ryanplym

Thats Ollie, I already have a VM in place just for this. the IT teacher has full access to this VM, it already has XAMPP and all the fun stuff installed and also a outbound firewall rule for port 80 to this vm so students can show their work off to whoever at home. I feel have done everything correct from my side but I dont think installing XAMPP on all pcs is a wise move but who am I - just the IT guy

i have a folder with email print offs, people would laugh at what they have asked us to do, unfiltered, unmonitored access to SLT ipads, they are able to log into their own personal accounts, not have it linked to their school email just as a start. I do have email filtering put in place for teaching staff that pick up on "gift cards" and scams etc this has stopped alot of issues but give it time and they will ask for unfiltered access for all :-)

Thanks I agree. I have spoken to SLT multiple times and had long chats with them but they say that he is the teacher and I am not in charge of student behavior. If the students access something they are not supposed to then that is their choice. It is down to the teacher to manage their behaviour. SLT love this teacher so I have no chance. I am just concerned about installing XAMPP and getting it in the neck that the PCs are slow.

That reply msde me laugh. We really have gone out of our way to provide. Even as far as seperating his IT room, giving him a dedicated IP range and his own special smoothwall filtering (Everything off except adult). I dont know any other schools that would go this far

Thanks, he knows about the web server, has access to it but really wants every pc to have xampp installed. Teachers always get what they want

Hi Our IT teacher wants me to install XAMPP Visual Studio Code and FileZilla on all the PCs. Personally I think its a silly idea as we already have a dedicated web server for the students to use to test their websites. Do other schools do this or am I being too soft on our IT teacher? Any thoughts about this would be useful or ideas that you have put in place for key stage 4 / 5 for their coursework Thanks

Thanks 2097, I have checked all enforced GPOs and cant see anything obvious. I also used the policy analyser tool. I am using pass-through authentication with SSO enabled. I will keep trying

Thank you thimon DavR thanks that's a good shout. I did check the domain and it is matching with what I have in azure. The students have their full email address in the email field although I will check the attributes in the morning.

HI thimon Thankyou, would you mind screenshotting your group policy settings if thats OK. This is the group policy we have enabled for computer configuration and user configuration: Computer Configuration (Enabled Policies) Administrative Templates - Microsoft Office 2016 (Machine)/Licensing Settings Enable EDU Org ID Sign In in Office from Windows Store: Enabled Use shared computer activation: Enabled Administrative Templates - OneDrive Always use the user's Windows display language when provisioning known folders in OneDrive: Enabled Prevent users from moving their Windows known folders to OneDrive: Enabled Prevent users from redirecting their Windows known folders to their PC: Enabled Set the sync app update ring: Deferred Silently move Windows known folders to OneDrive: Enabled Tenant ID: xxxxx Folder Options: Desktop, Documents, Pictures Silently sign in users to the OneDrive sync app with their Windows credentials: Enabled Specify the OneDrive location in a hybrid environment: Enabled Authenticate first against: SharePoint Online Use OneDrive Files On-Demand: Enabled Administrative Templates - Windows Components/Device Registration Register domain joined computers as devices: Enabled Administrative Templates - Windows Components/Internet Explorer/Internet Control Panel/Security Page Site to Zone Assignment List: Enabled Zone Assignments: https://device.login.microsoftonline.com (1) https://login.microsoftonline.com (1) https://aadg.windows.net.nsatc.net (1) Administrative Templates - Windows Components/OOBE Don't launch privacy settings experience on user logon: Enabled User Configuration (Enabled Policies) Administrative Templates - Microsoft Office 2016/Miscellaneous Suppress recommended settings dialog: Enabled Administrative Templates - Microsoft Office 2016/Privacy/Trust Center Allow Microsoft to follow up on feedback submitted by users: Disabled Allow the use of connected experiences in Office that analyze content: Disabled Allow users to submit feedback to Microsoft: Disabled Disable Opt-in Wizard on first run: Enabled Enable Customer Experience Improvement Program: Disabled Send personal information: Disabled Administrative Templates - Microsoft Office 2016/Subscription Activation Automatically activate Office with federated organization credentials: Enabled Administrative Templates - OneDrive Allow users to choose how to handle Office file sync conflicts: Enabled Always use the user's Windows display language when provisioning known folders in OneDrive: Enabled Coauthor and share in Office desktop apps: Enabled Continue syncing on metered networks: Enabled Continue syncing when devices have battery saver mode turned on: Enabled Disable the tutorial that appears at the end of OneDrive Setup: Enabled Prevent users from syncing personal OneDrive accounts: Disabled Administrative Templates - Windows Components/Internet Explorer/Internet Control Panel/Security Page Site to Zone Assignment List: Enabled Zone Assignments: https://autologon.microsoftazuread-sso.com (1) *.sharepoint.com (1) *.onedrive.com (1) Administrative Templates - Windows Components/Windows Hello for Business Use Windows Hello for Business: Enabled Do not start Windows Hello provisioning after sign-in: Enabled

Hii I hope I have posted this in the correct section as all our clients are Windows 11 Our IT Teacher wants single sign on for OneDrive. - I have followed the procces step by step from Microsoft here https://learn.microsoft.com/en-us/sharepoint/use-group-policy#SilentAccountConfig - Added the registry keys though group policy and tried adding manually - I have joined the PC to Azure AD using the hybrid configuration When a student logs in, it prompts them to setup onedrive, asking for a email address. When they type their email address, it logs them straight in not even asking for a password and will remain logged in if the student revisits the same PC but when they use another PC, it prompts them to login which frustrates the IT teacher. SSO works fine with edge, office applications, Teams but onedrive is the only application that prompts for a email. I know I am missing something, I just dont know what. Any help is appreciated - Thankyou :-)

Do you have this policy enabled in your computers OU or users OU? I have mine enabled in both. I wonder if this might be the cause?

Hi Thanks for your reply, I just checked and this has been enabled. Thanks for the suggestion

Hi We are having a strange issue, in our computer labs, when a student signs into windows and clicks on, for example, Microsoft Word, it prompts them to sign in although Teams logs in automatically, edge/chrome logs them in but none of the installed apps. OneDrive is also prompting them to sign in. I have changed the following: Administrative Templates/Microsoft Office 2016/Subscription Activation/Automatically activate Office with federated organization credentials Enabled User Configuration\Preferences\Windows Settings\Registry Key Path: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\microsoftazuread-sso.com\autologon Value Name: https Value Type: REG_DWORD Value Data: 0x1 (1) Key Path: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\windows.net.nsatc.net\aadg Value Name: https Value Type: REG_DWORD Value Data: 0x1 (1) User Configuration\Administrative Templates\Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone\Allow updates to status bar via script Enabled One of the IT teachers had a observation this morning which did not go down well at all. I am not sure what else to do. I have used delprof to remove any profiles on the machine, did gpupdate /force, ensured the policy was enabled Any help or support is very much appreciated Thanks

We had exactly the same issue. I noticed it was to do with our smoothwall system. On smoothwall I added a rule (and placed it on top within guardian --> Https inspection) the following: Everyone Microsoft Office 365 Everywhere Always Validate certificate only About 20 minutes later, emails started coming through

Sorry for not messaging sooner The copy link works perfectly, except out staff wont do that as they only send the email directly to that shared mailbox. I am trying to find a way that we can convert the permissons from the shared mailbox to the invidiual user account, they can see the shared mailbox in outlook, when they click on inbox they see the file that has been shared although when they click to open the file, it requests pemission. Its causing a issue for the department. Thanks for all your help so far, I thought it was me just being stupid