mdrabble

Very nice!, thanks for your hard work and providing an invaluable resource 😀 Loving how it just works on my phone!

To try and save me re-inventing the wheel and spending ages looking at the multitude of options etc, would anyone be willing to share how they have configured/locked down their laptops for staff? Cheers 🙂

I've spent most of yesterday evening playing and it seems to be a combination of waiting for Entra/Intune to Sync and also failed Hash uploads. As the has upload was part of a script I never saw the error I found a set of scripts, which use a webhook to post a pass/fail notification on Teams. Of the 4 laptops I have tested using this method, 2 now do exactly what they are supposed to do - once I have waited before starting the User Join Process and the other 2 had failed hash uploads. YouTube video on the process I now use - in case anyone finds it useful

So I have been busily sorting out apps, and generally testing our Intune processes. which I have been testing using the follow steps. Install Windows 11 either by USB or SCCM to get a based image loaded. Shift F10, run a couple of scripts which adds the device hash to Autopilot and sets the Intune Tag Run sysprep /oobe /shutdown so it is then ready to go. So my questions are...... When the laptop has been turned on after the oobe process, should I be presented with the choose keyboard options? The Autopilot Deployment Profile is set to name the laptop and configure the keyboard - do these step happen during the joining process? If the AutoPilot profile only configures things during the join process - how do I skip the choose lang/keyboard options at turn on - is it possible? Cheers

Thank you so much :-) very much appreciated. I would have done both at the same time, so good job i asked :-)

We use Office 365 and the current DKIM records are using 1024 keys - how difficult is it to rotate the key to 2048 versions and are there any gotcha's I need to be aware of? Is it a case of rotating the keys and then updating DNS? Cheers

I'm Looking at the M365 A3 - so would I'm thinking yes :-)

Slightly late to the party - just looking to switch to A3 - I've checked but wanted to confirm - I am right in thinking that Intune licensing is include with A3 Cheers

Have you considered looking at solutions similar to the Zoxi desk systems? You get the desktop usage and when not needed, the hid away and become a desk. Not used them myself but saw them at Bett and looked ok.

I am slowly loosing my mind and going round in circles! - Mods feel free to move me to a quiet corner where I can rock back and forth whilst drooling! I'm in need of a guiding hand or a slap around the head depending on how you want to view this issue..... I have FortiGate setup with a Captive Portal on a SSID/VLAN - and it works fine on unmanaged devices - You connect and you get the portal logon page, etc and it works as it should. I'm trialling JAMF School on some ipads and have set them up as Shared ipads, as they will be used by different students in Art! (Don't ask.......) Soon as I try and use JAMF School or have a JAMF School managed device on the same SSID/VLAN, things start falling apart! I must be going something wrong!! as both work perfectly fine when used seperately. iPads and JAMF school work correctly when hot spotted to my phone - so I know JAMF works. I know how Apple devices have the need to talk to the internet, so when I try and put in exception on the Portal interface such as 17.0.0./8 - the portal doesn't work So for those using JAMF School and Fortigate - how do you manage these things???? Cheers

I'm new to Apple School Manager - got the approval through yesterday and started looking at setting things up. Also trialing Jamf to manage a small number of ipads - as these ipads will be used in the Art Dept - and Jamf allows to be configured as a shared device - No my idea, I'm just stuck sorting out the :cesored: Took an ipad home and maanged to get it enrolled via ASM and into Jamf. The other, following the same process just give me "iPad added" - assigned to JAMF and the only option is to Erase the ipad, and I'm back at square one...... I'm using Apple Configurator on my phone to enroll ipads into ASM..... and been going round in circles all morning! What am I doing wrong? ------ Think it more me being impatient and firewall rules! Walk and a coffee always helps!

I was very recently in a similar position, 2011 ford focus with 135k miles and it suddenly needed work would have cost more than it was worth. Got £250 trade in as part ex as couldn’t be bothered with the hassle of trying to sell via other methods as they all seem to be same price. 2nd cars are really holding their money much to my shock! I though same sort of price £6-8k when it was more like £16k Having looked at HP costs over 3-4 years it was working out the same or more than a new car on PCP. Looked at full electric and hybrid and was really on the fence. Eventually went for a Duster Expression hybrid on a 4 year PCP costing me £369 Per month with a 3 year service plan - in year 3 I can trade in and upgrade or wait until the end and have options to hand back and walk away, trade in and upgrade or purchase. Correctly getting 500 miles on a full tank which has lowered by fuel bill considerably. I would like to have purchased via HP but cost was way more than I could afford, so PCP was the best alternative.

I’m 365 as well - how do you manage ChromeOS Flex? Do you need a Google account to setup and configure them?

@Imrogers which version of CardExchange do you use and do you do you need any additional plugins?

I'm going to put this here as it seems to related to firewall/filtering i think......... please feel free to edit/move as needed. Testing Intune, as it fails miserably when on the school network but when connected via 5G or home network, it deploys fine. Have a Fortigate in use - anything I should be looking to except? When looking at Fortigate logs, nothing jumping out as being blocked/denied so I'm scratching my head on this one. Cheers

So after a number of years talking about laptops and after a meeting yesterday, been given the green light to look at Teaching staff going down the laptop route from September. Looking at potentially 100 laptops (75 Teaching staff -Full & Part time, Supply Staff, Trainees and Support staff who may need them if working form home - and some spares for emergencies) This will also benefit me as I can finally shutdown RDS! as an on prem access can be made via VPN. The ideal is to stop 3 or 4 staff all logging onto the same PC in the morning, loading up everything for the day for when they teach in that room and then switching user! (I did remove the Switch user option but the backlash was unreal!!) Got to he point where I am fed up and staff moaning about things running slow - and I do point out time and time again this is due to to 3 or 4 users all logged on and each user having upteen browser tabs open, several PowerPoint files open, plus sim.net open! Laptops are to replace the desktop in the classrooms, as well as the removal of desktops from the staffroom and teaching staff offices - as staff would now use their laptop in any location - which would also save on the number of desktops that would need replacing to become Windows 11 compliant. Which brings me to my question (sorry for the waffle) So after going on mission to Bett, and spoke to a number of people about laptop - it has now ultimately come down to Budget (not been given specif about as yet but I need to work on as little budget as possible) initially, I am going to get 5 refurb laptops and dock to help form a working party to help drive things forward and get staff on board - as we all staff who love or loath laptops. I will set them up via Intune, with how I imagine them to work, and then wait for feedback from the working party and make changes etc..... Refurb laptops, such as the Dell 5410, 10th Gen CPU, 16GB Ram, 256GB NVMe, 14" Screen for a good price of £275 (using ICT direct as an example) Or New Laptops - Lenovo V15 G4 15.6" AMD Ryzen 5 7430U, 8GB RAM, 512GB SSD - 15.6" Screen - for £299 (probably slightly less if I manage to use the trade in offer) Not had a massive look around as yet - but new laptops ideally 16gb RAM for not much more money ideally and CPU can be AMD or Intel. In my head, I am thinking CPU wise, you wouldn't really notice the performance difference from the 10th Gen to the latest Gen CPU - were as the amount of RAM would significant be noticeable. Would need some kind of USB-C Dock for Ethernet and HMDI and Speaker output - again either £40 for HP G4 docks from ICT Direct or new at ££££££ I have an ideal world laptop, which allows user serviceable parts, rugged etc but in reality it will be done "Can I do this spending as little money as possible" So I'm looking at £400 for laptop, dock, bag. What are people thoughts, opinions and laptop choices. Cheers

Didn't even thing about the log files! Turns out, the device I was first trying was in SCCM with another Device name, so as far as SCCM was concerned, it existed, therefore no action needed. Now to look at these laptops.

Used Wireshark to grab some further info and it just shows an existing device as a source IP of 0.0.0.0 using DHCP Discovery - It not getting the DHCP reply which is odd as new devices are fine. DHCP working fine as device get an IP when booted into windows. Boot file has PXE drivers - but would expect PXE to get DHCP before handing over Boot file. Scratching my head on this one.....

Have a bit of a strange one with PXE booting clients. New PC straight out of box - PXE boots and builds no problem Existing PC - refuse to PXE book - fails to acknowledge Boot file - just simply gives up. I remove existing PC name/mac address from SCCM - so cannot be related to known computer (as far as i know) Only noticed this issue now, as last month or so, only been imaging new devices. Clutching at straws as what to try next - other than removing and adding PXE in sccm. Any other ideas/suggestion to look at. Cheers

Did look at Win 10 LTSC as a stop gap but though why should I scrimp/save/bodge when if anything goes wrongs - it's me that will get it in the neck! I went down the Cyber Security route - no updates, no patches = security issues Head and Governors have been very good and authorised slight over spend on my budget for the last 2 years I've got approx 100 devices (1 IT Suite and Teacher/Office devices) left to replace out of approx 500 Head and Governors have been very good and authorised slight over spend on my budget but I think that is only because I laid it on thick about my concerns.

I've removed the LAN rule for Student WIFI, so all DNS/DHCP handled by FortiGate.

Love the Edu-hobnobs at the back.... do they come with the cups? Hoping to pop by tomorrow and say hello

Having disabled the Student BYOD when we had Fortigate installed, I had been managing to keep it off for almost a year.....until now! SLT want it back on to allow students to access online polls etc as some students don't have enough data. Having sorted out a way to give them easy access to install the SSL Cert, I wanted to double check some firewall rules before going live with a test group. Student Wifi -> LAN - Do i really need this rule? Year 7 and Year 12 Filtering - thinking, should I change the Services from All to http, https only? Also, on my student test user, on an iphone, I am having issues when accessing any google, such as accessing the url google.co.uk and web searches due to blocking QUIC - is this normal? Would you suggest any other changes? Cheers

Yep SSL is just for filtering. I was resisting the need to spin up a VM just to host IIS and single SSL Cert, but looks like that many be the only option :-) Cheer Guys :-)

How do people get users to download and install the SSL Cert for BYOD? Users authenticate via Radius (NPS) and then passed on to Fortigate for filtering rules. Using Unifi Wifi and Fortinet for Firewall etc. I have set up a page on our SharePoint site which written info on what they need to do and why....... I was thinking of having a download button and QR code - but trying to decide on the best location to host the SSL Cert. Can't host on school website as Juniper Hosted site won't allow the upload. Did think about SharePoint, but they have to log in to access, as no option to allow anyone to access - plus wants to open as a text file! Ideas/suggestions welcome :-) Cheers