Olliedawg

Thanks for responses. I think we are better off going for Copilot as we're a M365 school.

Has anyone used/heard of SLTAI? I've been asked to look at it by the head - seems ok at a glance but I've never heard of it myself AI Designed for School Leaders | SLT AI

Here we have the below, i might re think this sometime though. Everyday user account - this account is local admin on the techs laptop, also has some delegated permissions in AD to change passwords, view LAPS, view bitlocker keys etc.. Server account - each tech has a "server" user account, which has rights to log into the VM's via group policy. They have local admin access on the VM's (beside the domain controllers) Test Staff & Student account - duplicate staff/student account in special "test" OU which has duplicates of the GPO's for testing DA account - we have 2 DA accounts, the main one, and a backup which isnt used. The DA credentials are not shared with the other techs & is stored away in the master password DB. I have been thinking about a DA for each tech too, but they can do 95% of what they need with delegated permissions anyway via RSAT

In the past i've never received any of the test alerts

We explicitly allow these executables to run, seems to do the trick for onedrive. Ideally you need to run in audit mode & collect logs to see what is being blocked.

AppLocker is great once you have it up and running, I would recommend it. We ditched SRP completely once we had AppLocker configured right. Run it in audit mode & collect what you need to allow that is being blocked. Then test with dummy computers/user accounts You can allow by publisher to allow all the Microsoft windows & Microsoft corporation apps (appx, windows store apps), then explicitly Deny what you want to block. More and more things in Windows 11 are moving to appx (store) apps, even some drivers are pulled from the store now.

As before, If anyone needs a copy of the last "free" version of EWP, I may or may not still have a copy of this if you PM me.

Core HP 5406ZL with a spare chassis in the cupboard incase it dies Edge switches are a mix of Netgears & Mikrotiks (24 - 48port 1gbps, all POE) UniFi for AP's with a software controller running on a VM

1st off - welcome to the forum. Lots of very knowledgeable people here with great advice. I've been in a similar spot myself. I'd probably advise getting an EES sorted so that you can utilise the £1 Windows 10 ESU licences, which will buy you (up to) 3 years worth of time to plan out upgrades. It's not vital to run KMS. You can get MAK keys instead which are multi-use, and deploy these during the imaging process. Please remember you are only human, don't let the stress take over otherwise you will burn out (been there). Would they consider taking on an IT tech, or apprentice to help out? I'd recommend looking at an MDM/remote patching tool to remotely manage the machines if you don't have one already. Action1 is what we use & it's free up to 200 endpoints.

Yes, we're looking at moving to HyperV. Licences are already paid for with our MS licencing so makes sense. We're in the same boat, still using ESXi 8.0.x however we're out of contract for support. (previous perpetual). Broadcom could have kept a lot of customers if they offered some discounted Edu pricing, but they're either too greedy, or they want rid of the smaller organisations

Seems to be fine for me

Just checked ours and the last change date was 2006... jeez adding that to the job list

Fixed it, seemed to be a conflicting policy which was blocking the entire Microsoft store causing the error

Anyone else having any strange issues with Applocker on 24H2? Our exam laptops were all recently moved from Win 10 22H2 > Win 11 24H2 & we keep noticing that on start-up we get the error dialog box. We can close this dialog box & it does not appear again. Checking event viewer, nothing seems to be being blocked in any of the sections (exe, msi, script..) Our exam user accounts do also have the policy configured " Run only specified windows applications " which could be playing a part? But you would think this would present the different error dialog box

30 days is insane, get ready to see post it notes with passwords written on them Who did the audit?

We use Action1. They offer up to 200 endpoints free of charge, so you can trial this at no obligation

99% USB C here

I can remember being the same when I set ours up. It's actually super easy to get going with group policy

We use Senso for off site filtering, does the job

As above you can configure bitlocker with either GPO or Intune. We store our bitlocker keys in the AD Computer Object.

We run voip on a semi "flat" network. Only VLANS we have here are for : Guest Network Student Network IoT Network (Tills, Display TV's, Vending..) Never really had any issues at all with ours. All switches are managed, with minimum 1gbps uplinks between them

Out of principle i would not work with that supplier after that email!

I think the latest versions have dictation features, as ExamWritePad has a partnership with TextHelp. We run the Read&Write software alongside the free version of ExamWritePad & have zero issues.

24H2 Education English International here. We're still imaging with MDT & have had no issues rolling out 24H2.

Yea can quite easily stop a LOT of stuff working with AppLocker unintentionally lol.. be sure to do plenty of testing I think my default setup a few years ago actually broke the windows 11 start menu somehow