CHiLL

We use Intune for the devices that students use at home (basically the DFE laptops given our during the pandemic). We now use them for students who do not have their own dedicated computer, laptop or tablet. If they have to rely on their phone or a shared family device to do their homework, they get a school laptop and return it when they leave the school. The Intune policies we had at the time were a slap dash get it working ASAP, even if things are done wrong, such as computer policies to control browser settings, etc. I've now taken time to rectify those incorrect policies, but Intune is making me want to jump off a cliff. I have absolutely no control over whether a device checks in or not and it doesn't tell me why it doesn't (I've had a laptop on for days and not checked in once). Policies and apps are incredibly slow to install and validate. Reporting back to the console takes an absolute age. There's a policy applied to the machines that blocks access to the C:\ drive but I can't locate it, as far as I can tell, it's not being applied yet it is. I have a laptop in front of me that has just downloaded an app we pushed recently and some policies configured last week, yet Intune reports it's last check-in date as 26/10/2023, 0:19:05.

We only have one type of bell throughout the school and do not have the money for another unique bell to be installed. Instead, we do multiple rings of the class change bell to indicate a lockdown scenario and also place a popup via NetSupport Notify that a lockdown has been initiated. A second popup is sent when the event is over. All external and door (including offices and classrooms) have roller blinds on the inside which the people inside must roll down once lockdown has started and the door locked from the inside. Staff are instructed that the blinds are only for this purpose, as from a safeguarding perspective, we can't have staff effectively hidden away with students (I've seen people do this innocently for privacy in meetings, or to avoid distractions from corridors, but they are spoken to by management to not do it again).

Does office install fine and those errors are logged anyway, or does the install fail because of this? I'm fairly confident that our machines that M365 Apps installed and works correctly, whilst the Microsoft.Office.Desktop AppX package is still installed. By reading your post, I don't think you mean the Store app itself, as it's not recommended to remove that as it can break a lot of other things that depend on it. You're talking about the default, small AppX package that comes with Windows called Microsoft Office, which is basically a web re-direct to the online apps or how to buy Office, correct? If you must manually remove the Microsoft.Office.Desktop package, you use a Powershell script to detect and remove it as a computer startup script in GP. I can't think of the code right now, but the logic would be along the lines of: - Check if the app is detected - if not, end the script. - If the app is detected, run "Get-AppxPackage -name “Microsoft.Office.Desktop” | Remove-AppxPackage -Force" - Check if the app is detected and maybe write to a log

My case is still unresolved, despite being opened on 04/03/2024, approaching two months ago. I haven't had a response other than along the lines of "I have chased our software team again".

Users are reading the config, not executing since it's only the config files in the C:\Users\Publlic folder and the application is in C:\Program Files (x86). Aaah, I forgot about using GPO to set permissions, specifically under "Computer Configuration > Policies > Windows Settings > Security Settings > File System". The following groups have the following permissions to that folder: ALL APPLICATION PACKAGES = Read and Execute, List Folder Contents, Read Creator Owner = Full Control SYSTEM = Full Control MACHINE\Administrators = Full Control MACHINE\Users = Read and Execute, List Folder Contents, Read Since permissions effectively work on a "if you're not on the list, you're not getting in", couldn't I just replace "MACHINE\Users" with "Domain\PastoralGroup" and also grant the same permissions? I could also repeat that for the "C:\Program Files (x86)" application folder. That way no other user can access it unless they're in the group. When I selected the folders from my machine, it states that inheritance is already off and sub files/folders inherit from that object. Or rather it gives me the option to turn inheritance on...which I take to mean it must already be off for me to be able to turn it on. I've created a test policy that I'll try out on Monday.

We are looking at deploying a CCTV viewer/exporter to our pastoral devices, so they can view/export footage without having to come through us. However, we have found that the software we need to use stores all it's configuration (including credentials and connection details) in "C:\Users\Public". This exposes an issue where if the software is installed on a pastoral staff laptop and someone else who isn't a pastoral member logs on, that person will have the same access to the CCTV. Ideally, I'd like to use something like AppLocker or Software Restrictions to state that only members in the "Pastoral" security group can launch the application. I'm struggling to wrap my head around how to manage this, since deny policies override allow. By default, everyone has access to the application because it's installed in "C:\Program Files (x86)". If I put an allow for the specific pastoral group, it doesn't do anything because they (and everyone else) already has access to it. If I put a Deny for all users (or the all staff group) and an allow for pastoral, the deny takes precedence. Since we have a redirected start menu and desktop icons, I could just manage access to the shortcut using file permissions, but I don't want to risk it being opened another way and the person having access. Can anyone help me wrap my head around it?

After some research and testing, we couldn't get SmartPSS to silently install without installing the storage component, as the /S switch installs everything. We found SmartPSS Lite from Dahua's wiki, which is pretty much what we want, a way to just view cameras and playback/save footage. Silent install command: General_SmartPSSLite_MultiLang_Win64-Install_IS_V1.003.0000004.4.R.231024.exe /S Silent uninstall command: C:\Program Files (x86)\SmartPSSLite\uninst.exe /S Default path for config files: C:\Users\Public\SmartPSSLite\Conf\User We found that copying the entire "C:\Users\Public\SmartPSSLite" folder from a configured machine to another machine that had a clean install - it just worked. Auto-logged in as the admin account, connected to the NVRs with the credentials. I have identified which files specifically are required, but I'm going to creat a batch file to install SmartPSS Lite and then force copy those files too. I have figure out the two main ways of managing users: Method 1 - Users on the NVR Method 2 - Users in SmartPSS I hope that info helps others in the future!

So to be clear, I have to: 1) Create the user in the web GUI (and it appears repeat for each NVR) 2) Install SmartPSS on the user's device 3) Configure the local SmartPSS admin account during first run (incl lost password questions) 4) Connect/configure NVRs 4) Create a local account for the user I wish to log in (same user as step 1) I don't understand why I have to create the user twice, in the web GUI and also in SmartPSS as both require the permissions/access to be set separately. During the original install, the contractor told us that SmartPSS requires local admin privileges to run. Is that still the case, or would modify permissions on the SmartPSS folder in Program Files be enough? I'll be testing that out, if I can get that far.

Looking at the web GUI, I can see that the group and user I created were there from what I added via the SmartPSS software "Device Cfg". Though to be sure, I deleted them the same way I created them and manually added them in the web GUI, but I'm still having the same problem. When launching the SmartPSS app on the desktop, do you log in with the same credentials you created in the web GUI? Edit: If we have two NVRs, presumably I have to create the user on each NVR, if doing it through the web GUI?

We have a Dahua CCTV system and we are the ones that are the admins and have access to it. Due to an increased amount of CCTV requests, we are looking at offloading this to the pastoral team by allowing them access to it. However, I am struggling to identify the best way to do this, as there are multiple areas where users are created and it's just not working. In SmartPSS, I can access the "Device Cfg", which is each of the two NVRs we have. Here, I have created a user group called "Safeguarding" and assigned it only live view and playback view on all cameras (so no other permissions are granted, like user management, etc). I have created a user and selected their group as "Safeguarding". However, if I log out of SmartPSS and attempt to log in as that new user, I cannot, as it says the username and/or password is incorrect. I have also noticed that there is another user section in SmartPSS called "Users", where I can add users/groups/permissions. I presume this is only affecting the specific instance of SmartPSS on my machine, such as if my machine was the DVR and was a shared machine. Does anyone know how to achieve this?

Films I've seen at the cinema since the start of the year: The Boy And The Heron - Classic Studio Ghibli/Hayao Miyazaki - not as good as some others, but still very good! Poor Things - Very weird and I can totally see why Emma Stone won the Oscar for this - much more deserving than her Oscar for La La Land The Holdovers - Really enjoyed this, a very wholesome and funny film. Paul Giamatti's performance was excellent Argyle - Another fun but rather forgettable film. Quite in line with The Kingsman films in terms of style Wicked Little Letters - Darkly funny and some good performances Dune: Part Two - Took me a while to see it, but very much glad I got to see it in IMAX. Lived up to the hype Kung Fu Panda 4 - Fun, but definitely the worst in the series in my opinion Godzilla x Kong - Fun film, don't expect an award winning movie - just some monsters smashing each other. If you go in knowing what to expect, you'll have a good time. Dan Stevens has a hell of an intro Ghostbusters: Frozen Empire - Not great, totally forgettable I'm going to see it in IMAX tomorrow after work. I've heard good things and the fourth host on the Empire Podcast recommended seeing in IMAX. Conveniently, I received an email from Cineworld saying that Unlimited customers get free uplifts for things like 3D, IMAX, 4DX until April 30th, so I don't have to pay any extra!

I think it would do if I was deploying the policy to a device group, but I don't think the filter works if it filters devices but the assignment is targeting a user group.

Yeah, they show in the list of devices. For those on-site devices, "Managed by" is set as "Co-Managed" and "Compliance" is set to "See ConfigMgr".

We have a mix of on-site (managed by SCCM but also synced in AAD) and off-site student/DFE laptops (managed by Intune only). The restrictions for the laptops were created in a rush during the pandemic and were basically machine only restrictions. I've taken the time to basically re-create our on-site GP settings in Intune, with the settings spread across both computer and user settings. While I'm testing the policies I am noticing that in the reporting of Intune, it shows the user policies as being evaluated and not applied for our users on our on-site devices. While I'm glad they're not being applied (since presumably ConfigMgr is preventing it), it would be nice for Intune to know not to even bother checking on this devices. I have looked at the filter options, where I have deployed the Intune policy to my user group and set the filter option to only our Intune/DFE devices...but they stopped being applied on all devices (no longer appearing in the Device Configuration tab in the device info in Intune). When I removed the filter, they eventually re-applied to the device and re-appeared in Device Configuration. I presume this was an issue because the filter was for devices whereas the policies are applied to users. Ideally, I'd just like to have a user policies that is only evaluated on specific devices. Is this possible?

I had forgotten about NLite, I haven't used it since Windows XP, as it took a while for them to release a version for Vista. To be honest, I haven't used the golden image method of deploying Windows for a very long time now. I find it easier to just use a regular image from VLSC and then made any amendments during the imaging process in SCCM (or MDT if you don't have SCCM). I have SCCM set the timezone, join the domain, install important apps (less important/used apps are pulled after the imaging process is complete, to speed up the process) and I use AppLocker to restrict access to apps instead of ripping them out of the image. I haven't used MDT specifically, only the integration in SCCM, so don't know what it offers in terms of those types of customisations during the imaging process.

Thanks for your reply. I'd seen that in other threads asking the same thing, but it appears that an AP can only be a member of one AP group, which I think would mean that I'd have to choose which APs are broadcasting at 2.4GHz and which are at 5GHz? Also, at least two of our APs are already in other AP groups, so I'd have to choose between the existing configuration or this 2.4GHz option. We also don't have a support contract with Net-Ctrl/Ruckus and the last time one of your team reached out in this way, they said they wouldn't be able to assist because of that.

I've DM'd you.

1. Customercare - Usually pretty good, though it's been leaving a lot to be desired recently 2. Helpdesk (resolution to tickets in a timely fashion) - With the ticket I have open at the moment, dire. I opened it over a month ago and the last update told me someone would be in touch soon, which was about three weeks ago 3. General communication to inform you of any issues, slow performance or downtime with their system (incl. status update page) - Performance/stability has been significantly better than it was. We've come back from at least two breaks without it going down on the first day back. Communication about scheduled updates is also better, though sometimes the warning they can give it only a matter of hours (but generally works are done from 5pm onwards). 4. Rollout of updates - Unsure as they're generally invisible 5. Development ideas - Can use their ideas portal to create and vote on ideas, but not sure if any of them made it into production (may have done).

We'd like to create an IoT SSID that broadcasts on all APs, but doesn't use 5GHz. I can't seem to figure out if it's possible to do this. Looking this up brings up a few threads, including ones on here that @Net-Ctrl have responded to, but I'm still confused. We have the following AP groups: System Default (contains almost all APs) Catering (contains the AP nearest to the canteen - so a specific SSID broadcasts on this AP only) Reception (contains the AP nearest to main reception- so a specific SSID broadcasts on this AP only) We have the following WLAN groups: Default (contains almost all SSIDs, except for Reception and Catering) Catering (contains all SSIDs, except for Reception) Reception (contains all SSIDs, except for Catering) Since we already have some groups created - how can I manage it so that I can broadcast an SSID everywhere that's only 2.4GHz?

We use Veeam Community Edition to back up our technician workstations and a physical DC. We also use the paid version of Veeam B&R for our VMs, though they are managed on two different servers and the backup files are on the same repository.

Sorry, I went all out on that post. Syncing and applying things is where I'm not sure on. I know there is a "PushLaunch" scheduled task under Task Scheduler Library > Microsoft > Windows > EnterpriseMgmt > GUID > PushLaunch, but I don't know when it runs or what the triggers are. Supposedly, you can run this manually to force a sync (or use this Powershell command: Get-ScheduledTask -TaskName "PushLaunch" | Start-ScheduledTask However, I can't tell if it's working and syncing. The machine I'm testing with isn't reporting into Intune according to the Intune console, so I might be dealing with another issue too.

Microsoft have introduced ADMX support into Intune and from my (so far short and limited) testing, it works fairly well and organised almost identically to your on-site GPOs. You can sort of thing of your on-site OUs as Intune's groups, where you can create a group containing devices and another containing users. You configure your Intune profiles as required and assign them to the necessary groups. You can access these ADMX settings in Intune > Devices > Windows > Configuration Policies > Create > New Policy > Platform: Windows 10 and later > Profile type: Settings Catalog Settings Catalog is the new ADMX templates and Templates are the older/original Intune style ones. There is also an option to import existing on-site ADMX policies into Intune, but I decided against that, there are a number that are configured for on-site resources and a lot of old and probably no longer required settings from previous versions of Windows. I decided to spend the time and go through each category in the Settings Catalog and apply as necessary. In terms of how does Intune communicate with the device - it's a bit whimsical. The device uses the "intunemanagementextension" application/service to communicate, pull settings/apps, etc. However, there's no ability to see what it's doing or any meaningful logs. You can push the Company Portal app to manually sync, get your published apps, etc...but I've found it's unreliable at deploying/installing on clients. As I'm still in the testing phase of these ADMX templates, I have created some test groups: All Workstations - Has a policy that includes Computer Configuration settings I want all machines to have assigned to it Staff Workstations - Has a policy that includes Computer Configuration settings I want staff machines to have assigned to it Student Workstations - Has a policy that includes Computer Configuration settings I want all student machines to have assigned to it All Users - Has a policy that includes Computer User settings I want all users to have assigned to it All Staff Users - Has a policy that includes User Configuration settings I want all staff to have assigned to it All Student Users - Has a policy that includes User Configuration settings I want all students to have assigned to it

Oh ok, I guess it shows how long it's been since I've looked into VMware licensing! Apologies.

From what I can gather, Standard is only licensed for 1 server with 1 CPU. If you have more than that, you'll need Essentials or Essentials Plus, which is up to 6 CPUs/3 hosts I believe. https://communities.vmware.com/t5/vSphere-Upgrade-Install/Standard-vs-Essentials/td-p/2897248. I don't think Standard or Essentials does vMotion, High Availability, vShield Endpoint, vSphere or Replication: https://www.vmware.com/content/dam/digitalmarketing/vmware/en/pdf/vsphere/vmw-flyr-vspherecomparekits-uslet.pdf. For any of those, you'd need Essentials Plus.

You should have an official school policy covering computer and Internet usage in place that the students and parents are aware of. We no longer require users to sign AUPs, though we do have a pre-login message users must dismiss which outlines the basics of the policy, configured via Group Policy. I believe all parents are issued with the computer/Internet policy as part of the onboarding process and we also run an induction for new year 7 students (but not any in-year admissions), where we specifically outline that everything is monitored and stored. We use Sophos for our firewall/filtering, Impero for classroom management/monitoring and Smoothwall Monitor, also for monitoring (but it's not monitored by us, but by Smoothwall externally).