Alex0x7F

@Bankesy If I am understanding your current issue correctly, in a cluster any mounted ISO needs to be on storage all nodes can reach, so a local path won't work, which is why FCM is complaining. Drop the ISO onto a cluster shared volume (e.g. C:\ClusterStorage\Volume1\ISOs) or another shared location and point the DVD drive there, it should browse fine after that.

Easiest way is PowerShell: Get-VM -Name "YourVMName" | Select Name, Path That Path property is the VM's actual config folder (not the VHD location) and should show you where it's living. Alternatively right-click the VM in Hyper-V Manager, Move... > "Move the virtual machine's storage", and the next screen shows you the current paths for everything (config, checkpoints, disks) before you actually move anything. Just hit cancel once you've spotted what you need.

As a former IT Tech and ICT PPA teacher in a primary school, in my experience M365 would have been largely inaccessible for most pupils. UKS2 (Years 5–6) could potentially manage it, but for the rest of the school it would be difficult to use effectively. We found Google Classroom worked well for UKS2, while J2e worked across all year groups from Foundation to Year 6. This made ICT much easier for pupils and staff across different devices, iPads in KS1 and then a transition to Chromebooks from Year 3 onwards.

I can recommend using Veeam’s restore to Hyper-V. I’ve used it a many times and it’s been the most painless way of moving hosts especially when swapping out the physical tin.

Hey @Caffeine11 sounds like you're on the right track from the last time I set this up as a proof of concept. To sync AD with Google Workspace you need both Google Cloud Directory Sync (to handle user and group provisioning) and Google Password Sync (for pushing password changes), since GCDS alone doesn’t handle passwords. Google Password Sync captures any AD password change on a domain controller, therefore including ones set via PowerShell CSV, so your scripted bulk password reset will count as a change and sync to Google. The part to watch is that GCDS has an option to force users to change their password at first login, which you’ll need to disable if you want pupils to keep a fixed password, and you should also turn off the ability for pupils to change their password in Google Workspace itself (either in the Admin Console or with GAM) so that the fixed credentials remain unchanged.

Hi @Simcfc73 it’s your Enrollment Status Page (ESP) getting stuck on a required policy or application during the Device setup phase. When I had this issue it was the enforced BitLocker policy that kept failing to apply, but it could also be a different security baseline for yourself. To find the error, while it’s on the hanging screen press Shift + F10 to open Command Prompt, then run mdmdiagnosticstool.exe -out C:\logs\ and export the logs to a USB drive. You could also create a temporary ESP profile that doesn’t block device use and assign it to a test build machine; if that build completes, you’ll know one of your required items is failing. In my case, I removed BitLocker as a required item for Autopilot and set up an Entra group that enforces BitLocker encryption, and add the device in after it's built. That “login anyway” prompt you see after clicking Continue means the device is only half-provisioned. it’s Azure AD joined, but user setup failed/didn't complete so there’s no profile to log into. This prompt can also be disabled so the device is forced to fully provision, or will time out if there's still an issue. Hopefully the logs will point you to the root cause of the issue, let us know how it goes!

I recommend taking a look at J2e, specifically the JIT5 tool. The paint tool in JIT5 is simple enough for Year 1 to use, and it handles saving and evidencing work super easily if you create class folders. It is subscription-based, so unfortunately not free, however I used to be able to use it to successfully teach the majority of units throughout the year. For KS2 we used Google Workspace SSO logins on their individual Chromebook profiles, but for KS1 you can generate QR codes from inside J2e for each child to scan and log in, as they'd mainly be completing their lessons on iPads.

The South West Grid for Learning Trust (SWGfL) has an Artificial Intelligence in Schools policy template you can adapt. It covers staff and student use, data protection, and risk management. Online Safety Policy Templates - Appendix C6

Sharing a ChatGPT Plus login isn’t allowed under OpenAI’s terms. Not that schools often give a hoot (cough Twinkl accounts, cough). If multiple people need to use it, you’ll need either individual ChatGPT Plus accounts or, preferably, a proper Team plan with better access control. I know you’ll already be well aware of the potential issues around AI models, so no preaching here! 😆 Personally, knowing what my staff are like… alarm bells start ringing. (especially some in SLT!) Things like: Staff pasting in sensitive pupil data “just this once” Never clearing chat logs that include data or signs of misuse, then other staff accessing it through the same shared login. I’ve moved away from education in the past 10 months, and it’d be interesting to see how schools are starting to adopt AI models. I imagine it’ll vary wildly from one place to another. Have your staff had proper training on responsible AI use? Does your school or trust have an AI policy or updated acceptable use policy covering this? I suppose they’ll end up using it regardless of what the IT goblins suggest is best practice when we’re not looking. 🫣

Biebian

I wouldn't entertain the thought of remote access for non technical staff. 0365/Google Workspace for any file storage needs, or if they must have access to the network, then I'd explore a VPN, with my preference being Cisco AnyConnect's Secure client using SSO & MFA enforced.

First we hide the user from global address list, then convert mailbox to shared, but we definitely wouldn't give access to the new employee. Setup an automatic response saying "I no longer work for XXXX, any queries please contact [email protected]". In some cases, line managers may be given access to the mailbox but this is rare.

Stick them to the back of my keyboard, they're usually all SchoolName1 anyway. (I joke... but I've seen it numerous times.) 1Password for work, Bitwarden for personal.

Previous academy I worked at also used Boxphish, seems very common in LA's. Here we use usecure's uPhish and uLearn Security Awareness training. The reports and customisation is fantastic.

SC-900 please sir!