mbedford

I second this, re-image. In place upgrade just causes more trouble than its worth. Also have to contend with the Windows.old folder residing on your HDD's until Windows decides it can go. If you have a WDS server in place then this shouldn't be a huge issue. We have 2500+ machines here and my team of 5 of us could do the entire estate in a week to 10 days if we had to rush it. Biggest slow down is the prep on the reference image IMO. I am just finalising our 1607 image to move us away from 1511. I know 1703 but I just find it a little more prudent to sit just behind the bleeding edge rather than on it. Microsoft is not having a good time with updates recently... Patch Tuesday: Security Update for Group Policy Breaks Group Policy | Patch Tuesday content from Windows IT Pro Patch Tuesday Windows security update rendered Outlook unusable for many | PCWorld Granted, the WannaCry attack of last week is more than enough reason to stay on top of security updates. But actual operating system upgrades, I think we can afford to be a little more cautious. Mike

Ah, i did not realise that. Thank you I will take a look. I dont generally have anything of huge privacy concern in our scripts either, but they are thousands of lines long and if I were go through them with a fine toothpick, im sure I would find something I wasn't happy been public :-) Thanks Mike

Good idea's however, I am concerned about maintaining the current folder structure and leaving the source files in there original location. If I change the "logon.script" (yeah thats made up!) i would like to be able to publish\checkout that change directly to the original location which is within \\domain\netlogon\folder\folder...... Sharepoint would use its own storage location and Git, well i dont know it very well, but given the sensitive nature of the scripts, is hosting them on Git a good idea?? im not criticising, that's a genuine question? Mike

Hi, Does anyone use any form of version control on your Windows startup\shutdown\logon\logoff scripts? We have a fair number of scripts in place and at the moment the management of those files is left to me actually telling my team that I have changed something. Would be nice to have something like Team Foundation Server in place for these but I'm not sure that application is the right place to go. Any idea's or suggestions? Mike

Phones we don't have much demand for. The student machines are not part of this GPO and that is were the majority of phone storage usage comes from. We offer access to all of the major cloud storage providers though (Google\Microsoft\Dropbox....) so the demand for any USB storage is decreasing year on year. In regards to camera's, I dont think I was clear in my initial response. We prevent writing to non encrypted devices, read still works just fine. Mike

Another vote for WDS with MDT. I will also +1 for the use of a virtual machine for the base image. Makes the image update process each year to catch up on Windows Updates and other product updates so much easier. Looked at implementing SCCM's management of this but the added value did not justify the work to setup and maintain SCCM. As a side note, SCCM seems to lose in that argument for most of its features IMO, we use it for deployment of End Point Protection and that is because it was a requirement of that solution. I think SCCM demands too much time in setup and maintenance to be useful in any company which doesn't have the staff to be able to dedicate a member of staff to it. Mike

We use a GPO to only allow USB drives (including mass storage on phones) to have write access if they are encrypted with BitLocker. Would that be secure enough for you? It sounds like you are currently just allowing\disallowing based on a list of allowed devices/users. This would give you a similar solution but would require that the data that is transferred onto said device is also encrypted which given the amount of articles you read nowadays of people finding DVD\USB\Laptops on trains, cant be a bad thing. I'm reasonably sure the same GPO could be configured to entirely ban USB drives encrypted or not, but that falls a little too far in to the security side of the security VS usability equation for me. Mike

Try this... Safe Harbour and cloud based services in education - DfE advice - NEN Mike

We use a custom made executable along with Task Scheduler and a VBS script to add\edit the task as required. 2130hrs - Sleep 2300hrs - Wake and perform Windows Update install 2330hrs - Reboot and perform Windows update install and reboot again 0030hrs - Sleep 0630hrs - Wake and reboot 0700hrs - Ready for use This runs every weekday on over 2000 machines. Works great.

Steve are you using the updated version of MDT, released since Windows 10 was generally released? If not, I would suggest downloading and using that. If you are using the MDT 2013 release prior to Windows 10, there is a workaround which we have successfully implemented to capture and deploy Windows 10. West Monroe Partners Blog » Deploy Windows 10, Windows Server 2016, and Hyper-V Server 2016 Technical Preview Using MDT 2013 It looks more daunting that it actually is. Mike

Hi, My director and assistant principal has asked me to arrange for suppliers to visit our College and demonstrate mobile devices to a large selection of staff from both our institution and others in the wider area. I am looking for anyone who can provide both mobile devices and displays (Clevertouch, Promethean etc...) and time to demonstrate them in a exhibition style event. If any suppliers are interested, please send me a PM and i will provide further contact details. Kind regards, Mike Bedford Walsall College

Hi John, Sounds like you have covered most of the basics. As far as VM's are going i think that replication may be a bit of overkill. All of the services you have mentioned already have some kind of replication built in DC's - Obvious, just create a multi server setup with at least 2 DC's (one on each host clearly) DNS and DHCP - These can both sit on the DC's, very simple to get these into a farm based setup File Server(s) - Id have two servers and look into DFS Replication and Namespace hosting (both Windows services) Print Server - Windows Print Management or some kind of follow me printing service? WDS - You could replicate this, but personally i see it as a non critical service which replication is just wasting space. However if you have the capacity, go for it. Im not against 2012 Hyper-V replication, I use it myself, but I just think using the built in resiliency of these services will give you a better solution, most of them have automatic failover, where as replication will require a manual failover (i have tried automatic failover, its not pretty!) Mike

Hi Gaz, We have implemented both here. I would go for RDP using terminal services. We have a farm of 8 servers which both staff and students can RDP into from home. Works great and is very heavily utilized. Direct Access is a nice solution, but RDP is just easier to setup and maintain IMO. Mike

Use this function function removeExtra ($table) { foreach ($field in $table) { $number = $field.clientip.indexof("ip=") $number = $number + 3 $field.clientip = $field.clientip.substring($number) $results += $field } return $results } usage Place this at the start of your script $results = @() Then use the function like this removeExtra $CDAmaps Your results should be in $results Thanks Mike

I would love to be able to give you some details on the issues I was experiencing. But unfortunately there in lies the problem. It would just fail, seemingly randomly with non nonsensical error messages like "Stopped-Server-Down" which on contacting MS Support, could mean one of a hundred different things. Its like the team developing it just did one huge try\catch exception block in the code and "Stopped-Server-Down" was the result. I would spend hours setting it up and it would work great for a week or a month and then for no reason, broken. MS Support solution every time, re install Windows Azure Active Directory and Reconfigure DirSync from scratch. It was just an accident waiting to happen, I felt like the whole process required far too much hand holding and I was never confident that it was working as it was supposed to. I ended up not been 100% (or anywhere near that) certain about which accounts had been provisioned offsite, who had correct details etc.... With 30000+ student accounts (including alumni) I couldn't manually reconcile all of the accounts from the web interface. So in the end I just bit the bullet. Worked out how to convert an active directory user account GUID to an immutable ID (the actual ID that Office 365 uses to match users, why it cant use any of the other already in place unique ID's is beyond me but there we go) and just got PowerShell to run through every account that was made in the last 7 days every evening. Yes this means that I am probably checking 100+ accounts over and over again until 7 days pass just to get the 2 or 3 new ones, but I am 100% certain that the accounts are provisioned. Two benefits from this for me really. 1. I know exactly how the system works, its targeted based on what I have written in the PowerShell script. 2. I can write everything to a log file, so its far easier to see what has gone wrong and at least have an idea of where to go to fix it. Rather than "Stopped-Server-Down"

I re-read "steak" before I posted and said to myself, "yeah, that right!" DUH!!

Hi, Can you not setup VLAN's on your physical network to remove the need to have an actual separate network ? If not, i would configure the static routing in Windows to point the traffic destined for network1 to use NIC1 as its gateway, and network2 - NIC2. Hope this helps Mike

Do your standard users have admin rights on there College equipment? Surely they cant install Office from a standard user account? Mike

I am probably going to get burned at the steak for saying this. But have you considered not deploying Java. We stopped doing so on our machines (2500 machines across three sites) two years ago and honestly haven't looked back. We have had a couple (less than 20) machines where specific software installs have dictated that we need Java but that't it. It used to be so widely used that you had to push it out a few years back, but i think Java's best days are behind it now Chrome to Drop Support for NPAPI Plugins Including Java, Silverlight, and Unity

Seems strange that you can't WDS boot them... oh well. You can change the default OU that machines go into on creation here; Easily Change the Default OU in Active Directory — PC-Addicts Joining the domain automatically will be a little more difficult. Could you put a PowerShell script into the start up folder for the machine inside your USB image? This script would basically do the following; ***Pseudo code warning*** Check for a non-existant (C:\Windows\BOOT1.TXT) file which will tell you if the machine has or has not been rebooted, you could increment this check up to whatever number you want to control after how many reboots you want this to happen, just get your script to rename the file at each reboot ($number = $number++ $filename = $filename + $number +".txt") Once the desired number of reboots has been achieved, implement the following commands Rename computer and join to domain in one step with PowerShell - Stack Overflow At the end, create another file called something like "C:\Windows\DomainJoined.txt" and put a check for that at the start of your script to prevent duplication of the event. Obviously this would be simpler if you could just use WDS to push out an image and you could join the domain as part of your task sequence then, but with that not been option this seems like a simply enough alternative. Hope this helps. Mike

I set up two Office 365 solutions (staff and student) with ADFS on Server 2012R2 in under a day, It's easy. DirSync was terrible, knock it on the head and use a combination of PowerShell and task scheduler to compare your onprem AD to Office365 each night and create the missing accounts. Can also apply licences at the same time. Let ADFS worry about the authentication and voilla you are done. Check out this guide for ADFS installation How To Install ADFS 2012 R2 For Office 365 - 250 Hello - Site Home - TechNet Blogs For redundancy, what environment are you in?? are your servers virtual or physical. Personally i would use Hyper-V and if the hardware was available replicate the ADFS server across two hosts. Obviously this depends on if you have the hardware available, but for mission critical servers (DC's, ADFS, VLE....) its gotta be worth it for the piece of mind alone, if the hardware falls over, click go on the replica and you are back up with minimal downtime. YOu could even setup automatic replication and failover but that can be a little too sensitive to network issues and you may find that you are spending more time chasing your VM's from one host to the other as they have failed over for no reason. But on the other hand, if both hosts are equal, then whats the harm as long as the VM's are running somewhere. If you need any help, give me a shout. Mike

Thank you.

Hi, We already have an ADFS solution in place for other software separate to Office 365 (Google Apps) which is working well. Now I am comfortable with the DirSync setup for Office 365 to get my accounts created on the Azure side of the equation, however, how do I configure my current ADFS install to allow it to work with the https://portal.microsoftonline.com login page? All the instructions that I can find on this matter seem to point to a new install for people who don't already have ADFS in place and working for another solution. I am reluctant to follow that guide and just pull out what I think are the relevant bits of information as that may break my current solution. Any advice?? Mike

Just replied :-)

Thanks for all the suggestions, managed to resolve it myself. Turns out that you cant apply a quota to a folder beneath one that already has one applied. This behaviour makes sense but I more descriptive error message may have helped! Thanks Mike