SYNACK

Watched the presentation with great interest but have not been able to get a response from them. Tried a couple of times to enquire and sign up. Do they have a representative on the forum?

Tried one of these and seemed to work alright during brief testing https://www.amazon.com/dp/B0BRSRWKCF

Had an issue where GWSMO (Google Workspace Sync for Microsoft Outlook) profile setup immediately fails and tells you to reinstall Outlook. The logs claim: 3f1c E:Generic profileeditor!MAPISubsystem::LoadMAPIFunctions @ 143 ()> Failed with 0x8007007e, last successful line = 123. 3f1c E:Generic profileeditor!MapiInit @ 5929 ()> Failed with 0x8007007e, last successful line = 5927. Internet came up dry so looked at it through procmon and found it was failing to find vcruntime140.dll All you need to do is install the latest Visual Studio Redistributables from here https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170 Publishing here in case someone else encounters it.

Teams is the absolute worst showing Microsoft has and displays a dangerous lack of caring for end users and managment. The client has always been a bag of hammers, 'conveniently' designed to run on a browser framework inside a container, inside an OS, inside an app container guaranteed to be slow on anything but a fresh new pc... That needs to update, as each individual user every 30 days or it will give them a 'you must upgrade' prompt with no button to fix it. The new AppX one has been around for some time now and is still unable to detect a computer in presentation mode, or focus mode and will helpfully spew chat notifications on screen while projecting to a wireless display. Sure you can go into options and manually turn it off, but that is the only option. No shortcut, nothing. In the past Microsoft at least had the decency to release an API so if they forgot something, or could not be bothered, you could script it or make a plug-in via the API. No such luck now, they really don't care, whoever is running the Teams development needs to be re-educated heavily by sysadmins from education and corporate alike for their complete lack of care in this regard. If you are not going to fix two year old feature requests then at least have an API to allow someone else to patch over your incompetence.

Alright I'm just going to plug my own post as I have looked it up on here several times now for various problems with Windows 11 updates and imaging. I don't know who is in charge of the code that modifies the uefi partition but they need some more code review. I have now had several machines that failed during major Windows updates that have been recovered by variations of this. It at least needs to be added into the startup repair tool remediations if they are going to keep cooking it.

Do they have any student licenses applied as well. Had to remove any student ones from a couple of users as it seemed to block copiolet despite their other license.

Good that they are working on it but why do they have to make it so complicated. You can do the same thing on the Apple side with a Mac by clicking a checkbox. https://support.apple.com/en-nz/guide/mac-help/mchl3b6c3720/mac It seems extremely gate keepy to have to set the whole thing up in azure just for some cache. Higher security - probably, easier to bill for definitely.

Scep certificates via intune is probably best, there are third party services that can run it or use the Microsoft offering with the connector. Be aware that it will have to be machine authentication only if using shared devices. If you use machine plus user it will not connect any new user as it needs internet to get a user cert but does not bother to grab one before jumping to user context. Unless you have an onboarding network configured that allows for certificate retrieval and patient users who will wait while it goes and grabs one it is not a good solution. Microsoft really needs to step up in that regard as cert based wifi is way more secure but Windows does not allow for just in time provisioning of certs for new user logons - happy to be corrected if I have missed something.

It's because Apple does not do shared SSO from the OS, you log on but then need to log on by an sso solution like MS apps with Authenticator which can then do sso to other apps. We have Apple classroom setup just to offer a picture list of all the junior classes, drilling down to users. As there is no bulk way the teachers initially log them in with 365 creds and set a pin. They also log on to a MS app that spins up SSO for all of them through Authenticator. If one of the solutions could tap 365 or Google SSO from the second logon it would make it work. Don't know of any that do though.

Couldn't find this online easily so thought I'd post a quick guide to help others. Ran into a situation where I needed security groups via student year and figured I could use the Grade SDS attribute to do it with dynamic security groups in AzureAD/EntraID. You can Use extended attributes in dynamic groups to it was just a case of finding the name and using it in a rule. Some searching found a PowerShell script to pull the attributes back out of Azure so I had an easy reference for the extension names. https://github.com/OfficeDev/O365-EDU-Tools/blob/master/SDS%20Scripts/Get-All_SDS_Attributes.ps1 In the dynamic rule builder, I just added an expression to pick out the year level for each group and made sure the accounts were live: Year1: Rule Syntax: (user.accountEnabled -eq True) -and (user.extension_fe2174665583431c953114ff7268b7b3_Education_Grade -eq "1")

I have been having a major issue with Windows updates for a month or so. Cumulative updates that would get almost all the way through then choke and revert at the last moment. I thought this was due to Windows 11's obvious 'quality' but then it started effecting the fresh Windows 10 builds as well. After running all the DISM checks, SFS and clearing the Windows update cache the problem persisted. Thankfully Windows 10 managed to provide an actual clue in its Windows update logs - helpfully left in ETL files till you run the Powershell command Get-WindowsUpdateLog . Burried deep in those logs - Running a find from the bottom up for the exception (0x800f0922) eventually landed me here: Installer ID: {c5f0e9d7-e844-4507-89e4-701b5a747221} Installer name: 'Boot File Servicing (BFSVC) Installer' 2024-07-25 17:12:54, Info CSI 00000863 BFSVC: 'ServiceBootFiles MuiOnly:n Res:n Fonts:n BootMgrOvw:n BootStatOvw:n DbgTrn:n SuspendBDE:n Offline:n' 2024-07-25 17:12:54, Info CSI 00000864 BFSVC: 'Not using Ex bins.' 2024-07-25 17:12:54, Info CSI 00000865 BFSVC: 'Using source OS version a00004a610001' 2024-07-25 17:12:54, Info CSI 00000866 BFSVC: 'Copying boot files CopyBootManager(Yes) C:\Windows\boot\EFI -> \\?\GLOBALROOT\Device\HarddiskVolume1\EFI\Microsoft\Boot ' 2024-07-25 17:12:54, Info CSI 00000867 BFSVC: 'Error creating \\?\GLOBALROOT\Device\HarddiskVolume1\EFI\Microsoft\Boot\es-ES\ path! Last Error = 0xb7' 2024-07-25 17:12:54, Info CSI 00000868 BFSVC: 'Error copying boot files from C:\Windows\boot\EFI to \\?\GLOBALROOT\Device\HarddiskVolume1\EFI\Microsoft\Boot! Last Error = 0xb7' 2024-07-25 17:12:54, Info CSI 00000869 BFSVC: 'ServicingBootFiles failed. Error = 0xb7' 2024-07-25 17:12:54, Info CBS Progress: UI message updated. Operation type: Update. Stage: 1 out of 1. Percent progress: 94. 2024-07-25 17:12:54, Error CSI 0000086a@2024/7/25:05:12:54.647 (F) onecore\base\wcp\plugins\bfsvcai\bfsvcai.cpp(479): Error HRESULT_FROM_WIN32(14077) originated in function Windows::WCP::WCF::BfsvcInstaller::CommitChanges expression: Result [gle=0x80004005] 2024-07-25 17:12:54, Info CBS Could not get active session for current session file logging [hrESULT = 0x80004003 - E_POINTER] 2024-07-25 17:12:54, Info CBS Could not get file name for current session file logging [hrESULT = 0x80004003 - E_POINTER] 2024-07-25 17:12:54, Info CBS Added C:\Windows\Logs\CBS\CBS.log to WER report. 2024-07-25 17:12:54, Info CBS Added C:\Windows\Logs\CBS\CbsPersist_20240724122557.log to WER report. 2024-07-25 17:12:54, Info CBS Added C:\Windows\Logs\CBS\CbsPersist_20240724060753.cab to WER report. 2024-07-25 17:12:54, Info CBS Added C:\Windows\Logs\CBS\CbsPersist_20240722200643.cab to WER report. 2024-07-25 17:12:54, Info CBS Added C:\Windows\Logs\CBS\CbsPersist_20240719210636.cab to WER report. 2024-07-25 17:12:54, Info CBS Added C:\Windows\Logs\CBS\CbsPersist_20240627004301.cab to WER report. 2024-07-25 17:12:54, Info CBS Not able to add pending.xml.bad to Windows Error Report. [hrESULT = 0x80070002 - ERROR_FILE_NOT_FOUND] 2024-07-25 17:12:54, Info CSI 0000086b@2024/7/25:05:12:54.937 CSI Advanced installer perf trace: CSIPERF:AIDONE;{c5f0e9d7-e844-4507-89e4-701b5a747221};(null);903569us 2024-07-25 17:12:54, Info CSI 0000086c End executing advanced installer (sequence 0) Completion status: HRESULT_FROM_WIN32(14077) 2024-07-25 17:12:54, Error [0x018049] CSI 0000086d (F) Failed execution of queue item Installer: Boot File Servicing (BFSVC) Installer ({c5f0e9d7-e844-4507-89e4-701b5a747221}) with HRESULT HRESULT_FROM_WIN32(14077). Failure will not be ignored: A rollback will be initiated after all the operations in the installer queue are completed; installer is reliable[gle=0x80004005] 2024-07-25 17:12:54, Info CBS Could not get active session for current session file logging [hrESULT = 0x80004003 - E_POINTER] 2024-07-25 17:12:54, Info CBS Could not get file name for current session file logging [hrESULT = 0x80004003 - E_POINTER] Looked like it could not find or update the boot files. A quick trip into Windows RE and some failed attempts to run bootrec /fixboot telling me access was denied I eventually stumbled across this: https://answers.microsoft.com/en-us/windows/forum/all/windows-10-bootrec-fixboot-access-is-denied/747c4180-7ff3-4bc2-b6cc-81e572d546df diskpart select disk 0 {or your boot disk} List part Select part 2 {whatever the 100MB or so UEFI partition is} assign letter=v: exit format v: /FS:fat32 bcdboot c:\windows /s v: /f UEFI This rebuilds the UEFI partition and then it can install updates again. I believe this is down to my imaging method creating template VMs in Hyper-V then mounting the VHD and injecting drivers then capturing an FFU. This used to work fine but it seems something - the mounting of VHDs by Server 2022 or the DISM tool - has changed causing this lovely aberration and requiring this manual fix on all effected machines. My displeasure with Microsoft over this is incandescent. EDIT: After much messing I figured out you can perform the fix on a live system (in seconds), it will not let you format the EFI partition but you can nuke and recreate it with admin privileges as below, just save as a .cmd or .bat file and runas Administrator: mountvol x: /s x: rd /s /q EFI attrib -a x:\EFI\Microsoft\Boot\BCD bcdboot c:\windows /s x: /f UEFI pause

Perhaps an in place bios reader/writer to copy from one to the other. Will dupe the serial dmi though https://www.amazon.com/Organizer-Socket-Adpter-Programmer-CH341A/dp/B07R5LPTYM/ref=mp_s_a_1_4?keywords=bios+programmer&qid=1680247603&sr=8-4

You can do it manually via the csv import method, not great but workable. Powershell can help tame the files into the required format with a bit of work.

Devils advocate, do they need to know. Just need a decent enough router/switch to run 1:1 SNAT on the interface that they see, structure it how you like and as long as you don't go over the allocated number of IPs it can be properly segmented if overly complicated. Unfortunately most providers are awful when it comes to stuff like this, ideally they should give you an ip pool you can divide up as you see fit and just define a summary route from the school with division and routing handled in house.

Have just done 200 with configurator before Apple broke it with the latest osx. Used two 5 port powered USB hubs to do 10 at a time and upgraded to an ssd in the Mac mini as the brain dead software will 'download' the software every single time. It's like they don't realize that not everyone works at Apple. Once they are on the Apple school manager it is way easier but the enrolment stage is rubbish. The MSP people I have talked to use huge powerd hubs and a few more redos when they fail. I had to use a PC with iTunes to restore an iPad recently as the latest osx refused with the usual nothing is wrong error messages.

Could this be because of the print nightmare 'fix' that Microaoft did a while back. It blocks install of drivers from a print server due to unfixable security vulnerabilities. There is a reg key/gpo work around. If the computers were running that old a version it may not have got that patch till they were upgraded. https://www.google.com/url?sa=t&source=web&rct=j&url=https://community.spiceworks.com/topic/2328739-best-way-to-deploy-printnightmare-proof-printers-to-non-admin-users&ved=2ahUKEwjjkoTBh_z5AhUGR2wGHeytDI4QFnoECAQQAQ&usg=AOvVaw0k5B3yy476s6LBENMMOfKb

Have you tried updating the display adapter firmware through the Wireless Display Adaptor app on a machine that will connect and have you tries older wifi drivers. Miracast is a massive pain to diagnose in windows.

In the fun new world of lockdowns, pandemics and remote work sometimes you want to share a whole screen you don't have. Perhaps a quiz PowerPoint you want to share but keep your only monitor for managing the call and chat. What you really need is a virtual screen, in older versions of Windows there was a way to force a phantom VGA output but that has been removed. Luckily Windows 10 added Indirect Display Drivers(IDD) which allow you to add a virtual monitor to your system without any additional hardware. This is mainly designed to send the screen content through USB, Ethernet or other means 1. Happily someone has done the work and written a driver to give you a virtual 1920x1080 (or whatever resolution) screen you can share through any collaboration app that can screen share. As a byproduct of their cool sounding screen over USB to android software they also released the standalone driver: Full Instructions If you want to read more about IDD look here at Microsoft or to the Sample Github code. I have tested this with both Skype and Facebook Messenger to run video call pub quiz and it worked really well both times. I felt the need to document this as solutions like Window Powertoys Fancyzones, Display Fusion and the others I tried were perfectly able to split up windows into whatever pattern but these did not show up as separate shareable screens to Skype/Teams etc. I used PowerPoint presentation mode to get easy controls on my real screen and if you are looking for remote quizzes (at least while some of New Zealand is in Level 4 or 3 lockdown) check out the Believe It Or Not Quiz Facebook Page.

I have been looking into this recently to try and rationalize our papercut setup after taking over a school. Unfourtunatly it is not just AAD DS, that gets you a nice LDAP server but its still locked away in the cloud. In order for anything local to access it you need to set up a VPN route from Azure to your local network which is also billed by public IP and by bandwidth used. If running radius you'll need another server running your choice of software to talk back to it. You can run this in azure as a VM but that costs more and you still need the VPN so local stuff can access it. This is a headache and so there are third parties that have worked around this particular headache for radius, I don't think they even require a password reset. https://www.securew2.com/blog/azure-ad-802-1x/ https://jumpcloud.com/product/cloud-radius Given how our liscencing is funded down here I am actually leaning towards spinning up a whole new local AD with a dump of users from AAD and turning on AD sync to get local services back. Even with AAD DS users need to reset their passwords after it is setup for them to be usable by AAD DS. The cloud push at all costs is responsible for a lot of issues and unnecessary spending when a hybrid system remains superior in many regards. Especially cost. Absolute minimum for use was looking like 100 gbp /month for the lowest tier of everything assuming our traffic was not too high.

Minecraft Edu has no servers per say but relies on peer to peer connection to a host pc that can have up to 30 users in a world at any one time. Teacher laptops melt at around 10 users so we spun up some virtual machines to put the hosts on a wired desktop machine. The discovery stuff is also multicast over a single subnet but we configured the switches to forward between subnets.

It's probably a transferred .doc file, save it as .docx file format and it should quit complaining.

If you mean deploy them then Intune or SCCM plus Intune along with windows store for business. If you have infinate time I think you can build them into an image but that requires a reimagine to add new stuff.

Out of the loop on the new MSI but was using the Frontmotion build for years 6 or so years ago which had AD configuration built in back then https://www.frontmotion.com/fmfirefoxce/ Stopped using it a long time ago thanks to the rather windows profile unfriendly unix style of settings and history that vomited thousands upon thousands of files till the profile sync broke. They may have fixed it since but have been using chrome msi and admx templates for so long now. Maybe when Edge switches to the Chromium engine it will be necessary to give FF another shot to give two actual choices on each station.

Had good luck using MDT in this kind of setup. Even with generic USB NICs you can boot an mdt deploy image from USB stick or CD. As long as the NIC drivers are integrated it works fine. Not sure what RM builds in but I am aware that you need to be very careful with driver selection profiles and Intel drivers. I have had deployments fail massively as it picked up a generation before or after of Intel drivers and messed the whole install.

Unfortunately they have not, I have the latest Galaxy watch 46mm. The one ui update is nice but still only 2.5 days of battery life even with the big battery. The fitness tracking is rubbish compared to a Fitbit. Floor count set at 10ft not 8 so your lucky if you get half the floors you actually do. Heart rate not that great either. Slow to charge. They are shiney and I have kind of got to liking the ability to answer a call on it, stream spotify to it, answer text and messanger messages etc. It just feels clumsy and even with all the cool features feels constrained by the apps.