Miscbrah

Thanks. This end (with the help of CoPilot and some googling) I've knocked up a script that makes urls (in a local .html file) for teachers to click, and something else (that I have to run manually until I figure out the auth token thing) that assigns the permissions of the OneDrives by url for each student in %group%. It's working. It's less graceful than your approach but it's working. We're going with Salamander ultimately but couldn't get in before the start of the year. A very large part of the appeal is that I won't then have to nurse a set of scripts through updates and retired modules and all that every September.

Ancient bump here, but did anyone ever get a script together that managed to do this?

Thanks. Yeah throughout this process I'm not having a super warm and fuzzy feeling about it... randomly losing files is of course no flippin' good! Similar vintage here also in GP but I've tinkered and changed loads. Add in loads more following this saga! Also 1G/s here and since the first weekend with it, provisioning is actually pretty swift and it does seem to do the redirection thing nicely. Though having said that it's only me gently testing things at this point and not a class of thirty shrieking students. Still have a tiny bit of optimism going though, which is nice. With any luck it all "just works".

Okay we're getting there! Students now log in, the "Known Folder" redirection (Desktop, Documents and Pictures) seem to sync up (and down again) to and from OneDrive. No interactions needed from students, just provisions when that logs in. Neat. Want to have a good long test and it's all still locked down (make sure we don't have them saving to obscure corners/armpits of 😄 or anything.) Happily this doesn't affect staff yet (not ready for that migration at the moment) as any sort of folder redirection just breaks this - so good news there too. Feels like I'm somewhere near the last person in the world to be doing this but if anyone else is stuck and comes across this can share the policies etc that got me going. Most success came after enabling SSO and stopping folder redirection happening at all (even desktop.)

Plodding along here! Little way into the term now but still not got this down. Progress made however. Have a *sigh* Group Policy setup I inherited with one big giant policy with the student lockdown settings in it. With that policy off, all known folder redirection to OneDrive works and with it on it doesn't, so the next hurdle is rummaging through this for culprits and turning them off and on and seeing what breaks and what works. When that's done should be a lot closer. Not using CloudConnect at this point, seems to all be working (bar that policy) with the vanilla Windows offerings. Wish me luck everyone...

Hello Edugeeks - decided it's time to join the 2020s and *deep breath* stop using local storage and just get students saving to OneDrives exclusively. Probably worth mentioning early I do NOT want this to affect staff yet nor break anything for staff; that's coming later in the year and I need to give it way more thought. Staff will occasionally log into these PCs though. Students however are a clean slate at this stage so I'm thinking it's a good time to go for it. They'll still have AD/domain accounts to log onto PCs in traditional fashion, just think it's time to cloud-ify storage for them. Usual (I'm guessing it'd be usual) wish-list applies: 1 - Stop them saving to C:, or indeed any other unwanted crevice of the PC or network other than OneDrives. 2 - Stop them seeing other OneDrives or areas they shouldn't see. 3 - Stop PCs themselves filling up with cached garbage if that's a common (or even uncommon) pitfall I can avoid here. At this point, before I set the accounts up and still have just about a fortnight to test this, my thinking is: A - No home area set in path in AD (be brave Miscbrah...) B - No traditional folder redirection set (as in, nothing set in group policy in User Config > Policies > Windows Settings > Folder Redirection.) C - In group policy, PC OU for the IT suite gets: Computer Config > Admin Templates > OneDrive > Silently sign in users to the OneDrive sync app - Enabled Use OneDrive Files On-Demand - Enabled (And the big one) Silently move Windows known folders to OneDrive - "Documents" and "Pictures" ONLY (along with tenant ID. And I'm guessing without notifying users - I think it'll jsut fox them.) "Desktop" omitted and redirected separately to a share they can't save to, for the sake of enforcing a standard set of shortcuts. They've had that set for years now so are used to it. (Along with the other big one) Prevent users from redirecting their Windows known folders back - Enable Then turn Storage Sense on (Admin Templates > Storage Sense) to stop the whole "PC fills up with cached garbage" situation. D - User policies for the students will be set to: User Config > Policies > Admin Templates > Microsoft Office > Default save location (set to OneDrive) - I must get the admx files for 2024 and do this... Then by my reckoning I should achieve a euphoric state of flawless digital triumph. But just in case that's not right, or vaguely right, or someone (I daresay most people these days) have done this differently or better, is there anything else you'd recommend I do at this stage or change? I do have Burconix Cloud Connect which is rad tbh but think I've all but moved away from that for students with the above. So yeah, firstly thanks for reading all that! Please chime in with anything in the above that looks doomed or broken or terrible! Thanks all!

You're both lovely thank you! I'll have a read of the info there.

Morning everybody - apologies in advance if this is painful but I'm no Apple person. Trying to seize some old independently-created Apple accounts the former IT manager made (for resetting of passwords etc) and made some progress, but also not entirely sure what I'm expecting here. So, in Apple school manager, domain is federated in (I guess??) the correct way: Great. I don't know entirely why there's 142 Apple accounts unmanaged with anything to do with my school out there in the world or what they are, so I guess that's question 1. Next step I guess is also to start the domain capture. Nervously pressing the link I get this: Right, this bit starts to worry me. I have visions of clicking this and nobody being able to log into their Microsoft accounts again because *something* happened and I can't figure out the *something*. So question 2 would be, in general terms, what the heck will happen with or to my Microsoft accounts after this? Also, what will they then be able to sign in with and do re the Apple store, Apple services and purchases etc etc? Can't really do anything else though without that toggle, and clicking that does this: Well no actually, now you mention it I'm not sure about any of this any more and delighted to hear whatever I'm pondering doing has no way back! Reading the help articles on the Apple knowledgebase and it seems like that all will do what I want, but I'm not so certain of it that I'd start clicking things without understanding the full implications of it. If anyone's passing and reading this and fancies literally spoonfeeding me through this ominous set of hazards it'd be amazing of you! Bit too daunted to go further at this stage. Thanks hugely for reading even!

Could I have one also please.

Revisiting this one (after a couple of years) with a bit of a query - thinking of reviving in anger a previous google school setup that never really got going. If we have google accounts set up for teachers and students with GCDS and chrome sign-ins, and they dutifully sign in to chrome (although I'm hoping there's something in an SSO thing out there that handles this) will they still be served youtube ads or does this stop it? Nothing like a couple of breakfast cereal or mobile game ads to really enhance a lesson/assembly! Thanks all.

Felt optimistic so I got back in touch with Microsoft and explained the above. They said that actually does work, as if all along they hadn't been telling me it's literally impossible. I'm baffled but my Office is all working so go me I guess! Thanks again everybody for the help/sanity with that one.

Ok so I ran the .exe for 2024 STANDARD on the KMS server in preparation for the AD-based auth for 2024 STANDARD and went back to check the test 2024 PRO PLUS machine and it's just fine now. Product activated. I'll give it a week to make sure it's "safe" to roll out and it stays authenticated and then I'll just say it's fine. I don't know quite why this is working now. Nobody from Microsoft I talk to knows why/why not or what I can/can't authenticate or which way I can/can't so at least I'm ending this crap-shoot with a licensed install. Hopefully... Thanks everyone you were all more help than the people who actually make and sell this stuff!

Haha yeah actually it's TWO of them who've fibbed now. I might go in for the hat-trick and try again tomorrow...

Thanks all - sorry didn't mention I do have a KMS server and AD, was looking to authenticate with KMS. Microsoft told me categorically there is NO KMS option for this, so I'm just moving to standard 2024 which does seem to. Even though @BKGarry it does seem like somewhere out there (and from what I've been reading) there actually might be. Just not for me it looks like. If all else fails will indeed put the MAK in the config xml and stop my faffing. Thanks again everyone.

Hi everyone. Looking to deploy Office 2024 LTSC Pro Plus to clients but no KMS option. Anyone else rolling this out? If so, how did you authenticate it?

Thanks for that - happy Saturday btw! Ok, got nowhere so set up a brand new share/location for these home directories. Did the tickboxes as you recommend there, looks ok and is now making the subfolders for those known folders/libraries (Pictures, Videos etc.) Set to this: I think the permissions in the other one were just a bit too much of a mess to work with here. At the moment all seems ok! As a kid I can browse other student home folders but can't save there/delete anything at least. Just a case now of trying to lock those down a bit. It seems like every 6-7 years I'll be somewhere or move somewhere I'll have to rebuild this nonsense and I always hate it SO bad lol! Thanks for helping me out there.

Afternoon all - ok this admittedly I've not done in years and always found it extremely fiddly whenever I've had to. It's beating me a bit today. On this network my predecessor never used the AD profile tab for home folders, was all done through a nest of scripts and GP settings. Took (what I thought would be) a leisurely Saturday to un-pick this, wish I hadn't started tbh! We also map a drive here to \\fileserver\pupilmydocuments$ to allow staff to browse student home areas, which we'd like to keep. So, in AD for a Y5 student I'm testing things on I've set the following: Connect H: to \\fileserver\pupilmydocuments$\Y5\%username% This works fine AS FAR AS the user's folder gets created in that Y5 folder as soon as AD is OK-ed. Permissions on it (that newly-created home directory folder) are: Should be ok I'd think. A few more admins in there than I'd probably like to tidy up but that's for another time. To folder redirection in GP, which is set as this: Log into a PC as a student, nothing's redirected and nothing is saved nor created in that user folder. Can anyone see anything obvious I'm doing wrong/silly? Thanks everyone.

Thanks everyone - yeah digging through logs I think best at this point. These all fully "vanilla" MSIs through GP, no scripting. The software I do script to install though (set flags myself) seem to work ok.

Evening all, have a weird one. Been an issue for a little while, hoped W11 would just make it go away but it didn't! Software deployed by Group Policy reinstalls every restart. As in each time it goes through all the packages and restarts are kinda painfully long. Only seems to be student IT suite. Never did get to the bottom of it but I'd defo like to! Anyone seen this before/solve this before?

Hey everyone - just had something to ask I've been thinking about along with some of the teaching staff. We (primary) are ditching a "traditional" (30x PCs, monitors, desks) ICT room and going with two laptop trolleys. A refurb and redecorate of the room is also on the cards. So, we get flexibility in the space and I would imagine need desks to accommodate in some fashion or another, that's a given. There's an intangible "wow" factor that we're after with it, but truth is we don't know quite what we'd do to get a "wow" factor. We've got as far as the following items below in discussion: - We've never seen (irl or googling) an IT suite that had whatever the "wow" factor is (and if you yourself reading this have please do send an image or describe one that did/does for you.) - We could probably achieve the "wow" factor by saturating the room with a 3D printer, VR headsets, Arduinos and making much of what these items can achieve through posters etc. But we don't know, though this is the closest we got. - The "wow" factor is not two banks of PCs with students sat at them. Though we don't know what it is. I realise there's probably not much (nothing) tangible to go on from that! Just wondering if there is even any sensible/realistic destination at all for this sort of thinking or if we go with the best of what comes of the above. But I guess I'd ask the group if you saw/did/have anything in an IT suite that made you think "wow"? Hopefully that makes sense in some fashion - although maybe not! Grateful for any opinions or anything!

Hey all. It does look like I want the world from these from the title! We're pondering a trolley of Windows laptops for the students, and my worry is the usual one of "wear and tear" from the life they'll have with students. Must be simple enough to strip down and replace parts. Does anyone have any recommendations given the above criteria? Oh and they also can't be too expensive. Chromebooks are out of the question. Or rather, chromebooks will actually be my favourite ultimate solution to the project but as far as this topic goes I'm exploring W11 laptops. Thanks for any/all suggestions!

Oh awesome thanks Microsoft.

Thanks mavhc. Just got to the link to Katy's blog in it, that thing's GREAT tbh: https://katystech.blog/mem/wufb-and-update-compliance Definitely recommended reading for anyone (like me) after the basics in plain English! The logging/reporting is going to take me a moment or three to get my head around but lots to read. I'll try and keep this updated as I go as either a step-by-step or can turn into a cautionary tale! Thanks again all for any pointers or anything as I go.

Afternoon all - it's time to tackle this... As per title really, I think I've dug out what to do but not found a good step-by-step out there on it so cobbling this together! So, think I'll probably be first turning off the WSUS server. Ding dong the witch is dead etc. Then referencing this: https://www.ajtek.ca/wsus/how-to-reset-windows-update-gpo-settings/ and then this: https://gal.vin/posts/old/get-started-with-windows-update-for-business/ To the first article then and removing anything from GP regarding WSUS policies, so afterwards also remove that reg key at HKLM:\Software\Policies\Microsoft\Windows\WindowsUpdate Next to the second article, I’m thinking we go with finding some nice people to be in my testing ring. Once I’ve made some friends they can be in that. Active Directory group for their PCs and laptops (call that “wufb_testers” or something) and then a group for everything else (call that “wufb_everyone” or somesuch.) Reason for this is the nice people will be nice when their machines get duff updates and it b0rks them, and I can defer that for the “wufb_everyone” lot. Set all policies as per that article, with of course options to defer when I fancy. Hopefully all that looks sane so far. Question I have is where do I view any reporting on updates for machines after this? We don't use Intune (which I have read can do something along those lines) but is there anything else in just the regular Azure admin centre or Entra admin? Have heard they can take a number of days to show up and report in to wherever it is. Thanks anyone passing for any help/pointers!

Morning all - just a quick one (hopefully!) Is there anything published regarding our obligations to filtering the public wifi specifically in schools? Also if so/if not, how strictly do you filter your public wifi? Rummaging the gov.uk site as I type but not found anything specific to public wifi, so I'm thinking filtering in line with curriculum internet might be the way... Thanks all.