gshaw

Ohhh I remember the "joys" of Enlight and how it'd randomly crash and lose its connection to the app the user was being tested on. It also used to be very fussy about how the candidate performed certain actions, no keyboard shortcuts unless you wanted to fail 😕

^^^ that's what I was getting at, does seem odd Microsoft giving that opportunity for fragmentation of the Education install base

Care to share or some pointers 😉

Your LTSB choice is an interesting one, weren't MS suggesting it's only meant for very specific usage scenarios? Can understand why you're going down that route if it is a clean, minimal install but will it also hold you back from the next wave of features (I imagine \ hope the next sub-release will come out soon and smooth out some of the rough edges that have been found so far)

From what I've seen elsewhere Chromebooks are becoming an increasing threat for MS after a slow start. Difficult to argue with some of the hardware pricing and set-and-forget configuration for basic use cases. More advanced apps still need something more flexible on the OS level (unless you're willing to fork out for VDI) but the initial setup and login process in W10 really needs looking at. Same with the Azure AD side, sounds perfect for working primarily in O365 (CloudBook-style) but it's been a bit picky so far.

I've been playing with 10 on my laptop for some time and happy with it as a standalone system. We've got a batch of Surface 3 devices in from Microsoft (50% off RRP ) and just setting them up, starting with a Win10 Education upgrade. Was wondering what basic GPOs you've all been applying that are specific to Win10 machines? Being a bit cheeky and trying to save some time getting these in a usable state

I have a NAT policy and matching security rule locked down to SMTP service. On Office 365 you have to add the external address in as trusted. I've also used Postfix as the server rather than IIS. More reliable and gives me mail stats nightly so I can see what's being sent.

Better off using an internal relay server authenticated by IP address rather than going straight from the copiers. We do it here and works well

Yup, it does seem to come at a premium but does do a lot. Should pay back in efficiency to some extent now all the paper processes are going online based

iTrent for us too, just been installed and funny enough moved from SelectHR

@caffrey any chance of elaborating on this? We're considering Smoothwall at the moment over the likes of Sophos for more education-spec filtering performance but interested to hear what's not working so well...

SSDs in machines cover up many of Sophos' sins. It's still heavier than something like ESET but we've got too many servers that would need changing to make moving over worthwhile.

Which AV out of interest?

Yup it's why I stored our last couple of Windows tablets in the stock room waiting for Win10 and the Enterprise Store

As an aside are these laptops domain joined? I like the sound of the new Azure AD join method using the O365 account for roaming devices as I wonder if the user experience off domain could be a bit hit and miss (cached passwords, GPOs etc)

We're trialling Smoothwall, currently on Bloxx, heard of iBoss but only recently spotted you @Net-Ctrl as a UK supplier of it. Does it have a) multiple NICs and ability to run two gateways b) bridge mode support c) social media filtering on outgoing posts and d) support for RADIUS auth? So far only Smoothwall and Bloxx have matched that list but a third option would be useful... For anyone considering a Palo Alto and has the budget for it, get one as they're awesome bits of kit. I'd say the web filtering is business grade rather than education focussed though so probably still need a separate filtering product alongside.

I'm having a lot of "fun" battling with our Aruba controller at present trying to get it to present RADIUS accounting info to, well anything right now having tried: - Smoothwall - Bloxx - Windows NPS The sticking point even if I can get accounting working (currently no traffic on port 1813) there's another potential issue around getting the device's IP address. It seems under RADIUS only the username is passed on authentication and the framed-ip-address is sent as an accounting update later on. Thing is it seems that every wireless vendor interprets the accounting behaviour differently. Some send the update of their own accord when the device's IP changes whereas others only send after a timeout period expires (600 seconds on the RADIUS RFC), which isn't much use when the filtering device needs the IP to allow the user to access the network. Does anyone have this kind of setup working in a usable fashion? In theory the RADIUS authentication is much better as it does away with captive portals and suchlike but this IP address issue is holding back progress right now.

Bit of a thread resurrection but was wondering what you're all doing about BYOD with SSL intercept? Do you basically say to users that they install the certificate or put up with constant security warnings?

How does this work for the users with more specialist software e.g. Photoshop and the like? Have any users had issues with sync or do they tend to use the web interface only?

Just been trying out the Azure AD join on some tablets we've upgraded to Windows 10 as I'm thinking it may be a better choice for devices that we expect to be roaming around and using Office 365 \ cloud services as opposed to traditional desktop apps. In Windows 10 setup I've joined to our UAT Office 365 tenancy, which went OK and logged in the first user correctly during the first run process. However if I log out of that account and try to sign in as "Other user" I get the error below: We want the devices to be shared by multiple users in an open access area so they need to be able to sign in on an ad-hoc basis rather than pre-enrolled as a 1:1 device as the setup wizard seems to be hinting at. Anyone else getting the same or managed to set up a Windows 10 tablet as a shared Azure AD device?

The way I read that Microsoft table (rightly or wrongly) was it applied to organisation owned devices rather than users' personal ones e.g. machines shipped with Vista Home Basic and not on upgrade rights via EES. Allowing it on BYOD as well is a nice touch once the 1 year upgrade window expires.

I'm sticking with my PS3, back catalogue of old games and a gaming PC for anything new (Fallout 4, Deus Ex etc.) I refuse to be taken in by the "pay to win" and subscription models being forced on consoles now, it's got so bad these days I've even dumped FIFA which I thought I'd never do. That game is a shadow of what it once was, doesn't even resemble a football sim these days and just seems to be there to prey on kids who don't know any better than to hand £50+ a time over for what's effectively under-18 gambling

Just seen an interesting benefit of Windows 10 Education on this newsletter, would be good if someone from Microsoft could confirm (but I imagine it's correct given the partner publishing the newsletter is quite a well known one) OK many of them may well be entitled to the free upgrade right now but in future once it expires could prove useful, or for anyone unfortunate enough to have an old Vista powered device... Ref: http://www.bytes.co.uk/files/1314/3929/2204/MS_Newsletter_August_15.pdf

Another vote for BitLocker, as an aside are you guys just using the TPM \ USB or do you lock down with a startup PIN as well?

I'm deploying it to our Windows tablets as 8.1 was a right pain with its insistence on Microsoft accounts, downloaded Education as well yesterday so in light of the above may give it a go first.