disk

I was assuming this was the correct way. In addition to this, does your college allow desktop techs this ability via domain admin credentials or is this usually reserved for sys admins? We use Deep Freeze so I am not too concerned with the lab machines, especially since so many courses require local admin privileges and some even teach powershell. The concern is more some accidental script running against staff or faculty. Thoughts? Back to code-signing, reading through various sites and blogs online, it seems fairly confusing as to whether or not the execution policy for powershell is any kind of security issue or not. If anyone here has some great reference or insight regarding this, I would love to hear it!

We are looking to grant our desktop support techs the ability to create/run some basic powershell scripts for things like copying desktop shortcuts to their labs, etc. The question came up regarding setting powershell execution policy to bypass on the lab machines. Trying to determine is this is acceptable or not. Has anyone else gone and done something similar at your school? Implications? Advice? Thank you!

Looking for some input on how to handle deploying Zoom to academic areas where Deep Freeze is utilized. Currently we have some discussions centered on possibly installing Zoom on machines that are protected by Deep Freeze. The way Zoom auto updates work doesn't work with this type of arrangement. We are thinking of just creating a desktop shortcut to the Zoom website and instructing everyone to login and use that but I would love to hear how others are approaching this. Thanks!

Just curious how people are converting some of the advanced computer courses (Windows Server administration, Computer Networking, etc.) for remote learning? These are the types of courses where by each student is given a handful of pre-configured VMs and virtual networks, etc. and they have a bunch of labs that walk them through configuring servers, network, etc. and networking them together, and some of the course curriculum even require two or more students to be able to communicate with each other. We are talking about moving them to Azure or something similar but I do not have enough experience here to know what would work best. I would love to hear some input from those that have already done something like this!

With apple planning on dropping intel in favor of arm (which was just purchased by nvidia, who historically have not played well with apple), that is one more reason to double down on migrating from mac to windows.

Our current standard is the Dell Latitude 5400 with an i5, 16GB of RAM, and a 256GB NVMe SSD. Make sure you have the latest driver pack for the model loaded in your imaging system, ensure BIOS is up-to-date, and these machines are an absolute dream to use. Plenty of satisfied users, including some that we recently switched from Macs due to software requirements (we are ~95% Windows anyway).

We choose to utilize Microsoft Premier Support for any Microsoft product. You can pay per-incident, or engage in a support contract. We paid for a full year of service when we were planning the migration from on-prem Exchange to O365, but afterwards, decided to just open an incident when needed. You can buy packs of "incidents" too for a reduced rate. The per-incident way is for break/fix type issues, while the contract can also be used for project planning and guidance (very helpful if you are planning something huge or don't quite have the necessary skillset/knowledge in your team). https://www.microsoft.com/en-us/msservices/premier-support

Hello all! I'm having trouble trying to determine what options are available concerning students gaining access to MS Project. We see the licences available in the Microsoft Volume Licensing site, assuming we contact our rep and purchase the appropriate licences, we would have kms activations available on campus, but that won't cover our online courses. For online courses we could make Project available to the students via Citrix or RDS, but that would also mean we'd have to purchase more Citrix and MS cals. I was hoping that Microsoft may allow students access to Project via OnTheHub, but it is difficult getting any information on this. Can anyone here please let me know if this is an option, or if anyone here is already making Project available to their students, I would love to hear which route you took, how much it costs, and how that it working out for you! Thanks!

We use generic active directory user accounts and configure our instructional labs to autologon. Group Policy is set to "Always wait for the network at computer startup and logon". Recently, I was made aware of a help desk ticket stating that every class session, 1-3 of the 25 PCs will not have the generic user account's home folder mapped. Logging out and back in fixes this. I have asked the desktop techs to do some troubleshooting in order to gather additional information, but I wanted to post this to see if anyone else has recently started to experience this issue? Perhaps it is a recent cumulative update? Any insight or troubleshooting recommendations would be greatly appreciated! I should mention, we are running Windows 10 Enterprise build 1803 in the area which is reporting this issue.

A couple of thoughts. 1) Did you try updating the BIOS on these systems? 2) How did you image/upgrade them? My guess is you may not be running the best set of drivers. If you are imaging with something like SCCM, verify you have the latest driver pack for that model.

We are setting up some Windows 10 kiosks using Edge in assigned access and everything works great. The only aspect that we can't set using a provisioning package is the URL control. According to the Microsoft document (see below), it is possible to do accomplish this using the Windows Defender. Under the section titled "Feature comparison of kiosk mode and kiosk browser app". https://docs.microsoft.com/en-us/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy Ideally, I would like to only allow web access to any sites on our LAN for this project so if anyone has any experience they wouldn't mind sharing, I would love to know how to accomplish this using Windows Defender Firewall. It is real easy to specify what URLs/Domains to allow or deny for the Microsoft Kiosk browser (which is based on Edge) from Windows Configuration Designer. Unfortunately, it has an issue currently where the "end session" button doesn't actually log users out of any websites they may be logged into.

Is this the method you are following? https://docs.microsoft.com/en-us/windows-hardware/manufacture/desktop/customize-the-default-user-profile-by-using-copyprofile We currently use USMT. I deploy one of our images via SCCM which includes all the software for a particular area. I then launch the software and make any customizations before capturing the profile. I then create a task in SCCM that will deploy this profile along with the image and software. USMT does a great job of capturing Windows and Microsoft software settings, and some popular third party software. For the more esoteric software, you will need to modify the XML file that tells USMT where that software captures the settings. Our logon times are fantastic in labs that have SSDs, and acceptable in labs that don't. Hope this helps.

Thanks for sharing! This definitely looks worth investigating.

We are already using the logon messaging to display our acceptable use policy. Good idea though.

Yeah, the wallpaper method we tried in a limited area and found that it was a bit unreliable. Some workstations never would update even though all other group policy settings would. I never looked into it but instead tried to get everyone onboard with at least looking at different possible solutions. Now that the footprint is looking to expand is a great opportunity to do so!

This could work. Thank you for the suggestion!

I should mention that we do not currently utilize windows screensaver in our environment, we simply allow the monitors to sleep after a period of time. If anyone can recommend a robust screensaver management system, that might be a possible way to accomplish this. I've tried finding one but as of yet have not had any luck.

We have been tasked with disseminating information to students via our instructional PCs in the various labs around campus. We had been doing this in one open lab for a year or two by utilizing a file share and group policy to set the jpeg as the desktop wallpaper. It wasn't ideal, but it was the best idea at the time. Now they want to do this across the entirety of the campus labs. This solution simply will not work. There are too many issues (different monitor sizes, aspect ratios, resolutions, etc). Are any of you using or aware of a way to accomplish this? The information will be targeted to students with messages/reminders about registration events, etc. So the content will change fairly often. I also would like the solution to not be intrusive to the users (if possible). I'd like to just recommend that they use email to send out information, but I'm always told that no one reads their email.

In my original post I mentioned running gpresult /r and saw that the policy that is linked at the sub OU is applied. I then made it enforced, but the settings from the top level policy are still what is showing.

The top level policy is not enforced. This is why I'm so confused. I was thinking maybe power plans behave different?

You are correct, it can be set for both/either, however, we are only setting it under computer settings (mostly due to the location of the policies and the user objects). I just find it odd that I can't overwrite the setting by a policy set directly at the OU.

Hello, We currently have a default Windows power plan specified at the root of our domain and it is specified in a very large, very old policy that does a lot of important things. There now is a need to tweak some power settings on a few laptops (specifically to shutdown windows when the lid is closed). I tried creating a new policy that just modified/updated the power plan and linked it in at that sub OU but it doesn't take affect. Does anyone have any insight into this? I even tried making the new policy set to enforced. When I run gpresult /r it shows the new gpo as applied, however, when I go to the power options in control panel, the original setting is still applied.

Physical or virtual server(s)?

Turns out our issue was very simple. I just had to have our global admin find the time to dig through all the menus and found a switch to enable the offline download option for apps! I am now able to get access to everything I need to deploy apps!

It depends on what you plan on using for a kiosk solution. Right now we are looking into using the Microsoft Kiosk Browser to redo all of our kiosks across campus. You would not be able to do this if you were running LTSB. We are deploying Windows 10 Enterprise x64 everywhere. We upgrade to a newer build every summer. https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Simplifying-kiosk-management-for-IT-with-Windows-10/ba-p/187691 That being said, I have one last issue with the Microsoft Kiosk Browser that I am trying to work through. Everything is perfect except that when I log into a site like Edugeek and use the "end session" button which is supposed to clear "all browsing data like cookies, history, and temporary files" it refreshes the browser but I am still logged in. I am actively searching for a way to prevent this as it is obviously a major issue. If anyone here has any ideas I would love to hear them! Everything else about this solution is great (easy to configure and deploy, the UI is the best yet that I've seen for a kiosk).