rjf99

I am supporting a school (not in the UK) with an incredibly tight budget. There are 40 teachers each of whom have a Windows laptop, which is unmanaged. All teachers have a local admin account. Most are running Windows 11 Home. There is no Windows server, and no budget for one or a cloud alternative. I have spoken to a dozen teachers and looked at their laptops with them to discuss how they are getting on. Many were handed the laptops out of boxes and have used their personal Microsoft accounts to sign in. Others were passed the laptop by a teacher who has left and the laptops are signed into their personal MS accounts. Others have local accounts and have risky apps or Chrome extensions installed. Many users were distratcted by many of the features in Win 11, such as the facts on the lock screen, the 'about this background' icon on the desktop, and the useless pinned apps. I have resigned myself to the fact that it needs to be a case of best endeavours with unmanaged devices. I am currently compiling a list of devices, so that I can figure out which are obselete, and groups of laptops which have identical hardware. The school has a Google Workspace which I am managing, but not a Microsoft 365 in place. My plan is to find a group of identical laptops, and choose one to copy necessary data from, and then follow this process: - factory reset (wiping all data) - sign in using a generic school admin account and use this to ensure laptop encrypts using bitlocker - create a local, standard user account - install necessary software (as much as possible from MS Store as these will auto-update with standard account no problem), and the rest Chrome, Drive etc. that should auto-update themselves - there is no Office licence in the school - most staff use Libre Office - so install that also - I know that is a MS Store version, but I believe the regular version can be ammended to ensure that the default file extension is .docx - I have heard of many issues in the past with it defaulting to .ods and it causing problems - log onto the local user account and remove bloating e.g. useless apps and just generally clean it up Does this process sound reasonable? I am also looking at scaling it? If I had a checklist to work from, it's not an impossibility to run through it all individually. Especially if I had 5 identical devices on the bench at one time. Ideally I want to streamline it though. Either through a script (I had a terrible experience with chatGPT writing a script!) or by cloning the devices. The issue I had with cloning though was that after they are generalised the user accounts are removed, and the bulk of the time going into this is with the user accounts. Does anyone have any suggestions? Some devices have free virus checkers, others nothing. I'm aware we can get Bitdefender for all devices cheaply with a central console. Is this worthwhile or is Windows Defender sufficient? The lack of central console scares me to be truthful. I am fully aware that this situation is bordering on farsical, and the school are well aware that what I will be doing is best endevaours, and I am happy that I am sufficiently covering myself. There is almost no budget for this. My experience is with physical Windows servers, domains and group policy. And those aren't tools available to me here.

We are having a Wi-Fi refresh, and it is a good time to introduce better SSIDs. We have the following need: - access for guests to internet only e.g. no LAN - access for teachers on their laptops on an individual SSID - MSP have advised that this will allow for separate filtering for these devices and management have agreed to this - access for student devices such as 1:1 iPads, shared iPads, Chromebooks etc. - access for staff on personal phones - some staff are currently using these to access LAN resources such as printers - appreciate this isn't sound from a security point of view - access for interactive tv's etc. in classrooms - these will receive the same filtering as every other SSID except for 'teacher on their laptops' I want the SSID names to be as clear as possible. Let's say our school is called St Mark's. I am wondering about SM_Guest - captive portal, no LAN, normal level of filtering SM_Staff_Laptop - less restrictive filtering SM_Student - Student devices, LAN access, normal level of filtering SM_Staff_Phones - normal level of filtering, no LAN There is maybe a need for one final network so that if someone wants to connect say an interactive tv, they know to use that network rather than the teacher laptop? Or should they use SM_Student for that? Or should I rename that to SM_Student_Access to make it more clear that it's for devices used by a student? We are not in the UK, btw.

I have a request to enable read allow software for a single laptop in the school. Our school owned laptops are chromebooks and they have a built-in feature which can be enabled. This allows a user to highlight text and press a shortcut key to read it aloud. I know that Windows 10 has a similar feature built in, but unless I am missing something it doesn’t seem to simple / user friendly. What I am specifically looking for is to allow a user to highlight text (in any programme) and press a shortcut key to hear it read aloud. Does this exist natively in windows 10? If not, are there any free applications that will allow this? The laptop is running Windows 10 and is non-domain joined.

I just wanted to double check how many tokens Moysle requires renewing annually? We have iOS devices that are DEP enrolled and are automatically linked to Mosyle out of the box by Apple School Manager. Am I right in thinking that there are two tokens? One for 'VPP' app licences? And one for linking Mosyle generally e.g. allowing it to enforce restrictions etc.?

I ran a training session at a community centre last week. They had a very large and high end CleverTouch interactive TV, with software on enabling AirPlay. I found that the AirPlay lagged approx 10 seconds behind the iPad being used though. I haven't experienced this before, even with lower-end TVs. Maybe I'm wrong on the quality and it's just underpowered. I won't be able to get the model number until next week. Some of the other possible causes I was theorising were: - The TV has some Android apps installed. Could some of them be running in the background and slowing things down? The TV was completely off and unplugged when I arrived. The rest of the interface on the TV was smooth - Too much Wi-Fi / LAN traffic ? There were x10 iPads turned on, which has been off for many weeks, so they could have been pulling a lot of data down for updates. They have very few apps installed and I didn't see any updating. They aren't running the latest version of iOS available for them, so I suppose they could have been pulling updates. - They have two Wi-Fi networks, and the devices could be on different SSIDs and potentially different subnets? (I think very unlikely on this one, and I know AirPlay has some specific set-up requirements around different subnets, which I don't think are in place.) The network is all brand new within the last 18 months, and all of the equipment I have seen is low to mid enterprise level Any other suggestions? Only thing I can think of in the first instance is to fully update all of the iPads with the latest iOS and apps. Then either contact the TV manufacturer or factory reset it?

I am doing a bit of work supporting a charity for children with special needs who have a number of iPads that are unsupervised. I am looking to bring them into an MDM. Does anyone know if: 1) I can sign them up for an Apple School Manager account? 2) If I can't get ASM, and have to get Apple Business Manager, are there any disadvantages, other than not getting the discount on 20+ apps that offer it? 3) Has anyone experience of getting a Mosyle Education account for something that is education related, but not strictly education? The iPads are a bit disorganised at the moment, but it will be a hard sell getting them to put funds towards an annual subscription for an MDM.

Thanks all. We are going to trial x5 Chrome Flex OS and x5 Windows 10 (it is actually Pro, rather than Home, I was confusing two different schools together.) The x5 with Windows will have JumpCloud as a trial, and we will go from there.

Some great responses. I am going to look into ChromeOS Flex in the longer term for sure. Great to know that they are on the certified list. Nano tape is a great idea, and a big time / cost saver.

Thanks for the great responses so far. To try and draw a few things together... Completely agree with everything said about safeguarding, and perhaps this didn't come through strongly enough in my first post. I'm confident in my grasp of the legal / ethical requirements. It's with achieving a technical solution to fulfil these with the resources I have available that I'd really value support with. There is effective filtering in place via the ISP, however an example of software that I found installed on a PC was a VPN. They are a Google Workspace school, with a limited number of Chromebooks. The policies in place on those 95% of the way there, and I have agreed to resolve anything amiss there. There is absolutely definitely no server, shared storage space, or workgroup. Admin team are 99% of data in cloud applications accessed through a browser. There is some data being stored locally on machines. Obviously there is an issue there, but does also have to come a limit to how much of my time I can offer as a gratuity around my full time employment. ChromeOS Flex, was at the back of my mind. I have had great experience in the past with that product when it was NeverWear CloudReady, and is something I will investigate. However, the buy in wouldn't be there at the minute, or my availability to offer training. So that might be something to circle back to in the medium term. In the short-term, the machines will almost certainly stay with Windows 10. I am trying to think of the priorities from a technical perspective to safeguard the students and have them running smoothly over time... - Student accounts with no admin privileges - Prevent Chrome extensions from being installed - I don't know how I can do this without AD? What else can I realistically do? The idea of setting 1 PC up as I wish and then cloning is probably the most likely. If so, what MMC changes should I make?

I have a set of x10 PCs in an ICT Suite of a school that I am supporting as a favour. At present all staff and students have admin accounts. There is no server or domain and the PCs are running Windows 10 Home. It is the unsafe mess that you would predict. I will be wiping them all and starting with a clean install of Windows 10. The first order of business will be to provide staff and students with no admin access. Are there any other considerations that are practical without a domain / group policy? Separately, but I think somewhat linked... There is no network or shared storage at present. It might be the case that the school are happy for this to continue. The ideal thing for me would be Google Drive, with separate user accounts and Google accounts for all students. Without a domain / Windows Server, it feels like I'm barking up the wrong tree. Is it feasible for them to use generic Google accounts and have access to a Google Shared Drive that allows for file creation but not deletion? I suppose it does run the risk of a user overwriting another user's work by say deleting their essay and saving it. Other than a backup solution, I can't see a way around that. (As I'm typing, I feel like I may avoid kicking the hornets nest here, as there is no perfect solution, and I may just be creating hassle for myself.)

Several are currently running Windows 11, with no apparent issues (other than being as slow as the others running Win10)

I am helping out a school for children with special needs with a project to upgrade their ageing ICT Suite. They will pay for the parts, and I will supply the labour, tools and software as a gratuity. The existing 3.5" HDDs drives will be replaced with SSDs, and the RAM will be increased from 4GB to 10GB. (There are x2 slots in the machines, and they currently have 2x2GB, so replacing one slot with 8GB.) The PCs are Dell Optiplex 3060 Tower PCs. https://dl.dell.com/content/manual43846229-dell-optiplex-3060-tower-setup-and-specifications-guide.pdf?language=en-us&ps=true https://dl.dell.com/topicspdf/optiplex-3060-desktop_owners-manual_en-us.pdf There is no volume licence for Windows 10. They all appear to be running individually licensed copies of Windows 10 Home. There are two scenarios (depending on their needs/wishes) a) Wipe the PCs and start again with a clean Windows install b) Clone the existing drives. 1) I'd be interested in feedback on devices such as this one: https://www.amazon.co.uk/Wavlink-External-Docking-Station-Functions/dp/B01H7D5W4G/ref=sr_1_5?crid=2AMIJKO4G1H8A&keywords=ssd+clone&qid=1678823899&sprefix=ssd+clone,aps,140&sr=8-5 2) In terms of the physical insertion. The product that I'm looking to buy doesn't appear to come with any cables or caddy to situate it in the PC. Does anyone have any suggestion as to what I will need. I have linked to the product below. I appreciate it might be a case of opening the PC case and seeing what I need. https://eu.crucial.com/ssd/bx500/ct240bx500ssd1/ct12851433

I have certain 'profiles' for installing apps that are not pushing to some users who have a 1:1 device assigned. This is because those users do not have a location set. I have tried to follow the Mosyle instructions but can't seem to find that option. Does anyone know what I'm doing wrong? I have other users that I know are assigned a location as they are receiving those apps, but even when I try to edit them I can't see their location. I do realise there is an option to assign profiles to users with no location, but I'm not looking to do that.

Thank you all. Myself and the students very much looking forward to choosing one.

I'm looking for a very simple assessment app that can be used on Android / iOS and also through a browser on a computer / laptop. The criteria is: - low cost - able to upload a custom curriculum / objectives - can upload photos (and videos would be a bonus) and link them to students and objectives - can mark objectives off as being achieved - can view a list of which objectives are remaining etc. I have Tapestry before in EYFS, and am trialling that. But it seems more geared towards continuing assessment, whereas we are very much looking for summative assessment of ticking off objectives.

I am a primary teacher and have been teaching Scratch to my classes over the years. This year we have taken it a small bit further by connecting a Micro:BIT. The students have enjoyed this a lot as they can control their characters using the buttons. They wanted to make some two player games though. Has anyone got experience of connecting a simple USB joystick to a Windows PC (or even better a ChromeBook) and using it to control Scratch? I have Googled the topic and read about software that will map the movements of the joystick to specific keyboard buttons.

I just wanted to double check that my understanding of the tokens / certificates required by an MDM is correct: - x1 APNS certificate that allows MDMs to configure settings such as passcodes etc - x1 Apps and Books certificate that allows the MDM to access licences from Apple School Manager: Apps and Books ?

I went to replace a switch today, and had mistakenly thought that the rack mounted PDU had a power button on it. (It turned out just to be a large light.) I can see a little behind the PDU and think that the cable goes upwards and out of the rack. I'm more or less certain that there is no 3 pin sockets inside the cabinet, and there are certainly none nearby that are obvious contenders. Looking for advice on what to do in this situation. Would it be expeted that this is connected to a 3 pin plug? The brand of the PSU is 'Geist.' If so, I guess my options are turning everything off one-by-one and seeing if it goes off, or having someone suitable to turn off the power to that room on the switchboard?

Perfect - that worked first time and was so simple to set-up. At the moment if I print a photo it blows it up to A4. Is there an easy way to print say 4 photos on one page, in the way that Windows offers the really easy options? I'm thinking that maybe there is an iOS app that can do this? If there isn't, I will certainly settle for what I have now!

We have no server, and printers are set with static IPs, and then added to individual laptops using the Control Panel and their IP address. The printers have no AirPrint facility. By any chance, is there any software for Windows that can be installed and will then advertise printers that it can access on the network via AirPrint?

I'm on the lookout for any programming apps that are available for iOS? At the moment we have been using ScratchJr, but I am always on the lookout for new options.

@dsmith8 That sounded like a great option. I tested it on a device that had YouTube blocked and it didn't help. I will give it a go now though on a device that is seeing the filtered version of YouTube and see whether it gives us the option to add in specific videos that are incorrectly filtered. @johnmayo74 That is a great resource - I will be signing up to that for sure. Thanl you!

Thanks for the reply Paddy. Yes, it is quite limiting. I had forgotten about the content restrictions checker. I tried it on a laptop which is in the IP range that is to block YouTube, and it wouldn't load. And the screenshot below is from a device which is allowed to view YouTube videos. It's beyond my understanding how they're doing it, but they have their own method for blocking / filtering YouTube. I had hoped to be able to use the Google admin console to approve videos which are blocked, but my assumption is that with the way they are filtering it won't make any difference. I will investigate later to see. We have no servers, and are currently relying on the ISP managed router to provide DHCP. They won't accept requests to set MAC reservations, and suggest that we make static reservations on individual devices, which we are looking at 30-40 of. I think a more manageable option is for to invest in a device to control our own DHCP, and set reservations in this. This feels like the most afforable option I can find: https://www.comms-express.com/products/ubiquiti-er-x-edgerouter/

I worked for many years in London, at LGfL schools and understand that filtering system used there - including for YouTube. I am now working in the Republic of Ireland, and am lacking a network here of other schools for support, so am reaching out here for a general feel of things. What we are looking to achieve is a split level filtering system where students cannot access YouTube, but staff can. Schools in Ireland all use one internet provider, Scoilnet. They provide six levels of filtering, and it appears to offer far less customisation than LGfL. I have attached the two documents that they have sent to me. Their advice is to choose Level 3 for devices generally, and Level 4 for devices which are assigned an IP address in a 'staff' pool... this sounds straightforward enough. From the literature, and speaking to them, there doesn't appear to be a correlation between YouTube's own 'Moderate' and 'Strict' filtering which LGfL allows. The team were a little unclear, but it sounds as though their web filter may be doing the filtering, as opposed to it being done at YouTube's end. I'm also interested in the possibility of using Google Workspace to filter / allow YouTube. But I have no experience of this. From reading up on it, it sounds as though the admin panle can be used to allow certain videos, but I'm unclear about whether this would allow them past ScoilNet's filtering... my gut tells me that it wouldn't. If anyone has any thoughts or suggestions, particuarly with regards to using Google Workspace, they would be very much welcomed.

Excellent - thank you. I didn't look hard enough. I have a 'teacher' account listed in MoSyle already that has synced from ASM. When creating the administrator account, it asked for User ID. I copied and pasted this from my 'teacher' account. Mosyle didn't like this and said that the User ID already existed. I'm quite happy with the way that it is set up, and don't plan to change it. Out of curiosity, could I either... 1) List myself as an adminsitrator in ASM, that would sync to Mosyle and make me an admin there? 2) Go into Mosyle and 'move' my existing teacher account into the admin section?