geohanson

@garethEds We paid considerably less than the price that's now on the 2Pint website, but I think it was still in beta when we bought it. If the renewal is the price as per the website, I think I'd have to look at changing to the community version, which I think would still work for us. The argument to the business manager was that we need an imaging solution that complies with the DfE Standards and Cyber Essentials. There isn't really much out there that does. MDT is now deprecated SCCM is too costly/complex SmartDeploy is expensive FOG doesn't work with secure boot and there's no paid for support Autopilot doesn't do bare-metal imaging

@garethedmondson That could possibly work - we've just gone down the path of least resistance, and just delete the PCs from AD prior to building. Once they've been built once with DeployR then they're fine. In AD, the owner for DeployR built machines is actually the server/VM rather than a user account. Not sure if changing the owner in AD would work but could be worth a try. The original version of the script is here: https://github.com/gwblok/2PintLabs/tree/main/DeployR/FrontEnd/FrontEndJSONDriven One of the things I wanted was to be able to manually name machines and choose an OU/software as per MDT. Took a bit of work to get it working properly (some thanks to Gemini Ai!) but it works well.

Only just noticed this thread, as I don't visit Edugeek very often! We're running the paid for Enterprise version of DeployR, (have been since December 2025) however I'm running the frontend script as a standard command line script not as a "Run Server side script" which I believe is Enterprise only. In reference to imaging a PC already in AD, it's my understanding that anything imaged with something other than DeployR will have to be manually deleted from AD, but once DeployR has imaged it once, it can be imaged again without being deleted from AD. https://documentation.2pintsoftware.com/deployr/reference/step-definitions/offline-domain-join I've just spent the last few hours making some changes to this and trying to streamline it... Our TS step to launch the above is Hopefully that might help.....

Haslingden High School (Rossendale, Lancashire) is currently recruiting for an ICT Technician to join our support team. This is a full-year (37 hours/week) position, Grade 6 (£28,142 - £32,061). The Role We are seeking a hardworking and enthusiastic individual to work within our ICT team. You will be helping staff and students get the best out of our systems in a mixed environment (Windows/Google/Apple). Key Duties: Support: Acting as a point of contact for IT support incidents and escalation. 1-to-1 Device Management: Assist with managing our 1-to-1 iPad scheme (using JAMF) and our Chromebook estate Hybrid Infrastructure: Assist with supporting our server and network infrastructure across a hybrid environment (On-prem & Cloud). Projects: We are currently in the early stages of a new school build, so there are lots of new and exciting projects on the horizon! Requirements: A sense of humour, a smile, and empathy for young people are essential characteristics for this post. Experience with SIMS/Edulink, MDM (Google/Apple), and network maintenance is desirable. Deadlines: Applications close on Tuesday 3 February 2026 with interviews the following week. Apply: Further details and an application form are available on our website: www.haslingdenhigh.com/vacancies Feel free to ask if you have questions!

Just using the content caching service on a pair of Mac Minis. They cache all MacOS and iOS updates and App Store downloads. Saves us around 6TB of download data per month.

@psydii Our iPad filtering just works over 802.1X - Users sign in to the WiFi with their AD credentials and everything is logged within the Opendium UTM. I believe there is a WPAD file which pushes anything to the web proxy within the UTM. There is a basic level of filtering applied to the iPads through Jamf and Apples own content filtering. We've had the discussion about full offsite filtering/monitoring for iPads, however, the school is happy with the current setup and the workload increase would not be manageable by the safeguarding team. Parents are made aware of this as part of our 1-to-1 scheme.

@DWilson1997 Sounds like this might be the path we take. I suppose we could push guest traffic through the Sophos filter for a basic level of filtering and redirect all other traffic to the Smoothwall. If we weren't doing much/any filtering on the Sophos, then I don't think we'd need the Sophos SSL cert on client devices. It's bad enough trying to manage 1 cert! I'm not sure if having two certs and potentially decrypting and re-encrypting twice would cause any performance issues. Do you do 802.1X/RADIUS for wireless devices?

Hi all, Looking at potentially replacing firewall/filtering in the next financial year. 1600 students, 200 staff. 1600ish iPads, 60 Macs, 450 Windows PCs, Chromebooks/ChromeFlex PCs, BYOD and everything else you can think of.... Unifi WiFi throughout, with Aruba and UniFi switches Currently running with a 1GB Leased Line with an FTTC backup - Hitting the limits of this especially first thing in the morning. Our Apple Caching servers are definitely saving our connection at the moment! Currently using an Opendium UTM Support is great Filtering is great Reporting is great Firewall side works, but is limited in what I/we can control without going through their support. I think pushing a lot more bandwidth through it (if we moved to a 10G connection) would kill it. It's also doing RADIUS auth for us which I don't think helps performance, especially during lesson changeover and 1500 devices all move round the building. It also does all our intervlan routing - Yes I could move that to the core, however I like the ability to have full control over east-west traffic, and it's easier than doing switch ACLs. Moving forward: We need a network level filter for BYOD/guest and can't rely on a on-device agent only Smoothwall is another option, however it seems like a great filtering product but the firewall doesn't match a dedicated Sophos/Fortinet We could retain the Opendium filtering and move the firewall to something else If we had a separate firewall and filtering would I then need to deploy 2 SSL certs to every device? The UniFi EFG looks interesting, however I'm not sure how well it would work for us. Any reason a pfSense/Opnsense firewall would be a really bad idea, providing we had the support for it? I haven't used Fortinet/Watchguard/Palo Alto I've already had a quote from Wave9 for a pair of Sophos XGS and Smoothwall filter, but we had a bad experience with the old Sophos XG around 5>6 years ago which puts me off a little... Does anyone have any suggestions on other options we could look at or things to avoid? Thanks!

Thanks for the replies So, I will move the Guest WiFi DHCP to something else that just lives on the Guest WiFi subnet. Are there any issues having the DHCP servers (with DHCP relay configured on the firewall) on the main network with them serving up DHCP for everything other than guest WiFi? What about BYOD? Should that be separated as well? We've got one WiFi (802.1X) subnet per year group, plus sixth form, plus staff which are currently all served from the DHCP VM (which sits on one of the WiFi subnets), but I'd like to put this on the main network and keep everything together other than guest WiFi which I'll keep separate.

Hi all, We are currently running multiple DHCP servers on our network and ideally want to amalgamate these into one VM, then setup DHCP failover to a 2nd VM Most of our DHCP is provided from one VM, with DHCP relay configured on our Firewall. We also have a few other DHCP servers which just provide DHCP on that specific subnet -EG Our 'main network' has DHCP running on DC1 So the question is, on which subnet should the actual DHCP server (and soon to be DHCP failover server) sit? Do we run multiple DHCP servers for better security? EG - our Guest WiFi has its own DHCP server that lives on the Guest WiFi subnet. Probably better from a security standpoint but then it becomes difficult if you have lots of DHCP servers.... Is there a security risk having Guest WiFi DHCP served from the vlan that contains all the servers? Any thoughts would be much appreciated Thanks!

This was going to be my next step (and the way I set it up originally), it's just a pain trying to get every machine updated with a new config file every time I need to change something. Our exams team often timetable exams in completely random rooms, so we deploy EWP to every PC now (about 500...) I could set it up to work on a heartbeat checkin in PDQ so it deploys the config file when the PC comes online, it just looked like the new MSI command would solve all issues! I've emailed EWP support so we'll see if they have a solution for why that doesn't work, if not, then I'll go back to deploying to each PC with PDQ.

So we've just gone ahead and paid for the license for the latest version. How do people usually deploy the config file for this? We use PDQ Deploy, so installing and copying over the license file is easy. If I copy the config file to each machine and need to make a change, then I have to redeploy it to every machine, which is a bit of a pain... If I put it on a network share and add the parameters to a shortcut, then changes to the config file are easy, however, EWP can ONLY be opened using that shortcut or it ignores the config file - EG you can't just open a saved document, you have to open EWP then open the document. Neither is perfect unless I'm missing something obvious.... Edit: I've also just found the MSI options to specify the license key and settings JSON during install, but it doesnt appear to work... https://support.texthelp.com/help/command-line-usage-pre-install

Hi all, We have a Meru MC3200 controller which although working fine at the moment however we are having issues in trying to save/backup configs. Whenever I do a #copy running-config startup-config it complains there is not enough free disk space. Running #dir shows the only full directory is /tmp There seems to be no way of accessing this to delete anything without root access however I've no idea what the password is. I've tried a #cd /tmp and #cd tmp but I can't access the /tmp directory. From doing some Googling /tmp is sometimes created automatically in Linux and often emptied on reboot.... However, I can't backup the current running-config so I don't want to reboot....... Even trying to download the running-config or startup-config from the GUI just results in an empty textfile.... Any ideas would be much appreciated

From what it seems the only way to script driver changes in Windows is using PNPUTIL or DEVCON PNPUTIL is built into windows, and can install and delete drivers but NOT replace a driver for a specific piece of hardware. DEVCON is not built into Windows, but CAN do the above. Devcon can be obtained from here: https://github.com/Drawbackz/DevCon-Installer Use the Devcon Installer under the releases on the right side of the page to download the EXE. Run the EXE, click the Update Sources button, choose the OS (I went for the latest one) and Devcon should then download. It is part of the Windows Driver Development kits, but there is no easy way to download it.... https://learn.microsoft.com/en-us/windows-hardware/drivers/devtest/devcon#where-can-i-download-devcon You then need a copy of the Windows "High Definition Audio Device" Driver. You can't actually download this, but you can extract it from a PC. This is what you will use to replace the 'quiet' driver from HP. In device manager, manually update the driver to the "High Definition Audio Device" driver. - In order to extract the driver, a device needs to be using it. You may need to reboot. The sound should now be much louder. In CMD as an administrator run: pnputil /enum-devices /class "Media" You should now see that the driver you need is HDAudio.inf To extract the driver and dump it in the root of C:\ run: pnputil /export-driver hdaudio.inf C:\ Note this will extract TWO files. Now we have DEVCON, and two driver files, we just need a script to use Devcon to replace the HP driver with hdaudio.inf DEVCON requires the HardwareID of the soundcard in order to replace the driver. (You do not need to run this now, it's just showing the process) Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.Description -eq "Synaptics HD Audio" } | Select-Object HardwareID Once we have the hardware ID we can use the following script to replace the driver. Note the location of DEVCON and the hdaudio.inf. (You do not need to run this now, it's just showing the process) C:\HPAudioDriverFix\devcon.exe updateNI "C:\HPAudioDriverFix\hdaudio.inf" "HDAUDIO\FUNC_01&VEN_14F1&DEV_5098&SUBSYS_103C83EE&REV_1001" So, to make everything work in one PowerShell script..... Get-WmiObject Win32_PnPSignedDriver | Where-Object { $_.Description -eq "Synaptics HD Audio" } | Select-Object HardwareID | ForEach-Object { $HardwareID = $_.HardwareID Write-Host "HardwareI: $HardwareID" C:\HPAudioDriverFix\devcon.exe updateNI "C:\HPAudioDriverFix\hdaudio.inf" "$HardwareID" } This will find anything called "Synaptics HD Audio", list the hardware ID, and run the DEVCON script using the Hardware ID it just found. The Hardware ID may vary between PCs, so this will ensure it is always correct. I am running this via PDQDeploy, so you may need to script this further depending on how you are planning to deploy it. First I am copying DEVCON, and BOTH Audio Driver files to a folder on the C Drive of the affected PC Then run the above PowerShell script Then reboot. That seems to work for me but I've only tested on a couple of PCs so far. It hasn't reset on reboot so hopefully it should be okay..... My PowerShell knowledge is extremely limited (thanks ChatGPT!) so there may be a better way of doing this, but it seems to work so far....

We're having the same issue here with the same PCs. I'm currently working on trying to script a driver change.... It seems that changing the driver back to the Windows High Definition Audio Driver fixes it.