MrLudwig

Ah sorry, wrong terminology. Not the placeholders, I mean the Automated Device Enrollment entries. Although I think they may start out as placeholders when imported initially. Either way, editing the iPad's entry here rather than in the Inventory does the trick. Think I need a lie down now.

Haha, found it! It isn't related to return to service. Further testing shows it also happens when I erase the iPad via Jamf without using return to service, and when initiating the erase directly on the iPad itself. In both cases, when the iPad is back online and checks into Jamf, the group memberships revert to the previous set even though I'd removed the iPad from those groups prior to the erase. It turns out it's down to the placeholders for the iPads. These retain the original groups specified when the placeholders were set up (via a csv import). So when the iPads are erased and reconnect, the placeholder comes back into play and thus the iPad is put back into the groups set on that. Thinking about it, it does make perfect sense now. Many thanks.

Yep, that too.

These are all Static groups.

Hello, In Jamf School when I have iPads to repurpose/redeploy for different users etc I'll remove the device from groups it should no longer be in (for apps/settings), then use the erase command (ideally with the Return to service feature). However, the vast majority of the time, when the device reconnects to Jamf to check-in after the erase, existing group memberships (ones I wanted to keep) are either forgotten completely, or revert back to the previous memberships (ones I'd removed prior to erase). For example, I take an iPad that has been used as a student device and want to repurpose it as a staff device. I'll remove the iPad from our Student Apps & settings groups (and usually nudge it to hurry up the deferred deletion of apps that Jamf likes to do). I'll then tell Jamf to erase the device with return to service to get it back on our network automatically, and thus back talking to Jamf. However what tends to happen is once the iPad checks in, all the group memberships are either forgotten, or it reverts back to being in the student apps/settings groups and so starts deploying all the apps/settings linked to those groups. It isn't specific to any groups; I've tried it with several different ones. I've also tried waiting hours/days between changing the group memberships and issuing the erase command; thinking maybe Jamf needed time to sync the change at the backend somehow. But it doesn't make any difference. Any ideas why this is happening or how I can avoid it would be very helpful. Many thanks.

We’ve used KRCS for several years now. They are consistently best on price, and are an Apple specialist so know the ins & outs of things like ADE, Classroom etc. As a bonus, they’ve never cold-called us either wondering if we have anything in the works they can help with.

Hi Brimstone, Yes to all of those - The iPads are brand new devices and are enrolled in ADE. The apps are all volume purchased through Apple School Manager and the licenses are showing against the device in Jamf (under Content Licenses). The device owner has no licenses listed against their account. The setting to "Remove app when profile is removed" is ticked for each of the apps. Dan

Hello, We are in the process of moving MDM from LightSpeed to Jamf School. For the most part, Jamf has been a far better experience, but I'm still finding my way around to some degree. This year all new iPads have been assigned to Jamf via Apple School Manager and we have transferred sufficient app licenses away from LightSpeed to Jamf to cover these. All this has worked without a problem. I've set up Device Groups for our staff and students and deployed apps to those groups. I can add devices to the appropriate groups and they get the apps installed. The apps all show up under Managed Apps on that device in Jamf. So far so good. However if I remove a device from the group, only a few of the apps are then marked for removal from the device, and none of the licenses are revoked. There is no way I can see to remove an app or license other than by removing the device from the group, except it doesn't seem to be doing this for the majority of the apps installed. I've checked that the licenses are being assigned to the device and not the user, and gone as far as erasing a device completely, after which Jamf shows all the apps have now gone, but still has all the licenses assigned to that device. I'm a bit puzzled, unsure if I'm missing something here because I'm new to Jamf, or something isn't working as it is supposed to. Some of the apps we use are paid-for and we only have a limited number of licenses, so at some point the need to revoke them from devices is going to become a real problem if we can't find a way to do this. Any help would very much appreciated. Best regards, Dan

I’ve done this from 2016 to 2019 using a guide I found on PeteNetLve. I’m pretty sure it said the same procedure should work back to 2008R2. I’ll try and find the link to the PeteNetLive article when I’m back at my PC, but it’s probably searchable. If memory serves, it’s basically backup the AD CS config using the built in backup option in the AD CS management MMC, export the certsvr regkey (something like HKLM System CurrentControlSet Services CertSvr). Modify the server name value in the .reg file to the name of the new CS server. Remove the role from the old server. Add the AD CS role to the new server, and restore from the backup. Stop the service, merge the .reg file and restart the service. As I say this worked for me going from 2016 to 2019 and I’m pretty sure the article said it should be much the same process for 2008R2 as well. I did this recently and haven’t seen any problems so far. It all seems to have worked.

MS have a nice page detailing how to do this via the Start Menu XML layout file thimon mentioned above here https://docs.microsoft.com/en-us/windows/configuration/configure-windows-10-taskbar. It works pretty well and there is an option to replace the default pinned icons or add to them.

As I understand it, you get one level of folders but that’s it. So for example if you created folders in C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Applications\Microsoft Office, any shortcuts in there or any other folders at that level or deeper would all appear listed together on the Start Menu in the Applications folder. You won’t see the Microsoft Office folder, but you would see any shortcuts it contains. The same applies to a redirected Start Menu. Also if a first level folder is empty, it won’t appear. Not sure what the Microsoft UI designers were smoking when they decided this was a good idea, but whatever it was, they should probably avoid it in future.

I did this on a Server 2016 domain at my last school without a problem. Only had 3 DC's so didn’t take very long. From what I remember it’s a fairly straightforward process.

Might be worth checking where it actually installed. I seem to remember Scratch v3 installed into the user profile for us, rather than somewhere that actually made sense like program files. Having said that, I think you can just move the folder onto a network share and run it directly from their.

Sorry Arcath, I can’t remember the specific file, plus I no longer work at the same school so don’t have access to the computer this was happening on to check.

Yeah ours still tries to do the dialout if it can't see the Meter Connect software via USB to a laptop, which is how I've been doing things up to now. Not sure sure what did it in the end but I have now got it to work again. I ended up using an old laptop that hasn't been turned on since August and so no Windows Updates since then. Also swapped the USB lead just in case. Plugged the Meter in and it detected it and connected back to PB first time. Will try again with the original laptop & USB the next time it needs an update/funds added and see how it goes. Then swap out one thing at a time to see what makes a difference. Thanks for the info and suggestions guys, much appreciated.

Thanks for the info robyholmes. Yeah I tried it through a non-filtered connection to rule out the firewall/filter blocking something, but it is something I would like to get working through our main connection eventually anyway so the domains you mentioned will be helpful in future. I had been using a mobile hotspot for the odd occasions we needed to top-up and upload data, but this has also been failing since last week. Do you use the PC Meter Connect software to update your Franking machine or is it connected directly into your network?

Hi, Is anyone else having trouble with PC Meter Connect software being unable to connect to the PB services? We have been having this issue since last week - the software does a "check for internet" which passes, then fails when "connecting to PB Services". We now have almost zero funds on our Franking machine but without the PCMC software, have no way to top it up. I know there are issues with this going through firewalls/filters etc, but I've tried it over a mobile hotspot and from my home connection to rule out our school firewall/filter; get the same result each time.

Thanks chaplic, Feeling less paranoid now; our emails are still fine so pretty sure this was indeed something at the recipient end. A restricted account or distribution list would seem logical explanation too. Thanks again.

Hi, One of our staff users has received three email NDR's today when sending to three different external addresses. Normally I wouldn't think much of this, two or them were simple RecipientNotFound errors from the servers at the other end suggesting the email address is either wrong or no longer exists. The third was not one I'd seen before - Remote Server returned '550 5.4.1 [[email protected]]: Recipient address rejected: Access denied. I've had a good look around the Interweb and most of the bits I found seem to suggest this might be a problem related to issues between an on-prem Exchange server and Exchange Online. This would be at the recipient end so nothing to do with us. However, I am a little bit paranoid at the moment as I'm in the process of an Exchange 2010 to 2016 migration here, so anything email related has me on edge, so to speak. Our migration seems fine and there doesn't appear to be any other problems, emails are flowing in and out and between 2010 and 2016 OK, so I'm almost sure this is a problem at the recipient end, but there is this little nagging voice of doubt in my head that isn't convinced just yet. Also, I will be looking at a move to a hybrid Office365 set up at some point in the future so any info that would help me avoid this same problem in future would be helpful too. Thanks

Just giving this one a bump as it doesn't have long left before the closing date. It is a really nice school to work at with a great bunch on staff, this includes a lot of the teachers .

The folders haven’t been renamed, it’s the desktop.ini file within each home folder that Explorer reads and presents the folder as Documents. The folder is still called the same and can be accessed using that name in paths. If you delete the desktop.ini file and refresh the view it will show it’s real name. The desktop.ini file will be recreated the next time the user logs in though. You could get around this Windows behaviour by creating a Documents folder within the named user folder and set that as the home folder. I do this for staff users and redirect their desktop, downloads and favourites folders there. Pictures, Music and Video folders are set to follow the Home folder. We use roaming profiles for staff so redirecting all these folders means the contents doesn’t get shunted around at each logon/logoff. With advanced folder redirection you can specify different paths based on group memberships, so you should be able to use the same GPO for each year group.

Ours can take a few hours to churn through rather than days. But oddly the bit that takes the time is the printing. Generating the reports seems to go through OK, but it seems to take minutes to send each one to print. This doesn’t happen for anything else being printed, just the student reports from within Sims.

The setup file contains the base .msi plus an .msp which patches the .msi to the latest version during the installation. The Adobe installer supports switches to extract the contents of the setup file. I then do an admin install integrating the patch which creates an up to date installation point. I then deploy this via Group Policy with an .mst transform file to customise some settings - turn off Java support, just as a security measure.

We still have a bungalow on site for our Site Manager. No LAN connection but it is just within WiFi range. He has his own Virgin connection however. He does have an alarm panel linked to the rest of the school so he can monitor and arm/disarm the alarms. We did have a plan to run in a LAN connection to enable access to CCTV. In the event of the alarms being triggered, he could view the CCTV first rather than just going in to investigate. The thinking being this would reduce potential risk to him in the event of a break in.

We set Deny permissions on a DLL component of the Office spell checker for our Exam user group. This seems to work pretty well. Disables the manual spell check, the red underlining and suggestions. If they try and run a spell check via the Ribbon or F7, they get the standard "Spelling and grammar check is complete", but no checks are actually performed. The DLL files are: Office 2010 - %ProgramFiles%\Microsoft Office\Office14\PROOF\MSSP7EN.DLL Office 2016 - %ProgramFiles%\Microsoft Office\Office16\PROOF\msspell7.dll Haven't tried this in Office 2013 or Office 2019, but I'd imagine it will work the same, although the specific dll may have changed, and the path of course. We set the deny permission on this file via GPO. This doesn't disable the "Replace as you type" autocorrect feature, but the standard MS Office GPO Templates and Disable UI controls mentioned above can mop up these little bits.