Blue_Cookeh

I've shown them the ways they can access it (through individual office apps, through the website, or adding it to their Explorer side bar by hitting the Sync button in SharePoint and choosing what they want to keep local) and they all manage it themselves. Before we deployed it I did play around with mapping it to a drive letter but it's not particularly clean and wouldn't really fit in with the whole web/cloud first thing. It was a pain in the butt to manage because it relied on scripts running at logon.

This is the way I'm moving our primary school. We currently have two DCs, a DirectAccess server, SCCM server, and a couple of others for things like monitoring/backup/digital signage sat on x3 Hyper-V hosts. I'm slowly killing off internal features with the view to go 100% cloud based and get rid of the servers in the next 5 years. We're at the stage now where file shares are in Office365 Sharepoint and personal files are OneDrive with FoD. My next plan is to implement Microsoft Intune on our Windows devices (already using it for iPads) so I can wind down Group Policy and use AutoPilot for device deployment. This will just leave Active Directory. I'm undecided whether to move entirely to AzureAD or just sit a standard DC in Azure with a site to site VPN. We'll probabably just go full cloud and stick with AzureAD - it's becoming a full replacement for ADDS slowly. Even if we had to stand up a full ADDS server in Azure then the cost of that is tiny compared to the cost of time/hardware etc. DHCP and DNS can then just sit on our core router (or use isc-dhcp-server on Linux @TwistedHelixis) and filtering done via SchoolsBroadband. We might keep one Linux server around for monitoring/CCTV/other bits.

ding ding I loved my Sophos XG's when we used them up until 6 months ago and I would happily recommend them if you need more advanced features like web filtering etc. pfSense is the way to go if you want something cheap (free) that would fall under being a typical firewall product.

Been using Ubiquiti since the original release of the Gen 1 APs (about 7 years ago?) and we've not looked back. Over the summer we upgraded everything to UAP AC Lite APs. We cover our playing field with two of their outdoor APs coupled with their Sector antennas which work brilliantly for our iPads and WiFi VoIP phones. I toyed with the idea of Meraki earlier this year. They wanted in the region of £15 - 20,000 for our primary school plus yearly licensing costs. It was ludicrous, that would pay for our Ubiquiti upgrade 6 times over and we've seen no performance issues. They're so cheap we can keep a 5 pack on the shelf as spares. We have 2 SSIDs, one 8021x and one Guest, turned off the slower speeds and turned the power down so we can have one AP per classroom (roughly).

Did you guys have to do anything else or talk to anyone to get the A1 Plus for Students licenses assigned? We supposedly got added to the Educational list earlier this week but when I self enroll a test student account they just get assigned the A1 for Student (*non* Plus) licenses.

It's already been pulled from Windows Update.

@mullet_man , who did you e-mail please? I went through Office365 support and they don't have a clue what I'm on about.

Depending on the money, you could do exactly this internally using VMware vRealize and you'd have a much nicer experience than remoting into a 30 odd machines over the Internet. If you're set on going that way, MS recently announced a cloud workstation product where you can host Windows 10 in Azure. I think I'd be trying to find out what the CompSci teacher's end goal is - by "relaxing restrictions" he could just mean he wants to be able to teach Python or something equally as deployable without faff.

Yeah we just use the build in stuff now, managed by SCCM and Intune. No issues so far - we also block all executable files inside C:\Users\%username%\AppData from running too.

In the 1809 ISOs

Yasss can't wait to check out the improvements to AutoPilot deployment! Hopefully I'll be able to say adios to SCCM and migrate fully to AAD and Intune for our student devices this year.

Of course, if school staff are expected (and indeed it is almost required, it's the nature of the job despite what people may say) to work at home writing reports, planning lessons etc then they should be provided with a mobile device (tablet or laptop) that is suitable for doing school work from home, as you would expect in any other professional industry. Do what you can technically, anything else it becomes a management issue and your policies should mention this along with the word "disciplinary" if they decide to ignore said policies.

This is why we blocked USB sticks entirely via group policy before GDPR came in. It's a grey area and what @Jawloms said is true - part of it is a staff training issue if you're going to let them do it. If you are then you should look at the DLP and identity tools that Microsoft offer through Office365 and MS Intune.

Thanks for the quick replies guys - seems like there are plenty of options. I'd rather let sessions timeout semi-regularly - I'll see what we can do on our end, pesky users

FWIW if you're on the new system with the Auth agent I've seen an issue where users' sessions expire in Netsweeper overnight and then in the morning they're considered "noauth" and forced back down to a Pupil profile. I assume this is because the auth agent is only run via a Logon script if you followed SB's instructions. Most of our staff (we're 100% Windows 10) don't actually log off their devices regularly, they just put them to sleep which obviously just locks their session rather than logs them out. I'll have a play around with task scheduler or something today to force a reauth every X minutes or something, unless @SchoolsBroadband has already caught this?

We did our migration this morning and so far the lack of authportal redirection has meant web browsing feels a lot more snappy now. Oh... and no more proxy settings! Agent is super light and easy, logs are all top notch. If SB can keep their recent Netsweeper stability up it's all happy days

The free licenses you get on Office365 for Education are NOT for deployment on school devices! If you want to deploy Office365 CTR to school devices with Shared Device licensing then you have to purchase one of the Office365 (can't remember which) or Microsoft365 packs. I'll freely admit I'm wrong but I've had two licensing partners check this with Microsoft so far

I looked at doing something similar when our VL renewal was up but the cost just wasn't worth it and the licensing guys between our resellers and Microsoft didn't seem to know about all this new stuff - there was a lot of toing and froing with MS on their own product. I'll probably revisit it - Microsoft365 seems to be the way to go for servers/client OS and Office etc.

Heh probably the same people if they both work!

E-mail [email protected] with your agreement number asking for it to be added - last time I did it they sorted me out in a couple of hours.

FYI if you're using a KMS key it is baked into the install already. You need to remove the PIDKEY value entirely, only use that if you're using MAK. Also if you're deploying with something like SCCM you can remove the SourcePath value and it'll pull from the Office folder next to setup.exe.

FWIW (two weeks on but it might help others...) your MDM solution should have a log of failures somewhere. On Meraki I know it appears towards the bottom when you look at a specific device. Failing that you can open the Console app (in the Utilities folder on any Mac) and plug the iOS device in to access very very verbose system logs. It's helped me diagnose network problems with our filtering a lot, too.

How do you mean coming to Office365? This is a direct replacement for Office ProPlus 2016 - it doesn't receive regular feature updates (only security) and is for your bog standard volume licensing customers. If you're licensing through Office365 then MS are pushing you onto Office365 ProPlus with regular feature updates based on the Monthly/whatever channels.

Thanks to the magic of SCCM we've now got it deployed to 25% of our staff and increasing... I decided to wrap it in a PSADT script so it would warn users, let them defer 3 times, and make sure everything was saved and closed before continuing. Normally I'd wait a little while but Office 2016 didn't support Office 365 groups and was holding back the migration of some of our internal shares into Office365 - now that can go ahead!

I also signed up for the BETA within minutes of receiving the e-mail - can't. wait. Netsweeper has been pretty reliable so far but I can't wait for transparent filtering to come back