Blue_Cookeh

I'd look into a UTM solution like Sophos XG or Palo Alto to do your routing/firewalling/filtering in school personally. We run Sophos XG appliances in our primaries.

Microsoft are slowly abandoning mandatory profiles, they've said this specifically in the last year. I setup a "Default User.v6" profile on our NETLOGON share which is used as the basis for any user logging into our network now, I then use the Group Policy setting 'Don't save settings at exit' and various others to lock kids' accounts down significantly. This has the added advantage that there is no "first sign in" actions, everyone gets the same profile, and they're kept local so none of the problems we had with "Waiting for the user profile service" when a user first logs in with a large profile exist anymore. My next step is to use UE-V to store stuff like Chrome data outside of the profile.

I've deployed it to around half our staff now and it's been highly successful. I redirect Desktop, Documents, Photos, Music, Videos to subfolders of their OneDrive folder. Make sure you download the OneDrive group policies and use these to control OneDrive behavior. You'll probably be most interested in locking down the ability to move the OneDrive folder (we force it to be in c:\Users\%username%\OneDrive - School\ and disallow adding personal OneDrive folders). This is a good basic start. Make sure to use the EnableADAL registry edits if you wish to enable OneDrive SSO with Office365. We haven't done a fully automatic migration, I'm going around and redeploying staff laptops one by one, updating them to 1709 via SCCM and then migrating their user account to a new one that's OneDrive enabled. I usually mount their old user home drive, use a PowerShell script to go through it and check for invalid characters (OneDrive doesn't like files with things like # in the name), and then just move them into the OneDrive redirected files. Sync times aren't bad, I had a member of staff the other day who had about 50GB worth of stuff that was migrated into OneDrive just fine overnight. The only niggle I've had is that OneDrive needs to update and set it self up on first login, then the user must login a second time to enable folder redirection - but this only happens the first time they use a machine so not a huge deal, I just deployed an icon to the desktop that takes them straight into the OneDrive web ui as a fallback. This is why I have not deployed it to children's accounts yet.

Yeah doesn't seem to be the problem unfortunately. The apps still run, the names and icons are just not showing up

Hi Guys, Just doing a cleanup of some of our devices and trying to get the initial logon time down. I've started using a Default User.v6 profile on our NETLOGON share with a modified Start Menu using LayoutModification.xml but I'm seeing a problem where some modern apps aren't showing up properly: Those three icons are supposed to be Paint3D, Calculator, and Camera. I deployed our SCCM Task Sequence to a Hyper-V VM and used a clean user account that mimics a pupil account to export the start menu XML, on the same build of Windows 10 so not really sure what I'm doing wrong here. On the plus side, a locally locked down profile with main folders redirected to OneDrive (using Files on Demand) has gotten logon times down to about 20 seconds! Any pointers?

MBAM is still worth deploying IMO since it provides extra policies and the potential for you to delegate key recovery.

I think they mean the ability to force file on demand only on some machines - right now you can change the default behavior but not stop users doing one or the other. OTOH we solved this by setting a GPO to clear unused profiles every 30 days.

This isn't necessarily a bad thing. Extra SSIDs significantly impact performance. Meraki document this pretty well: https://documentation.meraki.com/MR/WiFi_Basics_and_Best_Practices/Multi-SSID_Deployment_Considerations You could look at using RADIUS VLAN tagging to keep devices on one SSID, but in their correct network.

There are entire school districts in the US that have deployed UniFi https://www.ubnt.com/casestudies/ We're now ripping out our old original UniFi access points... and replacing them with the AC Lite models

We have our's configered as: DC1 - 10.0.0.1 DC2 - 10.0.0.2 DC1 Settings: Preferred 10.0.0.2 Secondary 127.0.0.1 DC2 Settings: Preferred 10.0.0.1 Secondary 127.0.0.1 Seems to be what the big boys do.

We get our Lenovo laptops with 4 year warranties now - they have never kicked up a fuss if I've requested a part, and an engineer is always out on site either next day or two days after I submit the support ticket. For the extra couple of hundred quid it's been worth it's weight in gold with our ThinkPads. Even if a kid pulls a load of keys off a teacher's laptop, Lenovo never ask any questions and send us the replacement part nbd. Same for Dell ProSupport NBD on our servers, and the HP lifetime warranties on our switches. I'd say financially it's made sense for us (maybe not on the servers, they've been rock solid).

I used the install guide at https://snipe-it.readme.io/v4.1.6/docs/installation, they do provide an automated script you can use if you're dedicating a server to it though: https://snipe-it.readme.io/v4.1.6/docs/downloading. Not sure how well the automated script works since I put it on n Ubuntu VM we have dedicated to internal web services. No smartphone app or smartphone barcode integration - you can get SnipeIT to create QR codes for assets that include a link to the asset in SnipeIT though so you might be able to do something clever with that. I'm just walking around with my laptop and a USB barcode scanner at the moment since I'm starting from scratch and making sure all our serial/model numbers etc are correct.

I'm deploying this in our school as we speak. I got sick of our office staff using an Excel spreadsheet and having to fix it every half term. I bought a pack of 1,000 barcoded asset tags with 'PROPERTY OF , ' on them in our school colour from Asset Stickers & Barcode Asset Labels UK Supplier | Label Bar and a barcode scanner from Amazon. I like that SnipeIT integrates with Active Directory, is very flexible with assigning assets to people and/or locations, and that it's hosted on premises. It also means we're not just tracking high value items anymore, I've started adding everything in like monitors, IP phones etc. It also has an auditing function where it wont tick an item off unless you scan the asset tag, I haven't tried it yet but we do this once or twice a year so that'll come in handy too. So far would recommend!

I think this thread is talking about two different setups. The OP has an LEA provided router with an interface that has a 'directly connected' subnet (like your average home router), in which case yes they need to make changes to support VLANs. Either add sub interfaces with VLAN tags or to configure it with routing capability on the port and set a next-hop address that points to your L3 capable switch/own router. Other people are assuming the LEA provided router is already providing a L3 route to a core switch on the internal interface, which it may not be. In our situation no. SchoolsBroadband provide a router with an interface on 10.0.0.1, they expect our core switch/router to be on 10.0.0.2 (next hop from their router is 10.0.0.2, next hop from our core switch is 10.0.0.1). They have a route setup on their router that says anything in the '10.0.16.0/20' subnet goes via our L3 core switch. I'd say this is a more typical setup in schools that need to route private addresses to their ISP for filtering and what not, so not that complicated.

Because the router knows that anything in the /22 subnet is behind the core switch (or 'next hop'), so it throws any traffic destined for any IP in the /22 at the core switch. The core switch then knows where each IP is on a more granular level (the VLANs) and does it's thing. SchoolsBroadband give us a /20 - they don't care what we do with it, their router just needs to know that our core switch knows what to do next.

Sounds like theft to me - they have your money, and you don't have the product you paid for. The courier is eBuyer's problem, not yours.

I hope they: 1. subsidise the cost of the laptop 2. don't expect staff or work at home 3. realise the cost of data getting exposed!

But not has huge as Cisco/Meraki!

I’ve gone off Millgate in the last 6 months. They never seem to reply to any of our emails anymore. I’ll be shifting our MS licensing away come renewal time. Have had various services from Pugh over the past few years, can’t fault them at all and Nathan is a pleasure to deal with Also worth giving VeryPC a go!

We opted for NUCs from VeryPC mounted to the back of Iiyama monitors from Insight. A full workstation was around the £300 mark for reasonable specs.

Are you using USB3 Ethernet adapters, or is the port built into the machine? I just had a similar issue on some laptops that I was imaging using USB Gigabit Ethernet adapters. The solution was to reboot into Windows, then run a step to pause for 10 seconds (ping 127.0.0.1 -n 10) and then run the Apply Network Settings step. This gives Windows enough time to sort it’s life out before doing the domain join. Complete stab in the dark though

Meraki scared me off with their outrageous pricing! I love our 2530s and the new 2530-48G-PoE+ I managed to nab is working wonderfully now

Hi All, Does anyone know how we can provision and do SSO for Microsoft accounts? We already do this with Office365/Azure AD but these are obviously different to standard Microsoft Accounts. We've got a parent who works at Microsoft coming in to do some sessions with classes of kids around HoloLens, Paint3D and a few other Microsoft apps but some of this stuff requires Microsoft accounts to function properly. Does anyone have any clue how I can easily and more seamlessly deploy this? I wouldn't want to say no can do because I really think the sessions will be good for our kids and give our teachers more insight into what we can do with Windows 10, it's just proving more difficult than I anticipated. Any help appreciated!

I don't see why you wouldn't to be honest. It gives you an easy way to provide user-based reporting on Web filtering, share permissions, allows easy integration into Office365/Google Suite and other applications. It's a no-brainer really.

Totally agree with Alan - you should look at setting up something like LibreNMS to monitor your network performance before blindly throwing money at things, although I'm not sure you can do that with Netgear - it was one of the reasons we ditched Netgear 10+ years ago. Their "smart" managed stuff is cheap, but it was lacking features even schools might use... and their web interface is *horrible* to use, with no CLI. I found a nice middle ground with Ubiquiti CCTV/Wireless and HP/Aruba (with some Juniper) switching. I just didn't have the confidence in the UniFi switches with them being so new.