mrbios

Cornetto at number 8!? Pah, heathens made this list!

Thanks I was racking my brains earlier trying to work out what i was doing wrong. With office 365 I just have an additional cloud account in case of any outages, my mistake was assuming Google would do things the same way....would have preferred it if they did, but i can understand why they don't.

So I've not really used G Suite yet, but I'm playing around with it so that i can do some chromebook testing.... I've got it linked to my Azure AD, all users exist. I've setup it up to do SSO, that works perfectly. However, if i assign a user admin privilages within G suite, is it correct that SSO for that account is then disabled? I setup G Suite with an email alias i never use, i can log in and out of that one using regular google credentials, but as soon as i change an account that is linked to my organisation to have any admin privilages at all, it no longer does the ADFS redirect and instead asks me for a google password...and fails to login with the usual password (presumably i would then be required to set one by going through "forgotten my password...") So is this normal behaviour?

I agree with this. On the flipside though I'm also concerned about the use of things like ipads because you're learning within an "app" you're not learning to type on a proper keyboard, or using programs you would be using in the real world. I feel like app based learning is perfect for primary education, but i have my concerns (and these are personal, as a parent, rather than anything that would go into the decision of what path we go down here...where i hold little sway besides my technical grumbles anyway) that app based learning isn't the great teaching tool it's made out to be. If anything, i think for something a student will eventually own, something that will be useful in every class and follow on that usefulness through to university...laptops are still the perfect fit. Obviously there's a whole host of issues behind those being 1:1 though not to mention the portability of them. They're also considered old fashioned now. Maybe I'm old fashioned in my thinking there, maybe I'm wrong. Like someone said earlier in the thread though...there's no real proof yet that having a device like an iPad actually increases learning potential.

In terms of iPads, what happens if a parent opts out due to them already owning one, and them wanting to use that? Can you just take the serial number, add it to DEP and then release it once they're done at the school? Presumably if you had the parents sign something so that they understood the consequences of using their own device that would be possible, as long as outside of school hours it could still operate as a personal device?

Do you find this the case because the school own the devices? If parents paid and owned them fully at the end of a students time at the school, I'm guessing obsolescence wouldn't be an issue? As 5 years will be the oldest they'll ever be? Which springs up another question....6th form. The leasing arrangements with parents paying and owning the device at the end, I've seen as a Y7-Y11 thing, 5 years is a fairly typical lifespan for a device, so would we just expect the 6th formers to bring their device back to use for those two years, or the school own devices for them, or something else? Then you've got 6th formers that start here from other schools etc. So many more questions keep springing up the further i look down this rabbit hole.

Thanks, sounds like i'd need to get a chromebook and have a play to see what the possibilities are.

I do like the idea of chromebooks, however having ourselves quite firmly engrained in Office 365, is there any drawbacks to us not using G suite? Can they work as/or nearly as seamlessly with Office 365? What's the management like?

I ask the question as I'm bound to be asked at some point. Whether it's something that's in place as a permanent thing, or as a partially allowed thing, or a case of phasing out printing gradually. It's not my position to decide that printing will or will not be available on them, senior management will make that choice. The IT side of the curriculum have already moved 90% paperless, we're trying to persuade others to do the same, but i can't guarantee that will happen from the offset. EDIT: also iPads aren't nessecarily the way we're going. We don't know yet. Parents pay, kids take them home at night, bring them in on school days, locked down settings during school hours. Kids own the device when their time at the school ends (assuming their parents paid the full amount). Senior management is only looking to use them as an additional learning tool, rather than a replacement to the way things are done now, so I'm told.

Interesting list! How do you all deal with printing? Can you separate which printers they can see depending on where the students are in the school? How do you have your wireless setup in terms of DHCP/vlans to cope with the quantity of devices? Do you segregate your site to keep vlans down to a minimum size at all for the wireless? Presumably if i had 1200-1500 devices connecting one massive vlan isn't going to look too pretty! I must admit, a lot of the issues you have appear to be down to the way your school has allowed them to basically be 100% personal devices? The way i've been told about it being done is that the school still have control until the student leaves, making MDM a requirement, restrictions a requirement, set app restrictions when in school etc.

I've got my logon screen background setting reliably....so long as you're happy to set an image and keep it at that permanently with no intention of changing I've got two scripts in my sccm task sequence. One which replaces the img100.jpg default image, then another which clears out the S-1-5-18 folder. Windows by default then takes the default windows\web\screen\img100.jpg. Not a solution by any means, but enough of a workaround to keep me happy. Only very basic batch scripts: TAKEOWN /F C:\Windows\Web\Screen /R ICACLS C:\Windows\Web\Screen /grant:r Administrators:F /T ICACLS C:\Windows\Web\Screen /setowner Administrators /T DEL /F /Q C:\Windows\Web\Screen\*.* COPY /Y "\\sccm\sources\Applications\Windows 10 1703 Lock screen settings\Lockscreen1.jpg" "C:\Windows\Web\Screen\img100.jpg" and rem ------ loosen permissions on a single folder in the path where the cached images are kept takeown /F C:\ProgramData\Microsoft\Windows\SystemData icacls C:\ProgramData\Microsoft\Windows\SystemData /grant:r %UserName%:F icacls C:\ProgramData\Microsoft\Windows\SystemData /grant:r Administrators:F icacls C:\ProgramData\Microsoft\Windows\SystemData /setowner Administrators rem ------ loosen permissions on the sub-folders where the cached images are kept takeown /F C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18 /R /D Y icacls C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18 /grant:r %UserName%:(OI)(CI)F icacls C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18 /grant:r Administrators:(OI)(CI)F icacls C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18 /grant:r SYSTEM:(OI)(CI)F icacls C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\* /inheritance:e /T icacls C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18 /setowner Administrators /T del /Q C:\ProgramData\Microsoft\Windows\SystemData\S-1-5-18\ReadOnly\LockScreen* Can't remember where i got them to give credit...

Students Mandatory Staff local No appdata redirect on either, everything else is redirected. I tend to avoid roaming profiles like the plague since the late XP days, more hassle than they're worth most of the time it seems. Although I'm guessing some of you are having good success with them going by the poll.

This area won't be my responsibility thankfully. The school my SLT went to see were doing their 1:1 solution through BELF, and they quite liked the positive feedback they received about it, and the way in which it was managed, so it looks likely that's where we might be heading too, but as i say, that's nothing to do with me (thankfully).

The school some of my senior management visited recently were able to lock them down only when on the school wireless, then when the kids went home and connected them to their own wireless they got their own apps back and were able to do whatever they want. I don't know what happens when they leave the school, presumably the device resets to factory defaults and is removed from DEP or something... I assumed the setting Brimstone mentioned was able to detect if it was a hotspot or a proper wifi network?

Thank you, didn't realise you could lock them out of 3G networks. That sounds brilliant. Do you know if that can be done with chromebooks and microsoft devices (intune?)? We're looking at parents paying, so they would own the device at the end of the lease term (as i understand it) No idea on which devices yet. A lot more meetings to be had on that front. I personally like the idea of Surfaces and managing them with intune for education.....but that's the most expensive solution that's probably out of financial capability for a lot of parents in this area. I'm guessing it's also the least "tried and tested" option as i don't know of anyone that's gone down that path yet.

I'm looking for some people here who are currently managing 1:1 device solutions. I did try searching but my searchfu was bad today or there aren't many threads answering my questions... A few general questions really: What sort of issues did you face initially from a technical point of view? Did you find your schools internet connection up to the task of handling the traffic from all the additional devices? What devices did you go for, and what made you choose them over the other options? What reasons would you give towards choosing one over another? How much work has it been for you from an implementation and on going maintenance side of things? Do you find many issues with kids hopping on their own 3G with their devices to get around filtering? (an issue that can be present regardless of whether being 1:1, but i imagine it would be more prevalent in a 1:1 scenario?) We had a new wireless system put in last year, it currently provides 100% coverage to the school, however it's not designed in its current implementation to cope with a 1:1 solution, we would no doubt need another 10+ APs for that. This naturally varies greatly depending on the capability of the APs, but would you say 60 devices to an AP would be a decent limit for a 1:1 solution? I'm after a lot of general information like that really. We're in the VERY early stages of considering a solution, no focus on specific devices yet. I had more questions that i keep musing over as the days go by but i keep forgetting them, so i'll no doubt add to this.

Went through this whole process last year myself, 8 months of planning, testing and comparing (and a full site survey). Ended up going for Aerohive, and a fantastic decision it was. We compared them to Aruba, Ruckus and Meraki at the time. I've had two minor problems so far, on both occasions i sent off an email, and someone at the other end had it fixed within an hour....on neither occasion was i required to do anything. The joy of cloud controllers and good support. Probably going to need to add some more APs soon now that the school are considering a 1:1 solution, another 10-20 in addition to our current 49. Adding them is as simple as can be though. We started off looking at the 3 i mention above, and didn't look at Aerohive until later in the process, and they honestly took all the positives we had noted of those 3, without any of the negatives we had highlighted.

Spent a few days on this now and I'm down to my last two issues (for now...that i know of...) First of all, no matter who logs in, if you don't touch the machine for 2-3 minutes, it automatically locks. Same policies as 1607, but that doesn't happen on 1607. I can't seem to find the policies that control this, if any. All power management settings are set, most of which restrict sleep/hibernation etc (it doesn't do those things, it just locks the computer and shows the lock screen) Second problem, not so much of a problem as such but an irritation. After imaging a machine with 1703 from scratch, on first logon i get a screen that says network at the top, and checking for updates. The user then gets kicked back to the logon screen, logging in again works fine. What on earth is this? Again new to 1703.

This is a frustrating problem that's been going on for weeks, and it only seems to affect one user. This particular user uses her personaly email in Outlook, and then another mailbox (the schools main public mailbox) in office 365 webmail. However intermittently she'll hit an issue forwarding emails on to people where the mails will sit in the drafts folder with a message along the lines of "Your message will be sent, we're not quite ready" then eventually it'll say that it failed to send...you don't get any options on the email to retry sending etc, the only option is to go back to the email try sending it again and delete the one in the drafts folder. (I can't remember the exact error for when it fails) Strangely enough though, from our testing we've found that the emails are sending (though we can't be 100% certain) even when they stick in drafts, so on occasion she's having to send an email 2-3 times where the recipient may or may not be receiving them. Anyone else seen this issue or know of a solution?

Am i right in thinking that the STP priority should go from lowest to highest working from the center of a network outwards? For example, core should be priority 0 (or 4096) then next switch 1, then next switch again etc etc until you're at the end of a specific cascade of switches? Or, do you just set the lowest priority on the core and leave the rest at the default value? EDIT: this is using MSTP

PM sent

Always have an offline backup solution in my opinion. I've seen so many issues where people have online backups and get hit with ransomware on their backups, at least if something is tucked away in a fireproof safe somewhere well away from your main server room you're covered in almost all disaster scenarios. They're also pretty cheap. As for which veeam version, I'm using the essentials kit, enterprise edition. If you have 6 or less vCPUs you need to backup from it's an absolute bargain. (Personally i do have 10 vCPUs, but the other 2 hosts with 2 CPUs each are purely terminal servers which could be rebuilt in a flash if need be, so i don't bother backing those up to save money on the cheaper option of veeam)

Veeam users i have a question: How come when I've done multiple full backups to tape, consisting of the entire 4.9TB of our data, does it then tell me that it needs tapes from a different set to complete a restore of a large set of folders? I don't understand why it would need tapes from another set, if i've done a FULL successful backup on to the set currently in the loader. It's making doing restore testing a pain in the butt.

Scan their addresses with this script: https://gist.github.com/iwikmai/65b8a5b882e782d78fc5f466dfd2cde4 (you need to install nmap and put the nmap script into the scripts folder first) That should tell you if they're vulnerable to the exploit.

Only other thing i wonder about is what the printer name is mapping as? point and print group policy settings asks for the FQDN of the servers used for P+P. In the past i've always mapped \\servername\printername presumably these would need to be \\servername.domain.com\printername to match what's in the P+P server list? Can anyone confirm that?