itskdog

OSDCloud would be my usual recommendation, but they seem to be undergoing a major overhaul and rebrand, so there's no updated documentation yet. That can be loaded as an image to your PXE server, or added to a USB stick to boot from. Alternatively there's the FFUBuilder tool on GitHub that can create a custom image for deployment.

With the KCSiE changes we tried to get the DSL to take it on, but as an AHT she has so many other responsibilities that it went back to us.

If you're using the built-in roll call function, I wonder if the two buildings are configured as separate areas. It could be they are appearing on the roll call for the kitchen building when they tap in there.

FYI, the DfE standards are recommending schools to get minimum 3 year hardware warranty for desktops & laptops now in their minimum requirements: https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges/laptops-desktops-and-tablets It's not one of the core standards we are supposed to meet by 2030, but it's the current recommendation, at least.

Sounds like a job for Autopilot (presuming hybrid environment given you're talking about both Intune and AD) or a Provisioning Package made with Windows Configuration Designer saved to the root of the USB's filesystem.

We're an HP school, tend to get good prices from SystemActive. If you're going HP, it's a good idea to make sure you're using a reseller in their Brighter Futures programme so you can get a rebate for sending in old devices (used to be up to 10 years old, now the max is 8 years, but they judge the age by the BIOS date, so you can sometimes update the BIOS to get the "age" of the device down). You get £50 back when you buy an i3/R3, £100 for i5/R5, £150 for i7/R7 or higher. Make sure to let the reseller know you're looking to use that programme so they can make sure you get a qualifying device. They can even submit the claim on your behalf.

Ah, AMD. The IT manager here is wary of buying AMD as he's had issues in past workplaces where software was only tested on Intel machines and had issues on AMD and they got caught out, and is willing to pay a little bit extra for the bigger name. G10 I think is only one generation ago (as they've reset back to G1 now along with Intel & AMD doing the same) That makes sense for the cheaper cost there.

A bit of a tangent, but what resellers are you using that £500 is high-end? For a 16GB i5 HP ProBook (typically a teacher's sole PC to save also having desktops in class which is extra expense) we're paying about £600 (plus extra for the 3 year warranty demanded in the DfE standards), though I suppose that does come with a £100 rebate if we have an older device to trade in within 60 days.

As long as the username in PaperCut shows up as the name of the job owner on the server (you can use aliases to set a second acceptable name if needed, such as the mailNickname in Entra for what's likely the AD username in a hybrid environment), it should automatically detect it and assign it to their account in print release if you're using SMB printing to the server (whether that's deployed through GPO or cloned queues in Print Deploy). It's only Mobility Print queues (whether generic ones with the PaperCut Global PostScript driver, or cloned ones with a custom driver) that require a sign-in. We didn't use Print Deploy at all on our previous system (just AD, no hybrid join), just deployed everything through GPO. If you're looking into moving to full cloud, then moving to the "Sign in with Microsoft" popup is the only solution I've seen. They don't support Entra SSO like Cloud Drive Mapper, but if you're using Microsoft Edge then it should be just the one click to install the printers the first time the user logs in.

Another vote for CDM. Microsoft themselves admit that the OneDrive client starts having issues when syncing more than 300k files (plus it will take long for the initial sync to complete when they log in to a PC for the first time), and they seem to be leaning more towards having users add just the folders they need as shortcuts through the web UI/Teams. We're only paying about £500pa for CDM in a large primary, the prices aren't too bad for schools, and I don't think the price has gone up that much in the 7 years we've been using it, either (been with them since late V1/early V2, now on V3)

AFAIK, ActivInspire Professional comes with the mainline ActivPanel IWBs (i.e. not LE, LX, etc.), but otherwise there is the free "Personal Edition" available. I'm unclear on if it can be purchased separately.

Our DPO, Judicium, have told us that any request for data should be treated as an SAR, there's no magic legalese that suddenly makes something an SAR. The ICO's own guidance also says the following: "An individual does not need to use a specific form of words, refer to legislation or direct the request to a specific contact."

If you're using Mobility Print queues, the user is required to authenticate - this button won't appear if you're using traditional SMB printer queues captured from a reference VM using the cloning tool. If you're on Entra/M365 for your computer logins, you could switch to PROMPT mode and you'll get a "Sign in with Microsoft" option to authenticate, which can then install the queues automatically. If you're on AD/GPO still, then deploying the queue over GPO would probably be the better solution than Print Deploy.

Yes - as long as it's marked as an over-18 account in the OU. Under 18s, even with parental consent, cannot create channels.

I may be wrong, but if I understand the documentation correctly, the former syncs Win32 apps, scripts, and anything else that's handled by IME, the latter syncs policies and LOB apps. The former can also be done via Company Portal, in the settings page there's a "Sync" button (can't 100% remember if that triggers both or just the IME sync).

I'm not involved in the decision making, PAT testing is considered a site team job, not an IT one, but we've used Office Test for many years. The hard part is getting the chargers for staff laptops & iPads tested, as it sounds like it seems to take quite a bit of work to get someone to come in for a couple of hours during term-time for those, when it was a regular thing in the past.

A phrase I often see on r/Intune on Reddit is "The S in Intune stands for speed". There's been a lot of things I've had to learn getting into Intune, mostly patience, and making sure to use a test group first. I've made a clone of our baseline policies and assigned it to my PC, and I always make changes there before changing on the main one that affects all devices.

Is it web-based? Could be a child who knows how to use the browser developer tools (Right-click -> Inspect Element)

We've usually just popped down to the local high street to one of the phone repair shops for our iPads. Only had one issue in the 5-6 times we've used them, and the one we've used most often has been happy to take payment via bank transfer, so no need to borrow the school credit card. Laptops are a bit more finicky to change the screens, but at least with HP, the service manuals are really detailed if you're getting business-class machines (ProBook or higher, but even 250s have good manuals, if harder to get the bottom cover off), and obtaining parts is easy, either through their parts store or an authorised reseller. Replacing a screen is usually just taking the bottom off, disconnecting the cables, and unscrewing the hinges from the bottom half before separating the two halves. If you're not getting the machines back, that's when I'd consider informing the office to hold off on paying the invoice while you're going through the complaints process - they don't pay until the item is delivered for physical goods when paid through a purchase order, why not for services as well? If this is a regular thing (which in your case it sounds like it is), I'd also consider if getting accidental damage cover when you purchase the devices, on top of the usual extended warranty (DfE standards say 3 year warranties for PCs, 2 years for tablets), then the OEM can repair, potentially even on-site if you get the right cover.

We're in a similar boat to you @Simcfc73, but we're planning to keep Net2 on the same PC it's currently on as it's not too much maintenance, and we leave any maintenance to our 6-monthly maintenance visits from our installer. Will need to either move the PC to Windows 11 or put Net2 on its own VLAN, but we've still got a couple of years to go on the ESUs there. The main changes we need to make are moving to PaperCut Hive or directprint.io (a quote we've received on what is apparently framework pricing looks like it might work out more expensive for a Ricoh machine that's half the speed of our current 120ppm RISOs, so we might end up having to go to with directprint for the cost & speed factor, or keep paying for Windows server to use PaperCut MF due to the 20 connection limit on a client machine), and migrating away from Impero EdPro (though with the nightmare stories I've heard about Senso on here, I'm a little hesitant, but we'd be more likely to go with them as we're an LGfL school and already get the safeguarding part free)

I've got a Pixel Watch 3, and the ability to use the mic & speaker on the watch for phone calls comes in handy to be able to communicate with others on the team, while not violating the safeguarding policy by having my mobile phone out of my pocket with children in the vicinity. Not the most comfortable position to be in when doing so, but it works in a pinch. Plus getting notifications from the helpdesk without having to grab my phone to see what it is, in case it's something urgent I need to deal with, or to save going back to my office, then seeing it, then going back out to see the person who needs help.

It's best to distribute all apps, even single-file MSIs, as Win32 if you're using Autopilot V1 as they could end up trying to install at the same time, and failing during ESP. If you don't want to convert them, then change the blocking apps in the ESP to only the essential apps (antivirus, monitoring, etc.) and let other apps install after enrolment completes (just leave it on the login page for an hour or two) - see how I have it set below. The blocking apps should all be Win32 apps (.intunewin packages) to avoid conflicts - if you want to deploy Office during ESP, package it as a Win32 app with a configuration.xml, rather than the M365 Apps app type.

Was this info from your reseller? I would be surprised if you couldn't purchase a handful of MAKs for Windows 10/11 Education. Ideally you should be purchasing devices that have either Pro or Pro Education installed if you're using A3/A5 to step-up the licence to either Enterprise or Education.

As far as I can tell it manages a slow rollout for you by automatically creating rings with devices in it at percentages you specify (probably sensible to use a dynamic group to include all computers), plus a Test group that gets the update first (e.g. for IT) and a Last group that gets the update last (e.g. for a PC being used as a Net2/Impero server). We don't have a huge number of devices here being a primary school, and most people don't restart until they're forced to anyway, so I don't personally see much use for us and have left us with the two Update Rings that RM deployed for us (Early Adopters get a 60 day deferral for Feature Updates compared to 120 days for everyone else), but for secondaries with multiple ICT suites, laptop trolleys, etc. I could definitely see a use case, so if there's a bad update there are less machines to have to roll back manually in WinRE by the time you pause the rollout.

Are you mixing app types (Win32/LOB), or have Office set as a blocking app in the ESP? Using the M365 Apps app type rather than packaging it as a Win32 app can cause issues during ESP. Also, the Get-AutopilotDiagnosticsCommunity script should be able to tell you step-by-step what happened in the Autopilot/ESP process and what went wrong.