CHiLL

We have ADFS configured, which has SSO enabled and works for users, logged into Windows 8.1/Windows 10 computers using Internet Explorer. We found that when using the default Microsoft login page for Office 365, after the user has entered their email address and clicks into the password field...it would redirect the page to their 'organisation's sign-in page' (which is actually the on-site ADFS server). To cut out this step (as it confused and annoyed a lot of people), we simply changed the shortcut to point to the ADFS server, albeit with a very specific URL which was: https://outlook.office.com/.

Thanks for the replies, though thanks to the borked VLAN implementation by our contractor and no possibility of backing from management to pay for the IPT system to be reconfired (makes sense as it is working...don't fix something that isn't broken)...looks like we're sticking with the way it is!

I have just done a little Googling of this and I too would like some more info. I'm not sure how it works with AD, I can't imagine it replacing it, as a lot of schools have already incorporated AD and Azure/Office 365. According to Microsoft's info vid about Intune for Education there are '150' settings/restrictions that can be enabled, such as the camera. I don't think it will replace GPO, so I'd be keeping my GPOs in place for drive mappings, etc. We have SCCM implemented to deploy operating systems, Windows updates and applications. SCCM has an 'Intune' section, though it isn't 'Intune for Eduaction'. I can't seem to find any information on whether I should be using the standalone Intune for Education, or use it in SCCM. The pros of the standalone appear to be that you don't need to pay for SCCM and SQL licenses to use it...but we are already paying them. So I'm still unsure which to use.

I'm far too late to amend the original post, but I'm going to add a more detailed description of the issue: Back in summer 2015, we had a third party contractor replace our wired and wireless networks, server infrastructure and a bunch of other things. Included in this was redesigning the network from scratch. Our old network was on the 10.122.xxx.xxx IP range. Our new network is on the 10.22.xxx.xxx IP range. There is now nothing on 10.122.xxx.xxx, except for our IPT phone system, which has a controller on a static IP of 10.122.40.10, along with access points for the phones, also with static IP addresses in that range. However, the IPT system is not owned or controlled by us, it is leased and supported by a contractor, who charge for callouts. Our main VLAN is 10.22.100.0/22 - however I cannot ping 10.122.40.10. The contractor who upgraded our network created 'VLAN 40' on 10.22.40.0/24, with DHCP disabled (by design - as it causes major issues with our phone access points when it is enabled). I have Port 4 on an edge switch untagged on VLAN 40. When I connect a laptop and set a static IP address of 10.122.40.50 (yes, that is 10.122.xxx.xxx - not 10.22.xxx.xxx), I can ping 10.122.40.10 and connect to its web interface. My problem is that I do not always have physical access to that switch, as the cab is in a meeting room. Is it possible for me to access that web interface from any machine on VLAN 100? If so, how would I go about getting it to work? Edit: Upon checking the switch, it is true that port 4 of the edge switch is on VLAN, however I cannot determine the IP address range of that VLAN...I'm not sure how. I can ping 10.22.40.1 from my own workstation on VLAN 100, so it appears that VLAN 40 is configured as designed by the contractor. I just don't understand how a device on VLAN 40 is configured with 10.122.xxx.xxx instead of 10.22.xxx.xxx and still work. Some steps that I have done: 1) Connected laptop to P4 on the edge switch. Configured the following IPV4 information: Static IP: 10.122.40.50 Subnet: 255.255.0.0 Default Gateway: 10.122.40.1 I can successfully ping and connect to the IPT controller. Note: The Ethernet controller displayed in 'Network Connections' shows this network as an 'Unrecognized network'. 2) Connected the same laptop to the same P4 on the same edge switch and configured the following IPV4 information: Static IP: 10.22.40.50 Subnet: 255.255.0.0 Default Gateway: 10.22.40.1 I cannot ping or connect to the IPT controller. Note: The Ethernet controller displayed in 'Network Connections' shows this network as recognized and shows our domain name.

Thanks for the info, though I'm not exactly sure how to go about that on out HP ProCurve switches.

A couple of years ago, we had our network upgraded by a third party. During that, we moved from a 10.122.xxx.xxx IP convention to 10.22.xxx.xxx, now utilising VLANs. Our third party set up a VLAN specifically for the IPT system, which was VLAN 40 with an IP range of 10.22.40.0/24. However the provider of the IPT did not (and will not) switch the IP convention to the new one. So it is still running on the old VLAN 40, with an IP address range of 10.122.40.xxx. Our third party created some form of routing, so that any device on the new VLAN 40 was able to access the IP ranges 10.122.40.xxx. Now, we have been advised by the IPT engineers that we can perform some changes ourselves, such as handset renaming/renumbering and save the call out cost. We just need to access the IPT controller, on 10.122.40.10. The only VLAN that can do it is VLAN 40, and I don't want to have to connect to a specific port which is configured only on VLAN 40 at the moment (plus access to the switch is limited, due to the room being in use). Nor do I want to change port VLANs on other switches if I can help it. Ideally, I would like to browse from my own VLAN (10.22.100.xxx) to the IP address of the IPT controller (10.122.40.10). Is this possible?

Assuming the printer is on a print server: 1) Open Print Management 2) Right click the printer in question 3) Select 'Set Printer Defaults' 4) Set your options accordingly This will set the default settings for all users who have this printer added. As for the VBScript, it is most likely a logon script, either defined in AD or in Group Policy. You can check the following: For AD: 1) Find the user who is having the printer added via VBScript. 2) Select the 'Profile' tab 3) Check the 'Logon Script' field 3a) If this field has an entry, then the script will be located within your NETLOGON folder. You can browse to it and find the script to inspect it. For GPO: 1) Open Group Policy Management, either on a DC or a machine with RSAT. 2) Right click 'Group Policy Results' 3) Select 'Group Policy Results Wizard' 4) Go through the wizard and select 'Another Computer' 5) Press 'Browse' to use AD to find a computer that a user is getting the printers added via VBScript (the machine must be powered on at this point) 6) Press 'Next' 7) Select the user in question from the list of users 8) Press 'Next' 9) Press 'Next' 10) Press 'Finish' 11) The generated report will appear below 'Group Policy Results' and may take a short while to populate the info. 12) Within the results, select the details tab and you will see all group policies that are hitting that machine and user.

I'd like some clarification from other people on where I stand on this before I decide how escalate the issue. We have a large number of Ergo Hybrid Windows tablets that have been bought in batches over the years, with our most recent batch being bought around November 2016. The magnetic keyboards have a nasty habit of breaking, where magnetic strip fails and detaches from the case, rendering the keyboard useless. This has been an issue since the first batch we bought a few years ago and those that have failed whilst within their one year warranty period have been replaced without issue. This was arranged after Ergo admitted that the keyboards were not up to the job in an educational environment, which the device was marketed for. Ergo have now discontinued this product, along with it's supplies and spares. We have had another keyboard fail from our latest batch (and I can see several more failing before the warranty period is over) and Ergo are refusing to source a new replacement keyboard. The best they will offer is 'a graded unit that is in working order but does have some wear and tear'. I'm getting the impression that this is the only one they have, so I'm not sure what will happen if they no longer have it, and I don't want to go down the self-repair route until this matter has been resolved. Where do I stand on this, regarding warranty replacement? Any advice would be appreciated.

Thanks for that, however I'm having trouble incorporating that into VB. We are basically using Visual Studio 2017 to create a form that contains a drop down list containing: Year 7, Year 8, Year 9 and Year 10. Each selected drop down would then display another list box, listing all the students in that year. Obviously the students move up years, but the intake year remains the same. Ideally I'd like to not have to revisit the script each year if possible. If I can get the basic script sorted, I can incorporate it into the project. Edit: Using the calculation you posted, how would it change for other year groups?

A number of years ago, I used to work with a guy who had a VBScript that automatically calculated that a Year 7 pupil's intake was 2016, a Year 8 pupil's intake was 2015, and so on. I'm sure that the maths worked so that he did not need to change the script each year as the calculations just worked...but I can't remember or figure out how the maths worked. Does anyone have any ideas?

I've managed to get it sorted using Powershell and Group Policy Startup Scripts. This has only been tested on Windows 8.1 at this point. The commands I used: $monitor = Get-WmiObject -ns root/wmi -class wmiMonitorBrightNessMethods $monitor.WmiSetBrightness(100,100) #First number is the brightness percentage level for when the device is plugged in, second number is for when it is on battery I used Group Policy with this setting: Computer Computer Configuration > Policies > Windows Settings > Scripts > Startup > Powershell Scripts Add the script into the directory and in 'Script Parameters': -ExecutionPolicy Bypass It may take several seconds (around 10 on our small detachable Windows tablets) for the script to be processed. Note:This only appears to work on certain device types with adjustable brightness displays for power saving, such as laptops and tablets.

We noticed it late on Monday afternoon.

This got a little derailed whilst I was battling a domain time synchronisation issue. Now that is sorted, I'll give it a go. Been here for around 5 years, though Selly Oak is full of students, I think the stats were that around 50% of the population are university students, mainly for the UoB. I'm hopefully moving to Harborne soon, which is a nice area. Since the weather it nice, I might take a drive over to the Wyre Forest and have a nice day out.

Appears as though we've sussed it. It appears that DC1 was not synchronising with DC2, but instead synchronising with it's internal CMOS clock. This would explain the time drift as DC1 is a separate physical server, compared to DC2 which is a virtual. By running these commands on DC1, it was able to synchronise with DC2: w32tm /config /syncfromflags:domhier /reliable:no /update net stop w32time net start w32time w32tm.exe /resync W32TM /query /status As for the other servers and workstations - it appears that they will receive their time from their logon server, which could be either DC. We just have to tell each DC in the domain to inherit the time from the PDCe using the commands above. The important thing is that DC1 and DC2 are syncing correctly.

Filtering the event log for that type on DC1, it has reported the following today: 14:03:25 - Information - Event 139 - The time service has started advertising as a time source. 14:03:09 - Warning - Event 142 - The time service has stopped advertising as a time source because the local clock is not synchronized. 14:03:09 - Information - Event 35 - The time service is now synchronizing the system time with the time source DC2.SJW.Internal (ntp.d|0.0.0.0:123->10.22.11.12:123). 14:03:09 - Information - Event 139 - The time service has started advertising as a time source. 14:02:40 - Information - Event 37 - The time provider NtpClient is currently receiving valid time data from DC2.SJW.Internal (ntp.d|0.0.0.0:123->10.22.11.12:123). There are no entries for yesterday, in fact nothing until back on 12/05/2017 and earlier, where the error was: Warning - Event 129 - NtpClient was unable to set a domain peer to use as a time source because of discovery error. NtpClient will try again in 15 minutes and double the reattempt interval thereafter. The error was: The entry is not found. (0x800706E1)

DHCP only has open 006. 066 and 067 enabled. 004 and 042 are unchecked. We use SCCM to image our machines.

I have just ran one against our SIMS server (which is reporting DC1 as the NTP server) and there are no references to any time settings. I have just ran another against one of our pupil workstations and there are no references to any time settings.

We have had time issues a while back and had a third party confirmed that our setup was not 'best practice'. They managed to correct the time syncronisation issue however we could not at the time meet the best practice, which was defined as having one source, such as our HP core switch configured to connect to the external NTP server (such as 0.uk.pool.ntp.org) and all other devices syncronising with that. Device / Computer / Client / Server / None PDC > PDC > Core Switch > 0.uk.pool.ntp.org However we have had some more time issues where our non-PDC domain controller was out of sync this week and I am finding that our servers are still pointing to our non PDC domain controller. I checked this by running this command: w32tm /query /source I have followed best practice and set our HP core switch SNTP as 0.uk.pool.ntp.org and pointed our ESXi hosts and virtual PDC (DC2) to it. As far as I can tell, we have no GPO settings enabled for time syncronisation at all across our site, yet our Server 2012 R2 servers are pointing to DC1, which is a physical (not PDC) server. I have tried: w32tm /resync and net stop w32time w32tm /unregister w32tm /register net start w32time Both with no avail, as the servers still report their time server as DC1. Running this command on the servers: w32tm /query /peers /verbose They are reporting this: C:\Windows\system32>w32tm /query /peers /verbose #Peers: 1 Peer: DC1.SJW.Internal State: Active Time Remaining: 1021.0781418s Mode: 3 (Client) Stratum: 4 (secondary reference - syncd by (S)NTP) PeerPoll Interval: 17 (out of valid range) HostPoll Interval: 10 (1024s) Last Successful Sync Time: 23/05/2017 14:32:59 LastSyncError: 0x00000000 (Succeeded) LastSyncErrorMsgId: 0x00000000 (Succeeded) AuthTypeMsgId: 0x0000009B (NtSignature ) Resolve Attempts: 0 ValidDataCounter: 1 Reachability: 3 Whereas my Windows 10 workstation is returning: C:\Windows\system32>w32tm /query /peers /verbose #Peers: 1 Peer: DC2.SJW.Internal State: Active Time Remaining: 3685.3286835s Mode: 3 (Client) Stratum: 3 (secondary reference - syncd by (S)NTP) PeerPoll Interval: 12 (4096s) HostPoll Interval: 12 (4096s) Last Successful Sync Time: 23/05/2017 14:35:25 LastSyncError: 0x00000000 (Succeeded) LastSyncErrorMsgId: 0x00000000 (Succeeded) AuthTypeMsgId: 0x0000009B (NtSignature ) Resolve Attempts: 0 ValidDataCounter: 8 Reachability: 255 How can I get our servers and any clients that are not currently pointing to DC2 to do so? Ideally without having to run a command on each one individually?

I would also like to know if there will be a recording made available for this webinar, as I too am unavailable at the time of the webinar.

That's a good idea, cheers. I'll give that a go. Originally I'm from Merseyside, though I'm living in Selly Oak area at the moment. Been down to Kidderminster a couple of times - nice area to drive around.

I have found this script on the Internet and set it as a startup script: REM Set Display Brightness Level POWERCFG /SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 7516b95f-f776-4464-8c53-06167f40cc99 aded5e82-b909-4619-9949-f5d71dac0bcb 100 POWERCFG /SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 7516b95f-f776-4464-8c53-06167f40cc99 aded5e82-b909-4619-9949-f5d71dac0bcb 100 REM Set 'Dimmed' Display Brightness Level POWERCFG /SETDCVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 7516b95f-f776-4464-8c53-06167f40cc99 f1fbfde2-a960-4165-9f88-50667911ce96 100 POWERCFG /SETACVALUEINDEX 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c 7516b95f-f776-4464-8c53-06167f40cc99 f1fbfde2-a960-4165-9f88-50667911ce96 100 REM Set Power Scheme As Active POWERCFG /S 8c5e7fda-e8bf-4a96-9a85-a6e23a8c635c Note: This script works specifically for my environment. To get it work in yours, use the following steps: 1) Log onto a machine with the active power plan in place 2) Open a command line and use 'powercfg /q' to get a report of your active power plans 3) The first entry will be your active power plan - copy the GUID and replace the first GUID in the above script with it 4) Scroll through the list until you see a subgroup named '(Display)' - copy the GUID and replace the second GUID in the above script with it 5) Scroll through the list until you see a subgroup named '(Display brightness)' - copy the GUID and replace the third GUID in the above script with it 6) Replace the last line GUID with your active power plan GUID from step 3). It appears to work - however there's a massive delay in when it is applied. I have timed over a 5 minute delay from when the script is manually ran and when the screen brightness changes. One other problem is that it is only being applied once. If after it has been applied the brightness is manually adjusted to the lowest setting and the machine is rebooted - it will remain dull until manually set by the user. I have also tried using Computer Configuration > Preferences > Control Panel Settings > Scheduled Tasks > Immediate Task (At Least Windows 7) and having the script located in SYSVOL...but I can't get it working and it also appears to only be processed once.

We've got a situation where students are using Windows' brightness adjustment to lower the screen brightness to it's lowest where the screen is almost unreadable. The next time the tablet is used, it is extremely difficult to read what's on the screen due to how dark it is. There is no hardware or keyboard shortcut for this, so they are relying on Windows' brightness adjustment setting. Now, I don't want to disable this complete for accessibility reasons and whatnot...but I'd like to get the tablet to boot or log on with a certain brightness level each time it is used. That way the brightness adjustment is not permanent unless adjusted manually. I have found this GPO: Computer Configuration > Policies > Administrative Templates > System > Power Settings > Video and Display Settings > Specify the display dim brightness I can set this, though I don't know if this will just be a one off setting or whether it will re-apply at every boot. Anybody have any ideas?

No idea when this will be made available on VLSC. 1607 took months to become available, whereas 1703 wasn't long after initial release. But it's definitely something that we've been waiting for, for a very long time. This sort of thing could eventually do away with on-site file storage, as long as the mappings work consistently in an enterprise environment.

I just don't understand why Microsoft are so consistently bad at not understanding the education sector. It seems as though they've taken the Apple approach to specs and pricing...premium build quality...higher prices and lesser/older technology under the hood. Also, with prices starting at around the £1000 for a Surface laptop...are they really expecting a school to purchase a class set of these? Especially when they are only going to get damaged either maliciously or accidentally in a classroom. I know I couldn't get this past our bursar and we'd be going for the lesser OEM style devices with lesser specs, but importantly a lower price.

If you're a home user, then via Windows Updates or the Microsoft Upgrade Tool. If you're a business, then via VLSC and your agreement.