CHiLL

I haven't used sysprep or created a golden image in over 10 years now. We are just obtaining the ISO from VLSC and deploying that (or the extracted WIM) straight to the clients and then using things like AppLocker and other GPO/registry settings to restrict access to apps.

We see this sort of behaviour with our fleet of HP Essential USB-C docks, where if we image a device via SCCM using the LAN port in the dock, it's the MAC address of the dock that's registered in SCCM and would therefore not PXE if the task sequence was only deployed to the "Unknown Computers" collection. To get around this I just use the laptop's Ethernet port (which I understand isn't an option for you) but I've also deployed the task sequence to another collection that contains the device. For example, I have a collection called "Workstations - Windows 10", which as it sounds, contains all Windows 10 devices. If I want to deploy Windows 11 to these devices, they won't PXE if the Windows 11 TS is deployed only to the Unknown Computers task sequence. Rather than remembering to delete the device out of SCCM devices, I instead deployed the task sequence to the "Workstations - Windows 10" collection and I am then able to PXE boot and deploy Windows 11. I ensured that the task sequence is only visible to PXE and boot media and we also have a password configured on the DP for PXE.

Probably because they know it's mostly an education market buying the product and we've all seen how educational suppliers price their stock. But yes, £100 is outrageous, hell even £50 is.

We're finding that classic Outlook is being purged from installs or updates to M365 Apps and outlook.exe is not located in "C:\Program Files\Microsoft Office\root\Office16" or anywhere on the system, despite not being marked as an exclusion in the office configuration deployment file. Instead users see Outlook (New), which I think is just a web app. It is possible to manually download and install classic Outlook, though I'm looking at the possibility of making it available via Software Center or Company Portal. Annoyingly, despite it being listed as a store app, I cannot find it in Intune and can't push it that way. I can't seem to find any switches for the downloadable executable either and it installs in full display mode, which isn't ideal. You may also need to set the following int he registry: Key: Computer\HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Preferences Value name: UseNewOutlook Data type: REG_DWORD Value: 0 I'm not a really a user of the advanced features in Outlook, I just generally send/receive and have some rules set up. In regards to the rules in the new version, I have noticed that when rule is manually run, it takes an absolute age. Presumably because it's being processed server side rather than client side, but I'm looking at over 24 hours and it's still not completed.

My dashboard appears to be fine.

I'm probably going to look at deploying 2025 to our less critical servers in the February half term, so hopefully Veaam will have updated B&R by then. I currently get warning emails from Veeam when it's backing my machine, saying 24H2 isn't supported yet, though it appears to be backing up fine. Maybe that's patched in a newer update, but I can wait until February for that too.

Sorry for the necro thread bump, but I was just wondering if anyone had any success with this? I'm testing a shared iPad that requires users to sign in with their Microsoft Entra credentials and would like apps such as Word, Excel, PowerPoint, Outlook, etc to automatically sign them in via SSO using the credentials they authenticated on the iPad with.

Oh ok! Have you tried copying the installer to the local C:\ drive or a subfolder in there? I've noticed some (looking at you Adobe Creative Cloud) that won't install from a network drive and others that won't run from "system folders", including the root of the C:\ drive (looking ay you Intel Arc drivers).

Try granting modify permissions for a test staff user to the folder where the application is installed. I've found that sometimes resolves those sorts of UAC or admin access prompts.

We've been pretty impressed with the Newline range that we've had (3x TT-7521Q and 1x LGA311D2 23QA), they're generally quite a bit cheaper than the BenQ interactive displays that we have and work just as well.

My colleague told me that he'd read somewhere that at least for SharePoint sites syncing in OneDrive, each site should not contain more than 5000 items to maintain performance. As we are in the middle of a slow transition to SharePoint and syncing via the OneDrive client, we have found that when we recreated the staff shared drive caused so many performance issues as the OneDrive client was trying to parse all the items when a user logged in. Instead we are trying to create a site per department/office/role, etc and only giving the necessary people access to the relevant sites. That way it massively limits the amount of files a user needs to sync or at least parse the metadata for. I don't know if that is entirely true or even if it applies in your situation, but it could be food for thought.

I'm currently running v8.6.26 and haven't experienced any of the bugs mentioned here, though I am finding a lot of deployment issues of the client to Windows 11 devices, specifically where Impero will install but the service will not start. I'd estimate about 85%-90% of devices work without issue and the rest encounter this issue. The only solution is to uninstall the Impero client, restart and then install it again (a reboot is necessary, otherwise the service will still not start).

This isn't something I've done before but as I was reading this I was thinking...if it's a VM DC, would adding a new virtual NIC to an existing DC and giving it the IP address of the defunct DC work? Same with a physical DC but using another NIC on the server (if it has one) or installing an additional network card? That way the IP would still be valid. Then again, it's a patch job and I wonder if just having the IP inactive would be the best long term solution and tackling issues as they arise?

I don't have any actual examples, but I think you could devices with USB4, as it's my understanding that a lot of the thunderbolt technology is also included in the new USB4 specification.

Not necessarily. There was a bug introduced into the Windows Recovery Environment earlier this year from a BitLocker patch that affected a large number of end users. Microsoft have stated they will not be issuing a bug fix for and instead provided instructions for a manual workaround, which could be argued is well beyond the average user's capabilities.

Sorry to hijack this thread, but I have a related question. We use Smoothwall Monitor on our desktops and would like to test and push your browser to our iPads, especially for the integration into MyConcern, However, our iPads are all not shared devices (they're just configured with our iPad accounts and restricted via Intune), I want to check to see if your browser can be configured to enforce user's to sign into a Microsoft account before they can access websites. We have been testing Senso's browser for this and it requires the user to sign into their school Microsoft account, which is what we want as it tracks the student's use Internet use. However, it would require us to purchase extra modules in order to utilise the logging and MyConcern integrations, so if we could achieve this within our current Smoothwall license and it operates how we want...that might solve things for us.

This is the command we are using: "thonny-3.3.13.exe" /ALLUSERS /VERYSILENT We did run into an issue that wasn't very well documented regarding using other Python modules within Thonny that are already deployed. We deployed OpenPyXL by pushing it as a pip installation via Python and it installs into Python's directory. However, when trying to access this module using Thonny, it wouldn't detect OpenPyXL, despite is being able to be called from IDLE. It turns out that Thonny comes with it's own integrated version of Python and it uses it's own interpreter, which doesn't have anything to do with regular Python. Instead, while in Thonny, you need to tell it to use the system interpreter from one of the options in the app and you can then import other Python modules as normal.

We are looking into the option of migrating from our legacy on-site domain joined/co-managed Windows devices to purely Intune cloud joined. So far, results have been promising, though I can't figure out what the best way to manage using these devices for exams, be it an online exam or for access arrangements. In our current domain environment, we use normal domain joined Windows laptops and specific user accounts that have a lot of GPO restrictions applied, with the main ones being that the desktop and start menu are redirected to a specific location that only contains apps that can be used and removes all unnecessary apps to help avoid cheating. Usually we have all the icons on the desktop, with all but the one(s) the students need hidden and students cannot show hidden files. We also utilise Impero app restrictions and AppLocker to prevent apps from launching. However, using Intune I don't know if I can have the same redirected desktop/start menu to only show icons that are required. 1) Is it possible to have Intune only users redirect their desktop and start menu or at least specify exactly what is shown? 2) How do I manage something like required exam resources, such as a PDF or Python questions for a Computer Science exam? (This is currently done via a mapped drive that only exam accounts have access to and is read-only) 3) I know Intune can be slow at making changes, so if one exam ends at 10:30 and another that needs a different app starts at 11:00, is that enough time for the changes to be made and then applied when the next exam account requires it at 11:00? Our main requirements are: - Use ExamWritePad, which is running and configured from a local network share - an icon on the desktop would be required for this - Use Word (including spell check) - this is rare but does happen from time to time - Use Pearson Online Platform - Depreciated but may come back - - Use PowerPoint - had our first request for this for an access arrangement student for next week - Use ClaroRead - I don't think anyone uses this anymore, though we are licensed and it's an accessibility thing - Use IDLE for Python for Computer Science exams - File Explorer to access Documents and mapped drives I also don't know how Internet access restrictions would work for a device that requires online authentication. There are other considerations that I haven't fully thought through yet, such as hiding the time because students aren't meant to see that apparently. For the time-being, we are continuing to use on-site domain joined devices as done previously, though this is something I need to look at in the future.

It's always important to remember that RAID is not a backup solution, you should have a separate backup solution regardless. Our production storage (HP MSA) and both our backup solutions are all configured in RAID5 by our configuration partner back in the day (10 years ago). It's been one of those things where it's been pretty much rock solid bar I think three disk failures during that time and no data loss. We were going to look at replacing our MSA and also re-look at our storage and backup requirements, though we have since decided to start migrating to SharePoint and then relook at our backup solution to ensure it will continue to meet our requirements.

We use Inventry for our signing in and out system, mostly for staff, visitors and external pupils. Once the registration bell is rang, the external gates are locked and late pupils must then come through reception to enter the building. Our reception has two sets of doors; external doors and internal doors to the school, to separate the public from the main school. The doors into the main school are not opened for pupils until they have signed in via the Inventry touchscreen, including providing a reason. Anyone attempting to sneak through the doors when they're opened without signing in are caught on CCTV and disciplined appropriately. I don't think this is written back to Bromcom, though it is stored within Inventry and I believe attendance/late marks are provided by the form/class teacher when they get to their room.

We are migrating to Windows 11 and have just reimaged our finance officer's laptop. We've deployed FMS via SOLUS3 as we have always done, though we are receiving the following error message when we try and launch FMS: Exception Exception in module Finance.exe at 0017C525. Stack level exceeded in finfun.p_HandleRedirect. This is very similar to this thread from over 14 years ago, though we have tried the suggestions and still receiving this error. What we've tried: - Deploying from SOLUS - Reinstalling from SOLUS - Uninstalling FMS and manually installing via FMSInst.exe - Added a printer and set it as default - Added another printer and set that as default - Given domain admins and our finance staff full permissions over the C:\Program Files\SIMS folder. - Copied FMSConnect.ini and ensured it is correct - Copying the FMS directory from the finance officer's desktop, which works with FMS (Windows 10) At this point we are thinking it's a Windows 11 issue, but I'm not seeing anything related to FMS compatibility issues in Windows 11. We can raise a case with SIPS, our support - I was just hoping to get it resolved without that.

During the pandemic we received a bunch of Vodafone 4G SIM cards with TP-Link 7200 dongles, however the member of staff who managed it has long since left and nobody knows where exactly they came from (council, DFE, etc). The SIM cards were dormant until activated and once activated, they provided a rolling 20GB monthly data limit and it was active for 12 months. After 12 months, they would stop working. It appears that the spare SIM cards we have are no longer able to be activated and we're receiving requests for students that do not have Internet at home. I can't seem to source a similar deal, as I'm either getting consumer SIM only deals or ones that convert to PayG after a 6 month period for example. Can anyone help point me in the right direction to source these types of SIM cards?

Not really and I don't see the need to consider MECM for updates if you're already using WufB, it would just add extra complication and unnecessary storage requirements on your end. MECM will get updates directly from Microsoft, but by the way of WSUS and the configuration specified in MECM and store them on the server. However, clients will be pulling updates from the MECM server, rather than pulling from Microsoft online servers directly. The simplified way at looking at the way MECM uses WSUS is that you create software update groups for each product and specify the updates, which then creates a deployment package and deployed to clients. You would also create automatic update rules, which you configure to sync on a schedule (such as patch Tuesday) and it will pull any updates as defined in the rule and add them into the existing deployment package. You don't interact with WSUS at all, you just install the role and don't even configure it! MECM manages WSUS entirely itself.

Most SCCM guides are still appliable, despite it now being badged as MECM, as long as you aren't seeing screenshots for Server 2012 R2, you'll probably be fine for the most part. The best sites to use as reference are: https://www.prajwaldesai.com/ https://www.systemcenterdudes.com/ https://www.anoopcnair.com/ Those sites have guides ranging from entry/basic to advanced configurations and have been a life saver for me over the years. For Windows Updates and your workstations, you could consider moving to WufB via Intune, if you are licensed for Intune that is. Earlier this year, we started properly testing Windows 11 and I also decided to utilise WufB for these, so I created a pilot ring and told MECM to use Intune for the update workload instead of itself. As my Windows 11 deployment grows bigger, as does my pilot ring and it will eventually become my production ring. However, I haven't even looked at how to manage server updates, so you may well need MECM and WSUS for those. I'd probably look at starting off small; focus on OS deployment, client settings and updates as a priority. Once you have that up and running, then you can look at extra things, such as application deployment, Office/Edge deployment/updates and configuration baselines. My main bugbear with MECM is how difficult it can be to fix/troubleshoot. The logs are usually pretty good and you should definitely utilise CMTrace (not even just for MECM - it's great for any logs), but sometimes it can lead you down the wrong path. For example, connectivity issues might occur because one of the certificates has expired and it doesn't tell you, so I'd recommend setting reminders to renew certificates in 12/24 months.

This isn't something I've done as we're still on A1, though it's something we're planning on upgrading to (A3). It's my understanding that users would only need A3, as A3 is effectively A1+extras, so all A1 features are also included.