LewRichAIM

@Alawil I would be interested if you are able to share! Thanks in advance!

Sorry for the delay, so far it's working well, SCEPman CE is the certificate authority, then FreeRADIUS as the gateway. Intune policies pushed out are: SCEPman root certificate (10 year) FreeRADIUS certificate (10 year) SCEPman issued student device certificate SCEPman issued staff device certificate Secure WiFi profile for staff Secure WiFi profile for students SCEPman automatically issues the certificates to staff and student devices via the Intune policy, you point it at SCEPman. These have a validity period and are auto renewed when they get close to expiring. The CN for the cert either has STUDENT then the entra device ID or just the device ID. FreeRADIUS has some config which says if the CN on the certificate has STUDENT in front of it then drop it on the student VLAN. If not drop it on staff. Chromebooks are done via a username and password configuration in Dalo/FreeRADIUS, the users have reply attributes set which put the device on the student VLAN. The reason for this is the community edition of SCEPman only supports talking to Intune, the full paid for version does but that's very expensive. From some rough calculations this will cost around £80 a month in hosting costs, you could reduce this if you host FreeRADIUS on prem, but we have multiple sites so was easier to host in Azure. Today was the day we moved into production so the policies have been pushed out via Intune, we will give it a few weeks for everything to pick them up, then turn off out old WiFi networks. Chromebooks are already running on this as of Monday this week.

Not sure if you ever got anywhere with this, I am in the same boat, I too looked at paid for solutions and as you say they are crazy money. I have a test system setup which is FreeRADIUS with Dalo on top which is a GUI for it. Then the community edition of SCEPman. All hosted in azure. All working so far, one "secure" WiFi SSID with certificate authentication for Windows devices. Chromebooks will use a username and password as SCEPman CE doesn't work with them, only the paid version. All with dynamic VLAN assignment. My slight concern is how stable this will all be at scale. We are going to try it at one site and see how it goes. We also have a separate guest/byod network, which is Art of WiFi works a treat with unifi and it's cheap. You can host it with them, but we just run it on a Linux box in house.

This is a really old thread but I am currently working on this, we are moving towards fully Intune, therefore no more NPS. I have it working in a lab environment, free radius hosted in azure, plus SCEPman community edition, the only costs here are the Azure hosting fees which at present look around £80 a month. FreeRADIUS is currently running in a container, moving it to a VM next. Then I am going to expand the configuration so we have one "secure" WiFi network which depending on the type of device will drop it onto a specific VLAN. Managed windows devices will user certificate authentication, Chromebooks will use a username and password as we can't automatically deploy the certificates to them like intune. Guest & NYPD is a separate network managed by Art of WiFi allowing staff to sign in with their 365 account, guests use a code. Regards to the Dalo element, I may ignore that as it seems to add a layer of complexity. Might change my mind at some point!

That's a good idea! The amount of times I regenerated the WIM! Might host it in SharePoint, that's worked quite well for copying desktop icons for students 👍

That's it, inside Config >> Scripts, tbh I don't remember creating it, but it was a while ago! Then when you rerun the process everything is merged into the ISO/WIM, everything inside StartNet runs right after the network adapter becomes live.

I am no expert on this but I have done a lot of back and forward in Claude AI, to get a complete script working. The script is stored in the workspace in the StartNet folder, this launches automatically when you boot from the OSDCloud PE before OSDCloud does anything. We are moving fully to Autopilot and Intune, so no local AD. When we boot up it launches a powershell form, asks for a computer name, has some logic in it to set the site based on the start of the name e.g XXX-NAME sets the site as XXX etc, then you have an option of a staff or student device, then press go, the hardware hash is uploaded to Intune using an Azure app key and secret, group ID set which inturn sets and assigns a deployment profile. Then OSDCloud launches to wipe the HDD, install the OS and drivers. Machine then restarts, OOBE kicks in and does the rest. End result is a finished device at a login screen ready to go. I just asked it about your your scenario with the unattended.xml (not needed in my setup, as I need the OOBE for the autopilot phase). It came back with a pretty complete layout for it including a powershell script to start the process. Similar to the way I am doing it. Happy to share the script if anyone wants to have a play!

Have you used that profile before outside of OSDCloud does it work if you manually install the OS etc.

This is a good place to start https://www.learningittogether.com/posts/osdcloud-v2-getting-started/

Update on this, I managed to get enrolment working inside OSDCloud using this guide https://github.com/blawalt/WinPEAP modified the powershell script to set the device name too. So once it goes into autopilot it names the PC correctly. We have the asset number in the device name so it's important for us.

In the end we used applocker to block office and forced them to use wordpad and the old version of Photoshop

We are about to start using OSDCloud on mass, really basic config, we get the devices into autopilot using the autopilot info script before we wipe. Then boot from the USB to re install the OS, once finished autopilot takes over. I love the fact it does the drivers for us, we are mostly a Dell house. I did play with the autopilot info script within the OSDCloud PE image, but I don't think PE contains all the bits of powershell that are needed. Tbh once it's in autopilot it's there for life so not much of an issue.

I know it's pretty unusual, it's Graphic Communication it's a 10 hour exam over 2 days. It's just internet access they are not allowed, but are allowed to use everything else. Ps it's AQA. As every they don't really give any guidance apart from "disable the internet" I think I may reach out for further guidance.

Hi all, we have a couple of IT suites where students take their graphics exams on computers, they use their actual accounts as they need to access some resources from their coursework etc. however they are not allowed internet access, we achieved this buy using a GPO to block all sites in edge apart from the ones used to license the Adobe suite and office. However students have now figured out they can email each other, via the outlook desktop app, I can block that app using app locker. My question is how do you if at all stop them from sharing a PowerPoint between students and passing 'notes' that way using the collaborative nature of 365. They apparently need to use PowerPoint so blocking that won't help me unfortunately. Appreciate your advice!

Thanks for this, we have been suffering with this for weeks. Like you we thought it was Windows Updates. We were getting it when connecting peripherals e.g. HDMI, USB etc. The script above is in slightly the wrong format it needs to be like this: $BlankFile = "c:\program files\renato\senso.cloud\disablefilter" $FileExists = Test-Path $BlankFile if($FileExists -eq $True){ Return} else { New-Item -path "C:\program files\renato\senso.cloud" -Name "disablefilter" -itemtype file} Start-Sleep -s 10 Restart-Service "senso.cloud.service"S Then deployed using the remote script module as PS1. Thanks again! We now have this rolled out, fingers crossed this cracks it! Interestingly we don't use ESET we use MS Endpoint.

Correct they would get the default filtering which is technically the guest policy, this does not force login as it's just basic DNS filtering. It's also the most relaxed filtering. Not had any issues with things being blocked as yet. You could always set a static DNS server on the device which bypasses the filtering entirely. Unless you will be blocking all other DNS on your firewall apart from Securly. Which is a good idea.

The way have it setup is our DNS forwarders on our DC point to Securly, meaning if a device doesn't have the SSL/SmartPAC/Extension they get basic DNS based filtering. This works for headless devices like tills etc. Plus also our guest network. We then install the PAC or extension on managed devices to get a more granular level of filtering. Like others have said you can't filter by specific internal addresses, the only way to achieve that is to have that VLAN leave the network on a different external IP, you can then apply a set level of filtering to that in the Securly UI. We have had this running for 3 months now and I can say hand on heart it's far better than the smoothwalls we were using before.

Evening everyone, I wondered if anyone could help, I am looking at firewall options at the moment, WatchGuard is one of the proposals I have. I wondered if anyone was running one in a large secondary, we have circa 400 laptops, 400 desktops. Around 1600 students and 300 staff. With a 1GB line. Is anyone using an M390 for this sort of size or do you think we would need to step up to the M590. We are currently running a Smoothwall S10 which seems fine. Thanks in advance.

Update we have around 120 access points up so far, not under load but the controller seems to be fine! Been a fun couple of weeks, up and down ladders, in false ceilings and generally very hot! Tomorrow is mounting points onto concrete ceilings, SDS at the ready!

Really interesting reading this, we currently have Smoothwall at two sites, it has its quirks, most annoyingly the idex agent not detecting a login and the need to log off and on again, or restart the service on the domain controllers. Reporting is rubbish, even with the cloud enhancements. Support has been a bit better of late, last year it took days to get a response. But for the most part it works. Plus it's nice and easy to setup different filtering levels based on IP ranges within the schools for guest etc. We've had the renewal through for next year and it's very competitivly priced. Securly is almost the same price over three years. This also includes adding a third site, so three UTM's. Lightspeed is slightly more expensive, but I have again heard story's of client issues etc. To add to the the cost with the Securly/lightspeed option we are going to have to source separate firewalls for each location. We have had pricing for WatchGuard that's somewhere between 4K and 8k each site depending on size. So the costs really start to stack up. The cheapest firewall solution looks to be pfSense, that's looking like 13k over 3 years with 3 X Netgate boxes, installation and some support from the 3rd party. I know we could run this on some of our own hardware, but I am not a firewall expert and would like someone who does it for a living to set them up. I am wondering like others if it's better the devil you know!

Cheers, I think I will see how we get on. We have three sites, I have turned on multi site within the controller. And we will setup each academy in its own site. We should be able to easily move if things don't work. Appreciate the advice tho!

I did think about a cloud key, but we have plenty of server space. Yeh managed to get hold of 210, sitting in our store room ready to go.

Hmm, I am no RADIUS expert, we are using basic NPS on Windows. So things I setup today to get this working: Within NPS the RADIUS client setup for the AP IP or the subnet the AP's are in. Connection policy setup in NPS based on AD group. VLAN tagged on the port the AP is connected to, we are using HP switches so this is needed. Network configured within the unifi controller, VLAN ID only no subnet etc needed. Profile configured within the controller with the relevant secret added and the IP of the RADIUS server.

Ah interesting, I tested RADIUS today, got that bit working. At what point is it not working?

I wondered if anyone had any tips for deploying a large amount (200+) of U6-Pros, we will be installing over the summer. It's been about 4 years since I have done this personally. Any tips for keeping track of which one is going into each room etc. Any config changes needed. This will be across three sites connected by VPN, with the controller running on a Windows box.