Davit2005

I don't know if it is still the case but deleting printers as part of the GPP did slow down login times from what I've seen. To be fair we got rid of Roaming profiles at the first school I worked at and never used them since due to the PITA they caused with Printers, etc. At my last place I moved to GPP, it just made it so much easier, in actual fact we used the same format for enrolment for the following 3 years.

BGinfo or similar to put the computer name on the screen if the computer name is the serial/asset number.

There is also a method of finding what GPO are applied to a machine locally in a html format. gpresult /h c:\FOLDERPATH\FILE.html

If it comes to certificates and you are running a domain cannot you use a GPO to deploy the certs?

What applications are you having difficulty with? I've only ever installed applications in task sequences using the Install Applications task under the State Restore folder For instance using following Quiet Install commands: Chrome msiexec /i googlechromestandaloneenterprise_62.msi /qb PacketTracer6_2.exe /VERYSILENT /NORESTART I'd normally setup a applications Bundle, In the past I've had to install certain applications in order. I had the responsibility of doing all the new builds at a previous employment for a few years but I don't deal with MDT at work now, I still have a MDT server at home and use it to deploy servers and my desktop. If you are having issues with the silent switches you can use the application USSF

Are Microsoft going to follow? I rolled out Live@EDU about 10 years back, then it changed to Office 365 and now they have Microsoft 365. Will they be re-branding Office 365, hmm.....

Whilst Virtualization has removed the need for Physical hardware you should consider an extra host as others have said. Splitting the Domain Controllers would be the first target and would give you some redundancy and room to manoeuvre for updates (and failed updates) etc. if both are running DNS and DHCP. Make sure both DCs are Global Catalogs which I think they are by default anyway.

Suggest a cup of coffee :-), then to amazon and purchase a cheap network switch, 9 short ethernet cables and a bunch of USB ethernet adapters I don't think you are gaining much apart from a tidier look.

RAM is normally more in demand on HyperVisors. That does seem to be an awful lot of VMs though for one host. What sort of VMs are you running and what are the specs of the host?

I started years back with thick image ghosting with all the different drivers as different images was a right pain in the rear. MDT or SCCM (I've never used SCCM to deploy images) just seems the way to go to me. Very easy to setup, the only challenge is getting the silent switches working. If you use a VM to do the build you can even setup a pause in the task to install any difficult apps manually. Or deploy extra applications at deployment time.

You can only advise at the end of the day, if they ignore then there is probably little you can do unless you can influence others that may have more influence on SMT. Just protect yourself, speak to a union rep.

Time is only free if you have the free time

I've in the past used Universal Silent Switch Finder with some success, I'm not vouching on the link below for a download but it has more info. https://www.raymond.cc/blog/find-hidden-command-line-silent-switches-for-setup-files/

Thanks, I'm giving this suggestion a go. It's working OK on a Windows 10 PC that has not got applocker on it although they are at different states of updates. I'm going to see if I can pull the bgi conf file from the netlogon folder so that way I can just update in one place.

Get to know your team and have a meeting with all of them and then have a meeting with each of them in person to gather some further insight. Understand how the network/infrastructure is (or is not) working at the moment, and get to know key members of staff who use IT i.e. tech teachers, etc. Don't forget to put licensing and endpoint/system cyber attack protection provisions on your list of things to check out.

Do you need shared storage for VMs to sit on? I'm assuming you are talking about iSCSI

I'm going to keep plugging on with BGInfo. There is an update here https://docs.microsoft.com/en-us/sysinternals/downloads/bginfo I'm giving this a go. Anyone know how I can get rid of the mess on the background?

Interested too. Made many changes and not sure if it was an update but the wall paper is static and I have now made changes to the details but it just sits on top of the existing info leaving one unreadable mess. Running via a logon script that runs a bat file from netlogon. Recently introduced Applocker as well. Would that have any impact?

I have a cloud key plus at home but I'm in 2 minds whether I want to use it for anything but the Unifi Video TBH. I've already had it once when it removed users I'd created and I had to revert to the original I'd setup, thankfully I'd documented what I used. And I defo did create the users to match the Unifi controller I have running on Ubuntu.

The other issue with users been logged into different devices is if they change their password. We disabled it at our last org as well as forcing desktop PCs to restart overnight, solved more issues than it caused and everyone was OK with it.

SaaS would be a better solution. Just moving SIMS to the cloud is not going to do anything but increase complexity and will Capita and inevitably the company that takes over from Capita support it????

If the clients SSID vlan is not different it should not effect the portal, you have only moved the management of the APs to separate vlan? You will need to allow the radius ports through to the radius server though from the APs. Normally on the switch you would tagg the SSID vlan and just untagg the management vlan with Unifi. I have my Unifi Controller on the same vlan as the APs at home but that probably isn't necessary and may look at moving eventually. NOt sure if below would help https://help.ui.com/hc/en-us/articles/218506997-UniFi-Ports-Used

There is one thing I would recommend if you have SCCM or MDT joining computers to the domain is to setup a service account with delegated rights on a specific OU instead of a domain admin account.

I have got a MDT server at home, lol. 15 years ago when working as an ePos field engineer we had laptops we could boot tills from using tftpd32, considering some of the units we had to completely diss-assemble before re-imaging these were a god send and quicker than the old method of copying another till HDD (not to mention safer and no chance of getting the wrong disk imaged over, lol).