psydii

To play devil's advocate for a moment.... If you've got a fleet of reasonable machines (at least Zen2 or Core 8th gen with 8GB and a 256GB NVME ssd), Windows is "fine" if you regularly hot desk across a small number of devices, and your user profile doesn't get wiped between sessions. I imagine its also fine if you are mostly a Google workspace school so don't care about all of the Windows bits and bobs, and just need Chrome to be launched (Windows gets its stuff done at leisure in the background, no harm if it takes 5 seconds or 10 minutes!) The laptop-first champion in me wants to counter my counter-points there, but they too can be countered etc etc. Here just opening the laptop's lid and you are working wins for us. Horses for courses.

Once upon a time it was impossible to get desktops to offer the flexibility offered by the laptop experience. It also took a fairly thorough understanding of Windows, Group Policy, AV equipment, and supply chain management to get laptops to provide the reliability of a desktop environment. On the Desktop to Laptop gap, Chrome/Edge and GoogleDrive/OneDrive have (almost completely) closed that. On the Laptop to Desktop gap, SoCs, Modern Standby, Intune defaults, and USB C/HDMI have (almost completely) closed that. These days I'm pretty sure its a philosophical difference. either side can put forward what they believe to be the killer argument. Last time we (were forced to) pivot back to desktops a significant chunk of staff left. When we pivoted back the other way, several mid-tier (b-grade IMHO) senior managers left as they did not 'get it'. I know what it would take for us to pivot again, and it would destroy the school as it exists. Could I take over and happily run a school IT service that was set up as Potnoodle's? Yes, and if the users were happy I would not force or even suggest changing it. If you are doing it well, and the users are happy and it is "how things are done here" it takes courage (in the Yes Minister sense, not the Apple/Schiller way) to throw it away in favour of the alternative - unless of course you are trying to change the culture of the school, and so we are back to philosophical differences.

Not Teaching is a significant part of a Teachers job if they have any drive or dynamism and have been in the job more than a couple of years. I've found they love the flexibility that a laptop provides. Baby teachers also love it as they are still in student-mode for the first year or so and working hard to develop their skills and find a direction for their career, thus being able to move seamlessly from work to home to work on a single devices with all their windows open and ready to go is invaluable. The only gumbling grouses are the teacher who learned their trade elsewhere, have no drive (but feel entitled to promotions?) who expect everything on a plate and feel it is an affront to be expected to work in their departmental office rather than their classroom on their non-contact periods. (our room occupancy is higher than average, for various reasons, and the existence of relatively large dept offices is one of them) I have literally had ex colleagues* run up and shake my hand/give me a hug in the street/club/pub/airport and tell me how much worse their new school with a classroom desktop only environment is. On the tech-side, the trick is the right laptops, the right configuration options (including how you are accessing files, and modern standby), the right AV and power interfaces, and great wifi.

No Windows is unreliable because it gets shutdown every night. Leave it on and let it update do housekeeping etc. It will reboot at least once a month to do updates. (configure updates to have a deadline where the give plenty of warning before forcing a reboot immediately) But generally: do not shutdown. On the charging bill: that is an unserious comment. The laptop is mostly in the classroom and connected to power. it should be almost fully charged when it leaves site at the end of the day. The power consumption is minimal and a worthy expense in exchange for the flexibilty in working arrangements a laptop provides. Also the take it home line was prefixed with "please", it's an ask and a recommendation. Rebelling against it only hurts the teacher.

Apple tried that. It did not go well (for their laptop).

Nope, all in on USB charging staff and student laptops since 2018. Only problem at any scale was on some laptops that were slightly too big for the older trolley and the usb ports did get damaged. This was solved by re-routing cables (and hasn't been an issue since early 2019) We've got hundreds of usb-c (charging) only devices and we've retired hundred at this point now too, and usb-c only charging is (almost) never a problem.* USB-C USB3.2/DP-AltMode on the other hand was a nightmare (2018/19/20 era) I have not revisited recently. Thankfully everything had HDMI ports too, so we could work around that. I'm told if you don't have older hardware in circulaton this problem is a thing of the past. * we see more smashed/dropped/stolen laptops than ones with damaged/failed usb-c charging ports. It does happen occasionally. That said sometimes the usb/pd controller might crash and then a reset button/key combo is requried to get things working again, we probably see 0.25% of devices with that per week and again looking at the helpdesk it seems to have been dropping off as we retire out the oldest machines.

"Don't do anything on it you wouldn't do in front of the head teacher" "This is the school's laptop, we might swap it out for an alternative at any point for any reason" "Save all your work in OneDrive" "Be careful with it" **DEMONSTRATE** how to wrap and unwrap the charging cable "Don't shutdown unless we ask you to." "Close the lid before you move it" "Leave it connected to power, connected to wifi each night " "Please take it home each day" "If it takes me longer than 10 minutes to remove the stickers when you hand it back, I will hunt you down and do things that violate rule 1"

Yeah seen this one a lot recently. It's like the client updated and generated a new unique identifier for itself and now the server refused to recognise it. (The UI tells me the server believes the client is running the older version of solus) Remove the client from the Solus console on the server, uninstall the Solus service from the client and then back on the server, re-add the client. EDIT: and yeah, make sure the client dns name lines up with its current IP before you start the de-install/re-install- the old way to breaks things still work well a decade after release.

There is an alternative contact method on his other blog Contact - SIMS + Power BI Blog Also if you sync via WONDE they might be able to advise whether that client/service is still a going concern. The lack of activity on either blog and elsewehere does not bode well.

Similar. Also I've found some of our computers upgrade experience indicators have gone "red" in just the last week. By the way, that's not the latest build for Win11, they updated around 10th June. Possible more relevant to your scenario, for reasons I can't quite figure out, some Windows updates completely refuse to automatically install during the day, even alongside others (that also require reboots) that install and reboot as expected by policy/deployment/collection maintenance windows settings. Leaving them overnight and things settle down. But we do have a bunch that just seem to fail to download/upgrade at all despite being up to date with all drivers, bios, windows updates etc. Open to anyone sharing their experience of this - one possible thing I have not investigated is that some updates are not actually available through WSUS/Windows Catalog, and its possible that the machines that have updated ok have at somepoint picked these up directly from WU leaving them in a better state than those that have only taken updates via SCCM ? (sometime ensuring the device has a wired connection seems to help)

Been thinking for a while of adding "Associate Deputy Safeguarding Lead (Digital Safety)" to my job title. (that title looks made up, but its not far of several others that exist in the wider safeguarding team!)

Those lists are carefully guarded, they are not accessible on any filtering platform, they just exist. From an admin's point of view they may as well be compiled into the executable. If you are rolling your own filtering system, IWF and the ?Home Office? are not going to give those lists to you, so you cannot build a compliant filtering platform in house.

Just me and my deputy. Overseen by the DSL (who also happens to line manage the IT Service). Very rarely actually get a legitimate request to have something unblocked, usually it was transient error, a pause by the web-filter as it decides what category to put the site as its new that day, or that the teacher hasn't signed into YouTube so gets the most restricted set of results. All requests logged on the help desk, and form part of a termly report from IT to the dsl. (the report is more to demonstrate KCSIE compliance to governors than serve any practical purpose - since the anything that needs to be reviewed happen pretty much instantly it hits the helpdesk, or escalated within the line-management framework which operated at a much faster cadence than the formal reports). (Technically the DSL has access to the filtering platform as does the Head Teacher, but they never logon)

Is the client in the same subnet as the server?

I've seen something similar when moving from a per-user to per-machine based install. We have seating plans so a missed sync isn't the end of the world, and most of the work is done direct into the cloud anyway.

Ah, yes. I used to use little automations like that when I was a loan tech. Gets a little messier when the team is bigger and SLT require more flexibility. Probably starts to work again at larger scales. For us if they haven't received a calendar confirmation from the service desk, the laptops aren't coming. As an aside, does the powerautomate stuff exist in your account's context or is it a tenant-wide thing? i.e. if you, say, switched roles to finance director (don't laugh, I've seen it happen), would the tech in after you be able to use the existing automation or would they have to recreate it? (I've bounced hard off powerautomate hard a few times, and never managed to really get even as far as your "not fancy" code, and wondering where it is really kept, has been part of what's keeping me away),

Nothing as fancy as above. Request sent to helpdesk, helpdesk create a calendar event, including the room, trolley, requestee, and sometime the tech who will do the delivery/collection all as attendees. We need to have this as a manual process as it there are some booking combinations that are impossible to execute even though we have enough devices. (moving 6 trolley/ 120 devices between 16 rooms across multiple buildings and floors is slightly beyond our capacity, usually; but if the moves are into adjacent or nearby rooms it *can* be possible, and if one of the requestee departments has a tech team (for example science, or technology) they can lend a hand to make complex moves possible. Also if a trolley is booked out back to back all morning, we might want it out of circulation in the afternoon for a check up (and later in the laptop-set's life when the batteries start to wear out, a recharge).

It does sound like Tefters might have the sharedpc wmi setting applied (which blocks OneDrive client). I was poking around at somthing similar recently and there are also now example scripts on for this on learn.microsoft.com too. Configure a shared or guest Windows device | Microsoft Learn

That's the old Microsoft way of doing it, if you fancy splunking through the github site that sites behind learn.microsoft.com you can find the original page. We also set it up back in the 1709 era (so contemporaneously with that spiceworks post) and its been running like that just fine ever since.

It perhaps wouldn't win the argument in an organisation that might be physically targeted by determined (financially/commercially motivated hackers), but I've taken the view that a school fully managed device is a *good enough* second factor (something you have) for most systems. HR /MIS / RDP /Entra etc all require a "third" factor (Authenticator usually).

I vowed never again after Connect 2.1. Not that it was bad, but it was clear NT5 was going to eat its lunch.

Pop wireshark on the client and see what it's trying to connect to?

For posterity (in case the link breaks in future), the Konica Minolta MFDs described in that document have a feature called "Quick IP Filtering" which on some models, by default, filters traffic to only allow from IPs matching the first 3 Octets, this is "equivalent" to a subnet netmask of 255.255.255.0, except it ignores the actual subnet mask configured on the IP stack. It operates at the application level, so as per the packet captures - the IP stack responds as expected, but when you try to try to connect at the application level (HTTP in the above Wireshark capture) it drops the connection. This feature can be configured to better match requirements.

Wild stab in the dark: https://manuals.konicaminolta.eu/bizhub-C658-C558-C458-C368-C308-C258-UD/EN/contents/opkey_925_S.html#_102157831

(I'm just reading that page too, so you're probably ahead of anything I have to say) The only other thing that jumps out at me (assuming you are *sure* you're running the command as domain admin, and you have completed the modern authentication process, is the recommendation to run the command from the server with Entra Connect installed so that the powershell command has access to the necessary dlls. But I'd expect a more dll focused error if that were the problem.