sparkeh

Oh yeah! But it seems slightly different for me to the video I posted earlier in the thread. Now when looking at marksheet templates the interface only jumps once. Then doesn't do it again!?

I don't think that there is any 'right' answer but personally I prefer to keep AD simple and use Security Groups to filter things like GPOs. I find that the actual structure of AD is rarely important these days.

Thanks, that's something to think about. However, after doing some reading it seems that when a DA client connects it doesn't contact DHCP to get its address, meaning that I could distribute the WPAD settings via DHCP rather than DNS (as currently) so remote clients shouldn't get the WPAD settings.... i think

For a long time we have used WPAD to simplify teachers moving their laptops between home and school and its worked very well. However, we are now implementing DirectAccess and its become apparent that when machines connect at home, they pick up the WPAD settings and all Internet traffic is routed through our gateway/filter/firewall (which we don't want to do). I can't really think of a way to stop this so wondered if anyone had any ideas? If not, how do others deal with proxy settings when moving between home and school?

Talk to Kate @Millgate she is the best licensing person I've ever dealt with, she'll work out your best option

Actually it's once a week https://technet.microsoft.com/en-us/library/ff793434.aspx

Both Windows and Office needs to check in every 180 days. If it goes beyond this then they have get a 30 day grace period with notifications to the user. If they go beyond this then they enter Reduced Functionality mode. There's no problem taking a machine home as long as they check in every 180 days.

DirectAccess is probably the most awesome thing that I have ever setup. However, there were a few gotchas with using a server behind a NAT that needed a bit or research, so below are the steps I took to a successful deployment, hope that they help someone. The setup The DA server is running on Server 2012r2 (non DC). It is behind a Smoothwall UTM so NAT is involved (although supported by DA in Server 2012R2 is complicated things a bit). The client I tested is running Windows 10 Education (Windows 8.1 Enterprise should work as well, Windows 7 Enterprise needs extra config not detailed here). I have an external IP with a public URL of da.<school>.<local authority>.sch.uk The Smoothwall UTM has a port forwarding rule to forward all traffic from our public IP on port 443 to DA server’s local IP. The steps: Create AD Security Group for machines that are allowed to use DA. Install DA role on server: Choose “Remote Access” role -> “Direct Access and VPN (RAS)” and accept the extra bits it wants to install. Reboot. [*]Configure initial DA settings: Run “Remote Access Management” from the Start Menu. Run the getting started wizard. Click “Deploy DirectAccess only”. Choose the “Behind a Edge device (with a single network adapter) topology. Enter your public URL (important: I found you must you the public URL, even though it says you can use the IPv4 address it doesn’t work in this setup (plenty of discussion on the net about this)). Exit the wizard. [*]Configure client settings: On the setup screen, go to “Step 1 - Remote Clients” and click “Edit”. Check “Deploy full DirectAccess for client access and remote management” and click next. Remove the default group and add in your DA security group. Uncheck “Enable DirectAccess for mobile computers only”. If you want to force all remote clients to tunnel through your network for Internet access then check “Use force tunnelling” (though I doubt you will do this). Click next. Here you need to add a highly available machine that clients can attempt to ping (I use our Smoothwall box) – there should also be DA webprobe added automatically, leave this alone. I checked “Allow DirectAccess clients to use local name resolution” – I think that this is a good idea… Click finish. [*]Configure DA server settings: On the setup screen, go to “Step 2 - Remote Access Server” and click “Edit” Check the settings on this screen and click next. Check the NIC is selected. Check to use a self signed certificate (unless you want to create an upload a proper cert). Click next. Choose your authentication method. Click finish. [*]Configure Infrastructure settings: On the setup screen, go to “Step 4 – Infrastructure Servers” and click “Edit” Ok so a note here. I am not clear exactly what a Network Location Server is, nor, apparently, do a lot of people who set this up. I plumped with using the DA server itself which a self-signed certificate which seems to work fine. Click next. Ok another odd one here. On this screen you have to add in a DNS server on your local network. So I did, and it failed miserably. Next I took the option of allowing the setup to detect a DNS server and it came up with the DA server. Its not a DNS server but it worked. Go figure. Click next. Add in your domain suffix. Click next. Next you can add in any management servers. I added in our SCCM server but truth be told, I am not 100% on this option. Click finish. [*]On the setup screen, go to “Step 4 – Application Servers” and click “Edit” I clicked to not extend but alter to our environment. [*]Apply the settings: On the setup screen, click at the bottom of the screen to apply settings. You should now see that lots of whizzy things are happening, including: [*]Check the settings apply correctly: Click on the Dashboard link You will probably see that things are still being setup. The DA server needs to retrieve and apply the DA server GPO from a DC. This can take up to 15 mins. When applied you should see lovely green ticks next to all the checks. Once your DA clients have picked up the new DA policy you should be able to take the machine outside of your network and it will connect! Something to be aware of: It seems that a lot of people report that the DNS entries that the setup process creates are deleted during a scavenging cycle. Therefore I altered the following records to not be deleted when they are stale: directaccess-corpConnectivityHost (both IPv4 and IPv6 records) DirectAccess-NLS (both IPv4 and IPv6 records) directaccess-WebProbeHost Good luck! And post in the forums if you have problems and I’ll see if I can help J New GPOs for DA server and Clients applied to domain (but filtered to the DA server and clients in the DA group) DNS entries.

Yeah I had something similar. For me it was that it couldn't connect through our Smoothwall without making an authentication exception.

Yeah working here. What exact bit does it fail at? I had to do a bit of tinkering to get it to work too. Also some discussion here: http://www.edugeek.net/forums/how-do-you-do/162160-office365-dirsync.html

The @VeryPC Thinbooks have gone down very well here (a higher spec one for the Head natch!). The custom branding makes then work twice as fast!

Me too, it's great. The AD find and replace is extremely handy too.

Yeah sorry it just popped into my head that there are issues using the old DirSync rather than AD connect. Funnily enough I can't run the Synchronisation Service Manager, says the service is not running!? Though we have a scheduled task enabled to sync every night.

...wait...just to check, are you using DirSync or Azure AD Connect?

Sorry probably being dumb but where am I looking? I can't see anything about disconnectors. When I run the sync is does both, i.e. it runs a sync for {domain}.onmicrosoft.com and then for {internal domain}.

Hmm after syncing our accounts can log in with their network login + password...

Ok got it synced, did a full sync and it synced users and groups. However some of the groups seems to be a bit messed up with object not found errors. Scratch that, I hadn't waited for the sync to finish. :S

Just doing this myself There doesn't appear to be an option to add Azure AD as a subscription like the Student and Faculty Exchange options. Though I currently have Azure Rights Management as a trial. I hazard a guess that when the trial ends we will be able to continue to use it as its one of the things thats free to education customers? Also can I just clarify, changing users UPN from the internal domain to our external domain doesn't have any consequences for users?

This is a good guide on getting SCEP up and running: using SCCM 2012 in a LAB - Part 5. Enable the Endpoint Protection Role and configure Endpoint Protection settings - Configuration Manager 2012 - www.windows-noob.com Though if you don't already have SCCM running then I would work through the previous guides linked in the first post on that link. Note: if you are running Windows 10 then you need to have Defender running and deploy updates for Defender rather than Forefront.

The wife liked the socks so much they are now hers!!

Have you installed the Microsoft Office 2016 Volume License Pack? https://www.microsoft.com/en-us/download/details.aspx?id=49164

I believe that file are autocorrect customisations. Are you aware of making any customisations to autocorrect?

We use SCCM/SCEP and found it very good. With Windows 10 it just pushes out a layer to sit on top the inbuilt Defender so no client as such to deploy. Works very well. Before that we used Sophos which was ok but had a fair few niggly issues which made running it a bit of a chore. In the past I have use Symantec but really did not get on at all well with it, but can't comment on current version.

And the prequel: [h=2]"whya did star wars episodes 4,and 6 comein before episodes 1,and 3? because in charge of production yoda was."[/h]

Seriously inappropriate advert, here's the URL (can't post image - do not click link in work! :S ) http://www.googleadservices.com/pagead/aclk?sa=L&ai=C7ZiNna5NVrGUF4zUWsCElsgIgu752Af6k4OS_AGSq-LMLRABIOfN4RFgu6atg9AKoAG-xpTdA8gBAqkC3R2qLNdwQT6oAwHIA8EEqgShAU_QI8d3S70neSWpuxZS2MeoqXFZGl1duvV6eorDRdVZC7MtAMoZt03cQ2LQfR4yrZskXllU6cK6u62ryFJ2MwJOjLHOR8JrUPSsmVpQR6bxtJcV2FcWnH_vruDQhuKdKemHWq98Jgfvn0etl6oCWHzzQns5ki2STURj7TvYwn4xwXWsG71NJ_YKlja6CFfs_UYPxss_9_8xf4eVOtAoEY85iAYBoAYCgAequesiqAemvhvYBwHYEwg&num=1&cid=5GjdFSLZYesIJWNxMGBe4F0F&sig=AOD64_19PUur1YIB75s529qeeAUqZVx0HQ&client=ca-pub-7039262575895325&nm=1&mb=2&bg=!RkVEsUOaW5KmqGUCAAAAFVIAAAAJCgAk_efL55GVC3pPeAGrxQKp7pZYZGUsU_efBl1GLb5JYdFj_UHCKgEIs6mnP-DhwyFOuhKJBooafnGEmkzjtC34gT_ySnVIB707wIy_r7uBCCnfpeRenItxgPVJSNR0UJOYifcVeqZshB_ZDGK7kCAjlQ_6wOLOSL6MBT-Do4e2qGKF-nszF7IL1-Po9SNShCRnzw5JFyce5lm3CI2JXhNklH7lBJo2cwbvYjxVdj5Rr5EuEA755FXJ25r9IB6cr7X1IBjY4c77Gi34i-wgGCJx7Fov-w0oSUWFn8VhRbcy7AedNEARLDKabmULZVZRBaRU5qMalNrhfIhkY2HJORQaQrF4Ilt1b4ccurmCwihse_qlQkQYiayj_Ais1wwqEjtTX5Wxqgr1HSAXpssJvJIu&adurl=http://www.papy.co.jp/cnt/%3Fac%3Da-r237c9c9-319276-520740-30025001f1f35%26pg%3D/renta/sc/frm/page/topics/re_google5.htm%253Ftid%253D319276-520740%2526rbc%253d1002