Killer_Bot

Hi all, I've had a look through various posts on here and no one has really asked this question since 2011 and I'm hoping time has moved forward enough to provide a solution that doesn't cost the earth. One of our Academies are looking at completely refurbing a large section of the building and have a really exciting project agreed. Part of this project includes the idea of a green screen and discussing it with them they were planning on doing the chroma key post processing which is easy enough. I'm just wondering whether there are any live solutions out there where the students can actually see what's going on behind them and don't have to act blind. I'm not at all expecting such a solution to be cheap though it would be great to hear what experience others have had and can advise on. I've had a look at various things through google but my googlefu appears to be letting me down as I'm not really finding an answer. Any thoughts or advice would be appreciated. Thanks, K

Lots of views but no response. Should I take that to mean Apple still haven't made the process any easier? If anybody would like to share their own methods that would be great. Dan

Afternoon all, I'm looking to get some advice and feedback on what the general approach is to putting iPads into a 'Shared Use' environment. My approach thus far has been to configure a single iTunes ID, register all iPads to that ID and then push apps out using Meraki. These iPads are unsupervised. This has been straight forward enough when there were 10 iPads but now I'm seeing Academy's want more and more and I'm not sure how efficient this will be moving forwards. The issues with this approach are numerous but firstly I'm not confident we're not breaking Apple terms of service by registering a single account against multiple shared devices. Secondly, whilst we are using Apple VPP, these devices aren't supervised and so used licences can't be revoked. We can redeploy to the same iPad if for some reason it needs formatting but we can't revoke and issue to a different device if for example it were to die a sad death. We're also unable to push out installs silently. At the minute for example a Technician has to be onsite, push out the apps, type in the password on the iPads when prompted and then wait for the apps to install. I've had discussions with Apple consultants, Apple themselves and various other people and the consensus seems to be that unless it's a personalised learning project, there is no efficient solution. It's only just occured to me to ask the Edugeek community and share some knowledge. I've been a long time lurker here but rarely get in involved. Time to change that!. Having a brief look through the forums currently there seem to be some interesting developments (one post in particular mentioning this Apple - Education - IT - Device Enrollment Program that I need to investigate further). Any thoughts, advice and criticisms would be most welcome. Thanks, Dan

Hi Bhavesh, Oasis Community Learning supports a variety of schools all across England though those we support in the Birmingham/Midlands region currently consist of Primary Schools only. There are no immediate plans for a Secondary School to come on board in the area though that could change in the future. The team the successful applicant will be a part of currently support 8 Academies; 7 of which are located in Birmingham and the other in Worcester. All mileage between said sites is covered under our Expenses Policy depending on the size of your car's engine. I hope that answers your query but if not please feel free to post back or PM me. Regards, Dan

Hi all, I am the Service Delivery Manager for Oasis Community Learning's Birmingham Academies and will be the person the successful applicant will report to. Oasis are a fantastic organisation to work for and we have a fantastic team of IT Professionals across the UK and a local team of 2 Technicians currently working across several Primary Academies in the area. The successful applicant will join this team and provide support for 2 - 3 Primary Academies acting as first line support but regularly getting involved in your typical second line duties. If anybody has any questions in terms of the job role and duties or working for Oasis please do let me know by either replying here or sending me a PM. Please do bear in mind that the Interview date has had to be moved to the afternoon of 4 December 2013 due to other obligations and I do apologise for any inconvenience that may cause. Thanks, Dan

We are now looking into a transparent proxy solution. Tried everything to get this working but had no luck. As a quick workaround to get some deployed we set up a laptop as a Wireless HotSpot and connected the ipads to that.

Did anyone manage to get to the bottom of this or is it a non-starter with a non transparent solution? I too can get the devices to enroll fine but synchronization will not finish and no config can be made remotely.

Thanks Peter. Sounds like it could still work. The only thing that concerns me is having to give Staff the credentials for the generic account (though of course there won't be a credit card on file) in order for us to push out the apps. The ideal solution I think would be a Mac and a sync station though it's hard to justify the costs and the budget of most my schools are typically low. We need to setup 44 devices and ideally be able to manage them remotely. I understand IOS7 is bringing more features in relation to an MDM so hopefully that will aleviate some of these issues. I think what I will do for now is setup a few devices and then push the apps out and see what happens. In terms of updating IOS would we need to collect these in and hook them up through iTunes? That would be fun! I

I know this is an old thread but I've just stumbled across it and very happy to read what howartp has wrote above. If this is correct and that wiping a device and reconnecting to Meraki will allow me to re-push the same apps out (more importantly the paid apps) that saves us having to buy a Mac and a Syncing station. Howartp; can you confirm if, a few months on, all is still working as described? I have Meraki configured with all our free apps and will begin looking at paid apps if what you say is still true. Granted they'll take a bit longer to setup over the wireless but atleast it's something that can be done remotely. Another quick question; if I chose to do this and not use a Mac I'm assuming the initial setup would just be 'login with schools default itunes account on device, connect to Meraki'. Right?

We have Forefront TMG as our Firewall, can this not do a similar thing? Trying to keep costs low.

Thanks for all your responses. I've looked into the solutions suggested and some of it looks like it could work but I can't find how to just integrate the solution with the OpenVPN AS server and only the OpenVPN AS server. Another solution I've read about is some kind of NAC client on the endpoint devices that staff could just install that would only allow the connection if it met certain conditions. Any further advice would be welcome.

Hi all, I've just gone through the process of installing and configuring OpenVPN for our Network and all is working perfectly. However after a discussion with the Network Manager we decided we really need some kind of protection from poorly maintained systems connecting to the network and possibly bringing all sorts of malware with them. I've looked into ways of doing this with OpenVPN but all I can see is advice RE Post_Auth scripts that could possibly pull AV status from software before allowing the connection. Though the issue with this being I don't know what AV the clients will be running and in all likelihood it will be many different varieties as Staff will be using their own devices. I've looked at using Windows own VPN solutions with Routing and Remote Access though as PPTP is known to be insecure, without implementing PEAP-MS-CHAP-V2 which in turn requires certificates being installed on clients, it's a route I'd rather avoid. Ideally I'd like a solution that could offer the following; - Simple connectivity similiar to OpenVPN (they navigate to our URL and logon) - Ability to interrogate client for status of AV and deny connection if non-compliant - Some sort of EXE staff can take home and run in order to make the necessary connections and system changes for the connection and interrogation above Are there any other out there that people may be aware of? Preferably free and software based. All thoughts are welcome. Thanks, K

Did you manage to find a solution for them to use? One of the Primary schools we support used something called Zu3D last year but we had no end of problems with the redirected home folders and it requiring to store certain files locally. The long and short of it was some lost their work, others had to have folders renamed to match what the file (and subsequent files created on the local HDD) were originally called, and others just kept getting errors from the software. They've asked if we could suggest something different for them this year which is what brought me here. Just wondering what you went with in the end. They too want to use Plasticine so has to be stop motion and captured via webcam.

I think the 'Remove this item when it is no longer applied' option applies to removing that setting when the Group Policy Object no longer targets that computer rather than the individual objects don't exist. It sounds like it may be more of an issue with their AppData storing the start menu objects. There are most likely ways you could clear out this area with a script on logon/logoff but it depends on where you've put their appdata.

Managed to get this script working in most regards in that it's successfully copying files to the local drive including permissions. The only issue I'm having now is that I can't figure out the whole 'hiding' the folders thing. For example I've removed permissions for 'authenticated users' and made sure the test user had no access to certain folders/files within the Start Menu directory. When logging on as that test user, none of the folders were shown initially, including those they do have access to. Trying to get our head around your script we noticed a reference to the 'desktop.ini' file existing. Copied the .ini file into the directories and then they showed when logged on as the user but those they don't have access to also showed up, though they were (empty). Any ideas what I'm doing wrong?

Kind of cant help but. I know a year is a long time but I can't afford to have even a possibility of being out of a job in that time, even more so when you consider the level of input this post asks for.

There may be no like-for-like policies in there that will prompt the overwrite but if they do just look at what's the latest version and keep that. If you're really worried it may mess it up then just copy the current PolicyDefinitions to somewhere else on the C drive. If anything messes up during the overwrite you can just delete the folder and copy the old one back.

You're best bet is to setup a Central Store so that no matter where you access the Group Policy MMC you'll get the same ADMX/L Templates. To do that follow the instructions here; How to create a Central Store for Group Policy Administrative Templates in Window Vista (although it says Vista the same steps apply). To sum it up though you just create a folder called PolicyDefinitions at \\FQDN\SYSVOL\FQDN\policies and drop a copy of your Servers Policy Definitions in there (including the language folder containing the ADML files). You can just copy those files you've downloaded (both the ADMX and ADML files) to that location then and that'll do the job. If you can't be bothered doing that just drop them in the servers PolicyDefintions folder, so long as it is uptodate then you're fine to overwrite. My advice is always the Central Store though.

Are there any PSO's being applied to particular users that are overriding your default domain password policy? If not have you actually seen the expiration error? I only ask as I get staff/students coming to me all the time saying my passwords not working anymore and half the time they've either forgot it or typing it in wrong. We use OWA and have never had an issue with passwords expiring so can't think why that would be a problem, we don't use RDP for Staff though so whether any security policies are setup when you add that role I'm not sure. Post back if you figure out what it is though

This sounded really interesting until I read the bit about the job being for 1 year only initially. That's a shame.

We use GPO to map our home drives and there is an option there to enable it for XP too. If you are using Scripts then I'd suggest doing it this way instead.

So I'm assuming you've added the printer to the server via TCP/IP Port? Have you then added these 32bit PCL6 drivers using the 'additional drivers' option? Think it's on the 'shared' tab if I remember correctly.

You may want to post a new thread Finch, this one's been dead for over 2 years Just a quick suggestion but have you checked what PiqueABoo suggested (i.e. keeping the arguments separate)

I know you can backup GPOS through the Group Policy Management MMC though I'm not sure if you can backup their locations (i.e. where they are allocated). There are tools built into Server 2008 to backup AD (which would possibly include the DNS zones) though from what I gather you aren't allowed to use them? We use DPM for our backups so not much help using them either way sorry.

If you don't want to go down the route of using an OU for the install you could do Groups as you initially planned though you'd need to do it as a group of computers as opposed to users. You can then use the security filtering and drop it at a higher OU and it'll only install to those who have the group membership specified in the Security Filtering. That's how I tend to install software that involves a few machines from each OU.