortunately. Appreciate your advice!

Thanks for this, we have been suffering with this for weeks. Like you we thought it was Windows Updates. We were getting it when connecting peripherals e.g. HDMI, USB etc. The script above is in slightly the wrong format it needs to be like this: $BlankFile = "c:\program files\renato\senso.cloud\disablefilter" $FileExists = Test-Path $BlankFile if($FileExists -eq $True){ Return} else { New-Item -path "C:\program files\renato\senso.cloud" -Name "disablefilter" -itemtype file} Start-Sleep -s 10 Restart-Service "senso.cloud.service"S Then deployed using the remote script module as PS1. Thanks again! We now have this rolled out, fingers crossed this cracks it! Interestingly we don't use ESET we use MS Endpoint.