mrstrong

how can you check this ? I created a user ok (or so i thought) but they can't login, they just get : "something went wrong" with error Back Filled Errors: Unhandled Rejection: Error: 401:undefined|undefined:undefined Co-pilot suggested I edit the Default Role Assignment Policy: "make sure that the MyBaseOptions check box is selected" it wasn't so I ticked it but made no difference. Wonder how we've not had any issues all this time without MyBaseOptions as looks like it should be selected by default ?!

no, long out of warranty

see attached, looks like this (classroom lights off and notepad opened on pc). Appears on all inputs and even when no signal, guess it's terminal ?

Interesting as our DPO said we needed parental consent ! Apparently "Google insist in their contract that you confirm you have parental consent." ?

@ibpalle any idea why my URL pattern scratch.mit.edu/projects/\d+ is not matching (and hence blocking) e.g. https://scratch.mit.edu/projects/1175653194/ I've added this on the on-prem box and device in question is a chromebook with the cloud filter Maybe URL patterns (defined in a new category which is blocked) are not supported in cloud filter ?

@ibpalle so you recommend I use the first example as best practice / starting point and tweak as appropriate ?

can I ask how you have your web filter rules configured ? we block "video games" for students but that catches scratch.mit.edu so I added an allow for students for the smoothwall category "Scratch MIT" above that After seeing this thread, I've now added a block above that for a new category I just created with domain url filtering : scratch.mit.edu/explore scratch.mit.edu/search and URL patterns: scratch.mit.edu/projects/\d+ so kids can still use editor but not explore / search but annoyingly the url pattern does not seem to be working as https://scratch.mit.edu/projects/1175653194/ still loads 😕

but IT staff would need access to some "core blocked content" so you'd have to move "IT Staff" folder above the "Everyone" policy folder ? edit: so not sure why the Smoothwall docs have Everyone above IT Staff by default

which "bit" of the website had the "inappropriate image" ? I'm wondering if it's possible to block parts of the website (we use smoothwall) e.g. the main editor the kids need is at https://scratch.mit.edu/projects/editor a lot of the user uploaded content seems to be e.g. https://scratch.mit.edu/projects/number e.g. https://scratch.mit.edu/projects/1175653194/ could smoothwall block these with a url pattern match ?

I'm trying to tidy/simplify these (ours are a bit of a mess / confusing) starting with Web filter policies. Could anyone share their basic setup ? Had a look online and found this article https://kb.smoothwall.com/hc/en-us/articles/360002031710-Default-Web-Filter-Policies-Overview It shows two interesting examples that I was thinking of using as a starting point, they do differ somewhat as first one uses policy folders based on "Who" which seems an interesting approach but not sure about having core blocked content so high up (rule 2.5) ? and

yes we tend to use syncs but if user had a shortcut already the sync failed. Shortcuts do sound like a good idea esp. as not device dependent. Might look at moving over to shortcuts but guess users would have to manually "stop sync" first? I can see teachers getting confused esp as a lot still like the old file explorer / mapped drives

Phew, thanks all I'd been disabling accounts and moving them e.g. Get-ADUser -Filter {(Enabled -eq $False)} | Move-ADObject -TargetPath "OU=Disabled,OU=Accounts,DC=ourdomain,DC=local" so it was probably already disabled and just got moved I'll move it back

Whilst "tidying" up some users with powershell I think I may have messed up big time. It looks like I've disabled the krbtgt user account and moved it into a "Disabled" OU. Apparently this account is crucial for kerberos 🤯 Nothing seems to have broke yet but can anyone advise ? E.g. should I just re-enable it and move it? Which OU should it be in ?

most staff here have a diary where they write down all their passwords, funny auditors didn't mention that. edit : just checked for most staff its 90 days(not 30) edit: and pupil chromebooks (1 to 1 devices) with stickers with several accounts / passwords on

which one do you recommend ?

yes this wasn't my decision, we had an audit and they told us to do it. Perhaps I should have quoted NSCS to them ?!

Hi, Spent this morning investigating printing issues, thought was a bad doc/ driver problem but now looks like it is a password ageing issue: I recently rolled out a fine grained password policy forcing some users to change their password after 30 days, What seems to be happening is some users are not being prompted to change their password when they login in the morning, then presumably the password "expires" during the day and then stuff breaks like printing (jobs stuck at spooling to shared printer as presumably auth broken). A PC restart prompts for a password change and all ok again. Does that sound possible and what have I done wrong / how to fix ?

wow really enjoying this thread, feel I need to up my "cable knowledge" now. I remember buying a "separates" hi-fi system from richer sounds years ago and the guy trying to sell me expensive connector cables. Thought is was bullsh!7 at the time but maybe he was right

just coming back to investigate intune (again), so far I've got a win 11 laptop (usb clean install) through autopilot and into intune (user driven enrollment (standard user). First thing I've tried to do is connect wifi: manage devices , configuration, create policy , windows 10 and later , templates, wifi WPA/WPA2-Personal etc then assigned to computer security group Works fine but then I noticed from a standard cmd prompt netsh wlan show profile name="OurSSID" key=clear reveals they key is this expected ? is there a way to hide it or a better/more secure way to deploy wifi ? (please don't say use radius 😁)

only just started looking (again!) at intune but one thing I noticed is your ESP _MSFT is only assigned to all devices. In my initial test of a User-driven enrollment, I had to assign the ESP policy to All devices and All users to get it to "work" Maybe as the process is tied to the user signing in during the OOBE ?

any reason why ? are you going to intune azure AD or hybrid ? we still mainly 1809 LTSC

KRCS : also paying £5 a pop

is the delete of old profile done somewhere else as can't see a delete in that script ? could you try adding: netsh wlan connect name="$($SSID)"

I did try Mosyle free a few years ago but found the interface a bit clunky. We now use jamf school, think its £5 per device per year.

yes you can do it with the share point migration tool: https://learn.microsoft.com/en-us/sharepointmigration/introducing-the-sharepoint-migration-tool its a while since I've used it but recall it was fairly simple, do a test first of course. Another approach I've used is to mark a shared drive as read-only and get staff to migrate their own stuff to teams / sharepoint. I created teams with a basic folder structure to keep it consistent. Main advantage is staff are forced to think about what they actually need, so in theory you get rid of a lot of "junk" After a few months take the shared drive offline and see if anyone moans