rjf99

I am supporting a school (not in the UK) with an incredibly tight budget. There are 40 teachers each of whom have a Windows laptop, which is unmanaged. All teachers have a local admin account. Most are running Windows 11 Home. There is no Windows server, and no budget for one or a cloud alternative. I have spoken to a dozen teachers and looked at their laptops with them to discuss how they are getting on. Many were handed the laptops out of boxes and have used their personal Microsoft accounts to sign in. Others were passed the laptop by a teacher who has left and the laptops are signed into their personal MS accounts. Others have local accounts and have risky apps or Chrome extensions installed. Many users were distratcted by many of the features in Win 11, such as the facts on the lock screen, the 'about this background' icon on the desktop, and the useless pinned apps. I have resigned myself to the fact that it needs to be a case of best endeavours with unmanaged devices. I am currently compiling a list of devices, so that I can figure out which are obselete, and groups of laptops which have identical hardware. The school has a Google Workspace which I am managing, but not a Microsoft 365 in place. My plan is to find a group of identical laptops, and choose one to copy necessary data from, and then follow this process: - factory reset (wiping all data) - sign in using a generic school admin account and use this to ensure laptop encrypts using bitlocker - create a local, standard user account - install necessary software (as much as possible from MS Store as these will auto-update with standard account no problem), and the rest Chrome, Drive etc. that should auto-update themselves - there is no Office licence in the school - most staff use Libre Office - so install that also - I know that is a MS Store version, but I believe the regular version can be ammended to ensure that the default file extension is .docx - I have heard of many issues in the past with it defaulting to .ods and it causing problems - log onto the local user account and remove bloating e.g. useless apps and just generally clean it up Does this process sound reasonable? I am also looking at scaling it? If I had a checklist to work from, it's not an impossibility to run through it all individually. Especially if I had 5 identical devices on the bench at one time. Ideally I want to streamline it though. Either through a script (I had a terrible experience with chatGPT writing a script!) or by cloning the devices. The issue I had with cloning though was that after they are generalised the user accounts are removed, and the bulk of the time going into this is with the user accounts. Does anyone have any suggestions? Some devices have free virus checkers, others nothing. I'm aware we can get Bitdefender for all devices cheaply with a central console. Is this worthwhile or is Windows Defender sufficient? The lack of central console scares me to be truthful. I am fully aware that this situation is bordering on farsical, and the school are well aware that what I will be doing is best endevaours, and I am happy that I am sufficiently covering myself. There is almost no budget for this. My experience is with physical Windows servers, domains and group policy. And those aren't tools available to me here.

We are having a Wi-Fi refresh, and it is a good time to introduce better SSIDs. We have the following need: - access for guests to internet only e.g. no LAN - access for teachers on their laptops on an individual SSID - MSP have advised that this will allow for separate filtering for these devices and management have agreed to this - access for student devices such as 1:1 iPads, shared iPads, Chromebooks etc. - access for staff on personal phones - some staff are currently using these to access LAN resources such as printers - appreciate this isn't sound from a security point of view - access for interactive tv's etc. in classrooms - these will receive the same filtering as every other SSID except for 'teacher on their laptops' I want the SSID names to be as clear as possible. Let's say our school is called St Mark's. I am wondering about SM_Guest - captive portal, no LAN, normal level of filtering SM_Staff_Laptop - less restrictive filtering SM_Student - Student devices, LAN access, normal level of filtering SM_Staff_Phones - normal level of filtering, no LAN There is maybe a need for one final network so that if someone wants to connect say an interactive tv, they know to use that network rather than the teacher laptop? Or should they use SM_Student for that? Or should I rename that to SM_Student_Access to make it more clear that it's for devices used by a student? We are not in the UK, btw.

I have a request to enable read allow software for a single laptop in the school. Our school owned laptops are chromebooks and they have a built-in feature which can be enabled. This allows a user to highlight text and press a shortcut key to read it aloud. I know that Windows 10 has a similar feature built in, but unless I am missing something it doesn’t seem to simple / user friendly. What I am specifically looking for is to allow a user to highlight text (in any programme) and press a shortcut key to hear it read aloud. Does this exist natively in windows 10? If not, are there any free applications that will allow this? The laptop is running Windows 10 and is non-domain joined.

I just wanted to double check how many tokens Moysle requires renewing annually? We have iOS devices that are DEP enrolled and are automatically linked to Mosyle out of the box by Apple School Manager. Am I right in thinking that there are two tokens? One for 'VPP' app licences? And one for linking Mosyle generally e.g. allowing it to enforce restrictions etc.?

I ran a training session at a community centre last week. They had a very large and high end CleverTouch interactive TV, with software on enabling AirPlay. I found that the AirPlay lagged approx 10 seconds behind the iPad being used though. I haven't experienced this before, even with lower-end TVs. Maybe I'm wrong on the quality and it's just underpowered. I won't be able to get the model number until next week. Some of the other possible causes I was theorising were: - The TV has some Android apps installed. Could some of them be running in the background and slowing things down? The TV was completely off and unplugged when I arrived. The rest of the interface on the TV was smooth - Too much Wi-Fi / LAN traffic ? There were x10 iPads turned on, which has been off for many weeks, so they could have been pulling a lot of data down for updates. They have very few apps installed and I didn't see any updating. They aren't running the latest version of iOS available for them, so I suppose they could have been pulling updates. - They have two Wi-Fi networks, and the devices could be on different SSIDs and potentially different subnets? (I think very unlikely on this one, and I know AirPlay has some specific set-up requirements around different subnets, which I don't think are in place.) The network is all brand new within the last 18 months, and all of the equipment I have seen is low to mid enterprise level Any other suggestions? Only thing I can think of in the first instance is to fully update all of the iPads with the latest iOS and apps. Then either contact the TV manufacturer or factory reset it?

I am doing a bit of work supporting a charity for children with special needs who have a number of iPads that are unsupervised. I am looking to bring them into an MDM. Does anyone know if: 1) I can sign them up for an Apple School Manager account? 2) If I can't get ASM, and have to get Apple Business Manager, are there any disadvantages, other than not getting the discount on 20+ apps that offer it? 3) Has anyone experience of getting a Mosyle Education account for something that is education related, but not strictly education? The iPads are a bit disorganised at the moment, but it will be a hard sell getting them to put funds towards an annual subscription for an MDM.

Thanks all. We are going to trial x5 Chrome Flex OS and x5 Windows 10 (it is actually Pro, rather than Home, I was confusing two different schools together.) The x5 with Windows will have JumpCloud as a trial, and we will go from there.

Some great responses. I am going to look into ChromeOS Flex in the longer term for sure. Great to know that they are on the certified list. Nano tape is a great idea, and a big time / cost saver.

Thanks for the great responses so far. To try and draw a few things together... Completely agree with everything said about safeguarding, and perhaps this didn't come through strongly enough in my first post. I'm confident in my grasp of the legal / ethical requirements. It's with achieving a technical solution to fulfil these with the resources I have available that I'd really value support with. There is effective filtering in place via the ISP, however an example of software that I found installed on a PC was a VPN. They are a Google Workspace school, with a limited number of Chromebooks. The policies in place on those 95% of the way there, and I have agreed to resolve anything amiss there. There is absolutely definitely no server, shared storage space, or workgroup. Admin team are 99% of data in cloud applications accessed through a browser. There is some data being stored locally on machines. Obviously there is an issue there, but does also have to come a limit to how much of my time I can offer as a gratuity around my full time employment. ChromeOS Flex, was at the back of my mind. I have had great experience in the past with that product when it was NeverWear CloudReady, and is something I will investigate. However, the buy in wouldn't be there at the minute, or my availability to offer training. So that might be something to circle back to in the medium term. In the short-term, the machines will almost certainly stay with Windows 10. I am trying to think of the priorities from a technical perspective to safeguard the students and have them running smoothly over time... - Student accounts with no admin privileges - Prevent Chrome extensions from being installed - I don't know how I can do this without AD? What else can I realistically do? The idea of setting 1 PC up as I wish and then cloning is probably the most likely. If so, what MMC changes should I make?

I have a set of x10 PCs in an ICT Suite of a school that I am supporting as a favour. At present all staff and students have admin accounts. There is no server or domain and the PCs are running Windows 10 Home. It is the unsafe mess that you would predict. I will be wiping them all and starting with a clean install of Windows 10. The first order of business will be to provide staff and students with no admin access. Are there any other considerations that are practical without a domain / group policy? Separately, but I think somewhat linked... There is no network or shared storage at present. It might be the case that the school are happy for this to continue. The ideal thing for me would be Google Drive, with separate user accounts and Google accounts for all students. Without a domain / Windows Server, it feels like I'm barking up the wrong tree. Is it feasible for them to use generic Google accounts and have access to a Google Shared Drive that allows for file creation but not deletion? I suppose it does run the risk of a user overwriting another user's work by say deleting their essay and saving it. Other than a backup solution, I can't see a way around that. (As I'm typing, I feel like I may avoid kicking the hornets nest here, as there is no perfect solution, and I may just be creating hassle for myself.)

Several are currently running Windows 11, with no apparent issues (other than being as slow as the others running Win10)

I am helping out a school for children with special needs with a project to upgrade their ageing ICT Suite. They will pay for the parts, and I will supply the labour, tools and software as a gratuity. The existing 3.5" HDDs drives will be replaced with SSDs, and the RAM will be increased from 4GB to 10GB. (There are x2 slots in the machines, and they currently have 2x2GB, so replacing one slot with 8GB.) The PCs are Dell Optiplex 3060 Tower PCs. https://dl.dell.com/content/manual43846229-dell-optiplex-3060-tower-setup-and-specifications-guide.pdf?language=en-us&ps=true https://dl.dell.com/topicspdf/optiplex-3060-desktop_owners-manual_en-us.pdf There is no volume licence for Windows 10. They all appear to be running individually licensed copies of Windows 10 Home. There are two scenarios (depending on their needs/wishes) a) Wipe the PCs and start again with a clean Windows install b) Clone the existing drives. 1) I'd be interested in feedback on devices such as this one: https://www.amazon.co.uk/Wavlink-External-Docking-Station-Functions/dp/B01H7D5W4G/ref=sr_1_5?crid=2AMIJKO4G1H8A&keywords=ssd+clone&qid=1678823899&sprefix=ssd+clone,aps,140&sr=8-5 2) In terms of the physical insertion. The product that I'm looking to buy doesn't appear to come with any cables or caddy to situate it in the PC. Does anyone have any suggestion as to what I will need. I have linked to the product below. I appreciate it might be a case of opening the PC case and seeing what I need. https://eu.crucial.com/ssd/bx500/ct240bx500ssd1/ct12851433

I have certain 'profiles' for installing apps that are not pushing to some users who have a 1:1 device assigned. This is because those users do not have a location set. I have tried to follow the Mosyle instructions but can't seem to find that option. Does anyone know what I'm doing wrong? I have other users that I know are assigned a location as they are receiving those apps, but even when I try to edit them I can't see their location. I do realise there is an option to assign profiles to users with no location, but I'm not looking to do that.

Thank you all. Myself and the students very much looking forward to choosing one.

I'm looking for a very simple assessment app that can be used on Android / iOS and also through a browser on a computer / laptop. The criteria is: - low cost - able to upload a custom curriculum / objectives - can upload photos (and videos would be a bonus) and link them to students and objectives - can mark objectives off as being achieved - can view a list of which objectives are remaining etc. I have Tapestry before in EYFS, and am trialling that. But it seems more geared towards continuing assessment, whereas we are very much looking for summative assessment of ticking off objectives.