itskdog

For our ProBooks, BIOS Updates have been coming through via Windows Update without issue, only our cheaper HP 250 laptops haven't been getting those as while they come with Windows Pro, they have the consumer BIOS from Insyde rather than HP's in-house "commercial" BIOS. I still remember when the conventional wisdom was "Only install BIOS updates if you're having an issue that the update might resolve".

Usually I find that driver updates continue to come out through Windows Update even after the OEM stops publishing them on their own website, and of course Windows Updates are independent of the hardware itself, devices we bought in 2019 are supported for Windows 11 (albeit starting to show their age in terms of slowdowns, so we're planning on retiring them once we've retired our Windows 10 devices that we've put ESUs on)

In "When to meet the standard" it only says when purchasing new devices (other than the OS requirement which should be in place already), and it doesn't say you have to throw them out as soon as the warranty expires, just that when you purchase them they should have 5 years of manufacturer support left (which I would assume means 14th Gen/Series 2 Intels or whatever the new AMD equivalents are now they've both reset their numbering schemes, not the 12th Gens being quoted earlier in this thread, as any PCs being sold with those must already be a few years old by now)

At least means you've got another contact for your three quotes, I suppose. Buying PCs will usually get you over the threshold for requiring multiple quotes.

Just opened a new browser profile in Chrome and went to "earth.google.com" and it just took me straight into the app, no sign-in prompt here.

Yeah, my understanding is there's certain security features such as TPM2.0 along with fixes for hardware vulnerabilities such as Meltdown & Spectre. I also doubt that devices of that age will be getting the necessary UEFI updates from the OEM to support the updates for the 2023 Secure Boot certificates, lowering the security profile of the device once the 2011 certificates expire in a few months.

Of course as soon as I post this I find this little tidbit hiding away in the User Client page (but not in the "things to consider when using UPNs" page). For permanent reference for anyone who finds this on a web search, the fix is to go to Options -> Config Editor, then search for client.config.upn-search-enabled, and change it from N to Y.

Hi all, We're using Riso MFDs, and so are stuck with PaperCut MF (as they only support the "Lite" version of Hive, so we wouldn't be able to monitor copying, and the print quota system on Coreza Print doesn't support manual admin topups). For the last year since moving to Entra+Intune (syncing with the Standard Entra ID method, rather than paying out for an Entra ID DS), we've been working without the user client, and people are checking their balance on the MFD or the web UI. I am starting to investigate once again how to roll out the user client. PaperCut have instructions on how to install it with Intune, but they don't explain any way of getting it to do username matching correctly with Entra-joined machines. At present, it prompts for a username and password because Entra creates the local profile's username based on the Display Name (but without spaces, e.g. if the display name is "John A Smith", it uses "JohnASmith"), so it tries to automatically log in with that and of course fails as the user doesn't exist. Aliases would help (if they could be configured to remove the spaces), but we use RM Unify for account creation/deletion (which names staff accounts as "Mr J Smith") and we have two staff with the same first initial and surname, which would probably make a different local username and presumably cause conflicts when matching the username. Has anyone had success rolling out the PaperCut User Client to Entra-joined machines? Either there's no documentation out there or my Google-fu isn't working on this particular issue. I would hope there was a way it could be configured to check the UPN instead of the local profile's name, e.g. the output of "whoami /UPN" (which would give "[email protected]", which will match the UPN in PaperCut) instead of just "whoami" (which would give "azuread\johnasmith")

This was just plain Intune with their baseline policies, no CC5.

I can't find a policy to necessarily hide items from the menu, but you can disable the functionality inside them, e.g. disabling the password manager entirely (though not recommended) with PasswordManagerEnabled or blocking CSV exports with PasswordExportEnabled. You can block deleting browsing and download history through the Delete browsing data page, but can't block deleting cache and cookies. The policy there is AllowDeletingBrowserHistory. You can block installing extensions by setting ExtensionInstallBlocklist to * (and then allow them through the separate Allowlist policy) It seems you can block internal URLs such as edge://settings via URLBlocklist, but they recommend against it as it can "lead to unexpected errors". There are quite a number of options inside "More Tools", I don't have the time to go through every single menu item and see if there's a policy for them or not, but certainly the major ones such as the developer tools can be blocked with DeveloperToolsAvailability, and installing PWAs can be blocked with WebAppInstallByUserEnabled.

Isn't 2019 EOL now? I'm pretty sure LTSC 2021 had it, if you still need Publisher and have Office through volume licencing such as OVS-ES.

Generally I'd advise against doing the tweaks at work. On a personal device, sure. But on the fleet you're managing at your school I'd advise against it, you're just asking for trouble. The 2028 I gave was for the ESUs on Windows 10 that you get from your licencing provider. Bypassing to Windows 11 was always going to be using hacky workarounds, and as I mentioned (though given the layout of your responses I'm assuming you're not even reading what we're saying with a critical eye and just passing everything we say to an LLM to answer for you), my understanding is that you'd have to re-do the bypass for every feature update anyway. The issue you probably ran into is that 24H2 Home, Pro, and Pro Education reach end of support in October, so you'll need to be on 25H2 by then if your licencing doesn't give you Enterprise or Education editions which get an extra 12 months. (Source, good page to keep in your bookmarks for this stuff: Windows 11 - release information)

Haven't seen issues with embedding YouTube videos for years, assuming you're using the latest Office LTSC or M365 Apps for Business. Just paste the video link (not the embed link that the article above says) into Insert -> Video -> Online Video and it will create the embed automatically for you.

If you're using unsupported hardware on Windows 11 (i.e. anything before Intel 8th Gen or Ryzen 2nd Gen) then MS have always said that updates could stop at any time, and Feature Updates have always required you to bypass again each year. It's nothing to do with the grade of CPU. If MS were stopping support for i3s and Celeron/Pentium/Processor then we'd all know and it would be in the tech news, and I doubt MS want to give that market segment away to Apple (with the new Macbook Neo) and Google.

Probably. Just as I'm sure you tell the teachers and the teachers tell the students, never trust an LLM, always check the sources to make sure it backs it up. LLMs are less reliable than Wikipedia. It's probably mixing up consumer ESUs or the free EU ESUs with commercial ESUs, which are configured entirely differently. My source for all ESU info is Microsoft themselves, who say nothing about this: Extended Security Updates (ESU) program for Windows 10 | Microsoft Learn

I'd still like a source for this - AFAIK, Windows 10 ESUs are available for 3 years for all hardware supported by Windows 10. Only individuals got ESUs for 1 year, everyone else can purchase up to 3 years, with schools getting a heavy discount.

Don't have experience with anyone else, but we're with XMA and I can recommend against them. Since I've started handling IT orders with the IT manager taking on other responsibilities, I've always had trouble with them renewing our OVS-ES and getting our Windows 10 ESUs. On top of general slow response times and not having an auto-reply or bounce-back when an account manager leaves the company, I recall they once assigned the licences to the office shared mailbox because that's the email address on the purchase order form (as they place all orders) rather than to myself or the IT Manager, after initially not actually adding any licences to the contract, and Microsoft automatically terminated the agreement we'd just signed as a result of it being untouched. We've moved to A3 as part of an RM project (so bought our first batch of licences from them), so at our next renewal we might shop around for the best deals - will save this thread to come back to later.

classroom.cloud is NetSupport's cloud offering. Sadly it's all "Request a quote" and not public pricing like Senso.

I normally use: GPRESULT /H gpresult.html and open the file to see what policies are applied to that system. Can also be done remotely from GPMC, but we've moved to Intune now so I can't recall the exact naming of it any more.

We use LGfL/Wavenet for VoIP (Cisco UC phones) and can broadcast over our phones for an extra fee. No need to run new network cables. We didn't go through with it in the end, but the quote was less than £1 per phone per month (added to the quarterly bill). For schools that don't already have a tannoy system and are looking for a cheap option and have phones in every classroom already, might be worth checking if your existing VoIP system can be configured to do broadcast on speaker to all phones by just dialling a specific extension, especially if you only have a single network port in the ceiling for the AP, rather than a double socket to plug in a PoE speaker as well.

If you're still on OSDCloud v1 (which you are by the looks of things), then there's a dedicated New-OSDCloudUSB cmdlet that worked for me. Apparently the new v2 (with the Recast branding) is getting a way to easily deploy a WinPE with it installed, but it's not available yet.

Given ASM is a rebranded ABM with some settings tweaked (e.g. 200GB instead of 5GB per user in iCloud, and MIS imports), the assumption is that ASM will at some point move to the same feature set as the new AB, where they combined ABM and ABE into the same product.

Our M365 was provisioned by RM, so they added a bunch of swear filters in the mail flow rules. As we're a primary, we don't give students email access anyway, so haven't had to look too closely at that myself.

If you don't have a third-party password manager, the browser password manager is better than nothing. Especially if you have syncing forced on, most browsers these days prompt to use a randomly-generated password when they see a password creation prompt. Making people type in passwords encourages password reuse, which is the opposite of what you're wanting.

If anything, I've noticed it finally starting to keep the actual spam from recruitment agencies in the Junk folder rather than going to the inbox. We have our BCL set to the default 6 for most people but moved down to 5 for email addresses listed on our website, plus anyone else who has reported a lot of spam before. Maybe you increased the agressiveness before to keep the spam out and they've made tweaks that balanced things more?