mjhardisty

I think we have to accept that commercial customers of Microsoft are subsidising the education sector. We have to accept having features and applications rolled out to our tenants after enterprise customers and that the platforms are designed with them in mind. In regard to enabling some features that are paid, then the cost of A3 or A5 or Enterprise & Mobility Licencing for a subset of staff shouldn't be out of reach of schools.

2FA can be targeted to groups of users, so you can exclude students and also enable conditional access so 2FA won't apply with devices when they are used in school.

Hopefully now a thing of the past.

Move should be disabled ... See if you can recover from a backup!

You could try it via GPO and copying the file .... not sure whether the same environment variables for the user are available. There are plenty of ways to skin a cat as they say. The script should be lightweight ... it doesn't do much, but give it a test!

No idea - possibly some legacy instruction! Glad its now working.

Take a look at the vendors offering Windows 11 SE devices. Depending on curriculum needs they may be perfect. Windows 11 licence included and pre-configured with Shared PC policies that are locked down. Prices from around £180.00.

I produced this guide on changing the Pinned Apps for Windows 11 via GPO: https://markhardisty.wordpress.com/2022/06/07/customising-windows-11-pinned-apps-menu-for-education-users/

Yep, duplicate the GPO settings as per my post and try again.

Microsoft Kaizala is chat - so I would disable that too. They might want Power Automate - if they are adventurous students and get into automating their own workflows!

Try this group policy.

Yep, then no difference!

Look at https://m365maps.com/. If you have A3 licences then that has InTune included, and has a 40:1 student-use benefit. So, for every A3 Faculty licence bought, you get 40 free student licences. So, depending on how many A3 licences you have you need to ensure all the other users have an InTune licence. The most cost-effective way I can see for this is to have a mixed estate of full A3 and Enterprise & Mobility A3 (a 1:15 student use benefit). Specific InTune licences must be purchased per user, and they don't have a student use benefit ratio.

Look at https://m365maps.com/ for guidance. A Student Use Benefit A3 licence does not have a Windows Server CAL as the Faculty licence does. The service & features table here also shows the different between staff/student: https://learn.microsoft.com/en-us/office365/servicedescriptions/office-365-platform-service-description/microsoft-365-education

So, in AD you add a home directory and map it to a drive letter? This works as expected?

https://educationblog.microsoft.com/en-us/2023/02/reimagine-personalized-learning-with-new-category-of-tools-from-microsoft-education Good news from the Microsoft Reimagine Education event.

Suppose a long shot might be to start the program as an administrator, close it, and then see if you can identify any other folder locations that the program modifies via datetimestamps. Do they have a Program Files\Common Files component? Might be somewhere else.

Can you give students R/W access to that folder only? I think we've had this issue with Cubase too ..... Avid's response was to make students local admin.

Might be worth firing that at Microsoft. I can't find anything that exposes the activity feed in GraphAPI that is usable. Try: - works on Teams, not in the same areas but has helped me with GraphAPI/PowerShell queries before. Also:

One of the issues with modern SharePoint is the lack of audience targetting with it's web parts - so a general landing page won't work very well. I'd recommend splitting STAFF/STUDENTS and having a landing page for each - much easier to maintain and easier to setup with permissions. You should be able to setup one of these quickly yourself without the need for a third-party. As per @Steve21's suggestion Cloud Design Box do good stuff, but would be overkill for your immediate needs.

I've amended that method slightly to update the user's W11 menu at login: https://markhardisty.wordpress.com/2022/06/07/customising-windows-11-pinned-apps-menu-for-education-users/

First allow OneDrive Files-on-Demand to run and start to sync Windows Known Folders. Set the following OneDrive policies to allowed: Silently move Windows known folders to OneDrive Allow syncing OneDrive accounts for only specific organizations Prevent users from syncing personal OneDrive accounts Silently sign-in users to the OneDrive sync app with their Windows credentials Use OneDrive Files On-Demand (also add your tenant ID) OK, then configure the new policy: https://learn.microsoft.com/en-gb/windows/client-management/mdm/policy-csp-fileexplorer SetAllowedStorageLocations to LocalDrives SetAllowedFolderLocations to Documents (or include Desktops if you want to sync shortcuts) This will only show the "SetAllowedFolderLocations" in Windows Explorer. Students can navigate to C: still, but are restricted and can't navigate anywhere else but the root. Anything they save in "Documents" will be synchronised into OneDrive.

Its worth running the GPO Report out of curiosity. Like I hinted above, it may be that the GPO is not causing the issues at all, but its an issue on the machine (a service, etc that the restart fixes). If it was a GPO fault, generally you'd get the same reason over and over again - especially being part of the User GPOs.

I wonder if this isn't GPO related. It might be an issue with something else. In the User Details in the report does it give a Time Taken result that matches the 9 minutes or does it show GPO has been fully processed and then you get the software protection errors as Windows logs in? https://learn.microsoft.com/en-us/answers/questions/749452/restart-in-100-years-successfully-scheduled-softwa

In User Details in the report does it give a Time Taken result? It may be worth creating yourself a test OU that has no polices and gradually add them in to see if there is a culprit. We've occasionally had slow User Profile processing due to printer mappings, etc, or resources that are not available.