Warwick_Tech

Thanks for the replies all - I'll do some investigations and get back to you, most appreciated. Regards,

Ok, Imagine you're talking to someone who used a mac once in college (Final Cut Pro making Zombie Movies, hey it's a living) Also imagine you're now tasked with a new Music suite of 30 MACS and a handful of iPads and Macbooks on varying OS levels and specs. Now also imagine this is real and I have no experience with MAC OS - Is the server software free? Can I install it on a VM from Hyper-V? Does it Sync with AD? Long story short - what's the best (read quickest and dirty) way of managing these devices centrally so they are locked down to a couple of Apps and we can create/wipe user profiles easily if they ever get lost/stolen Any input welcome.

Hi Dave, If we did postage to South London how much would you want?

MP4Museum Works as long as someone doesn't 'borrow' the memory stick

We have tried several ways to achieve this - DelProf2 seems hit and miss on W10, so we used to use this Ps1 script BUT this was also clunky and I think caused some printer connection issues - So instead I use this script now which you can easily alter days Just change '14' to however may days you wish.

Would this be easier to manage with a server share folder that you can force a wipe of - It means no need to worry about PC's with home area data hanging around (GDPR) The only issue with this is as you say depending on how many people are logged in at once they can browse to others folders... When you say 'right click' do you mean the taskbar icon or file explorer? As there must be a way of blocking acees to the root (O:) but not the path (O:\Username)

A good idea, there are a few GPO's that can help with this: https://docs.microsoft.com/en-us/onedrive/use-group-policy but as OD is 1TB would 4GB be enough? you may encounter errors if they have more than 4Gb of data. the other idea I had was simply direct it to their home area on the server, but again space issues and sync issues may persist.

We had to stop using OneDrive Mapper for two reasons - One was the WebDav which was problematic at best, but the second was more serious in that students could use the login box to access powershell as an admin (despite launching powershell as an admin prompted for credentials, my theory is that as it was run as a login script it was already an admin so it bypassed the UAC prompt) So yeah, no more OneDrive mapper. With regards locking the C: drive, I have always had it locked as this covers multiple bases, simply being hidden can cause all sorts of backdoors, better the 'cover all' approach - but this does mean no sync tool for students. For now they are using the web apps version without much issue, it also teaches them how to use it for H/W and access outside school etc so it's swings and roundabouts.

The best (and only) way I found was to create a 'theme file' (remember them?) And have it apply on deployment and via GPO - This sets the colour according to the theme file which is .theme Edit the to any hex colour you want https://www.w3schools.com/colors/colors_picker.asp

What I find frustrating is this didn't happen in 1607, they just weren't there!

Hi All, After updating my internet connection I want to try downloading updates direct instead of WSUS - But still want to control them so we don't get versions (1903 for example) I found this box But you all know as well as I do how fragile WSUS is - Will this download the updates but only what's specified in WSUS, bypassing internal storage? I'm tired of it filling up so quickly. Cheers all,

In my experience the Netgear switches are pretty good, and their ability to stack is great; They also have a limited lifetime warranty. However they are let down by a confusing UI that moans about flash and java a lot....

Hi All, I may have cracked it accidentally - The fix to the greyed out start menu is to re-enable/allow cortana through applocker, but this leaves the menu open for abuse (looking through PC files etc or running commands) But, with these GPO's it seems to lock it down so you can't find anything except the windows 10 options, which can be removed or settings blocked (ours opens, then immediately closes for students In, User Config, Policies, Administrative Templates, Start Menu and Taskbar o Do not search communications, = Enabled o Do not search for files, = Enabled o Do not search Internet, = Enabled o Do not search programs and Control Panel items, = Enabled o Do not use the search-based method when resolving shell shortcuts, = Enabled o Prevent changes to Taskbar and Start Menu Settings, = Enabled o Remove Search Computer link, = Enabled o Remove Search link from Start Menu, = Enabled o Remove See More Results / Search Everywhere link, = Enabled It's not foolproof as I was still able to get to command prompt, but if any edugeekers have more time than I do prepping for Summer they may be able to help as this seems to be a great start. Credit shouldn't go to me - It was a student who cracked how to get to powershell on an old W7 machine on the network I took over; finding how to block this lead me to a forum from 2011 on Spiceworks with the GPO list - curiously I tried it and there you go! Might be worth a sticky if it works!

Hi All, Looking at new Core switches and this bad boy has appeared on my radar https://www.netgear.com/support/product/M4300-24X24F Only thing is I can't find anything definitive if it's 24 and 24 ports (shared) or independant, so it's 48 seperate connections... I might just be going blind though.

No, that's what we tried but nothing worked - Only pointing the GPO to a network share image seemed to force a refresh

I can't speak for 1903, but moving to 1809 didn't include the updates to photos to allow the video editor so I've now re-enabled app updates

We found windows only likes one image and to change it we had to point the image to a network share, not changing the name, filesize anything worked - except the network share; so that's now where our lock screens live.

Hi All, We have a USB ban in school via the following GPO This allows us to still have our cameras work for photography and not worry about hardware ID's etc. However the Microbit registers as a USB device so is blocked under the current settings; without going through every USB ID does anyone have a similar situation they are finding themselves in? I thought of using Impero SentryStick but I haven't used it before and have no idea if it's as good/better or worse than the GPO (if anyone is using sentrystick I would be intrigued) Regards,

Thanks for the replies all - I tried various methods to get it to work when 2019 was released, it was for domain PC's - The update of the DC went flawlessly (concerning) so now just some VH left (Is there still the bug where you can't update these properly?) and the file server with the MSI's, but that's going to be a pain if the feature remains. If you use SCCM you won't be affected I guess :shrugs:

Hi All, Mentioned this as a bug, sorry - Feature of Server 2019 ages ago, but not sure if it was a big enough thing. The traditional way to create and deploy an MSI was create a network share for 'everyone' to have read access and add it to software distribution via GPO. This however seems broken in 2019 as it always prompts for network credentials on accessing a server share on a local account, meaning the programs cannot install. I got around this on MDT by entering admin credentials on the scripts, but cannot find a way round for regular PC's; I know security is important, but sometimes you need these unsecure folders to host EXE's and MSI's your users need. Anyone got any further on this? Also upgrading my DC to 2019 as we speak - 77% wish me luck

So not sure if anyone else has noticed, Windows Defender now has a handy start menu icon. Maybe not so much when it allows students to open it from there. Applocker has no effect and anytime I search for a GPO it's just how to disable it completely (which I don't want to do) I remember 1607 had it where if an app was app-locked it wouldn't appear but that has long since gone. What do you guys do with Windows Defender icons for students?

Is this a new GPO setting? Currently running 1803 but can't remember what version of GPO we're on - Also do you not get the 'This action has been cancelled by your system administrator' when they browse to the OneDrive folder on explorer? (This is what I think the deny access to C: GPO is doing, but no way I can turn that off)

It's funny everyone should mention this as I've been having trouble with SMTP on 587 and anonymous on 25 mail.protection.outlook.com It used to work with TLS ON (MS recommendation) then it started working without, now it doesn't work at all! This is affecting our helpdesk, papercut, Unifi - The usual suspects; papercut in fact won't send any notifications on server 2019 I've opened a ticket with Office 365 but they are clutching at straws (not really their area)

Sorry for resurrecting an old thread - we currently have OneDrive FOD working for staff (silent sign-in works 90% of the time) but for students when they click on the OneDrive link on the start menu it does seemingly nothing, however logged in as a staff member on a student PC it does launch OneDrive after 30 or so seconds. I figured this was a software restriction, but I don't have anything locked in APPDATA or C: - I recall a post somewhere on here that said you needed to 'unrestrict' the C: drive GPO; anyone know if this is still the case? As Katy says the OneDrive Mapper is great, but causes a problem with files over 50MB and students aren't patient enough! Any ideas anyone?

Bringing this thread back from the dead I've noticed some wierd results using applocker on versions higher than 1607 - Where it used to not show the icons of blocked apps, now it does, and some apps like 'Print 3D' under windows accessories show whatever I do - There's also wierd bugs; new apps like 'Video editor' not being visible for students, and even the 'create' button being replaced by a spinning 'refresh' icon in photos. Has anyone discovered the reason for these changes since 1607? I'm ready to deploy 1803 this summer but the lack of a video editor and a messy start menu is causing concern amongst the IT crowd.