JSpaced

I ended up writing a scheduled task with a delayed time. Still not 100% proof, but then our stations are doing SO MUCH on startup, I think things get pushed to the back of the queue and beyond their timeout thresholds.

Ultimately we spent EVEN MORE money and bought Jamf, which helped us dramatically. It's still the IT suite we spend most of the time in. More than any other in the two schools I look after. Other issues that came since then: Any student signing in will automatically eat 1GB of the Hard disk before they do anything. Adobe Scratch disks will consume whatever is left of the hard disk until the entire computer stops working Mobile profiles created in concert with Intune/ Entra sign ins will corrupt randomly for no reason and require deletion Regular complete wiping and rebuilding of the Macs is required to keep them in a state approaching working. You need: hard disk space to download the iOS update + hard disk space to unpack the update + hard disk space to install the update + hard disk space to accomodate the failed downloads from the first step. It is extremely hard to turn off just the bit you want to turn off on a Mac, even if you have Jamf helping you. If a user forgets their password, they will need help on the Mac because the keychain will demand the original forgotten password, even after Intune confirms and changes the new temporary password. Honestly I think we only have CCTV in the Mac suite to stop me destroying them all. This summer we are replacing with Windows.

Hello all, We're running Intune to manage our Windows devices and we have a deployment of Papercut Print Deploy (currently v1.9.1836) We're noticing a consistent problem with the Papercut client on first login. When the user hasn't used the station before, the UI for Papercut fail start properly. The services run fine. In some cases it connects the printer correctly, in some cases it fails, but the system tray icon fails to start and the user can't view their installed printers etc. The only workaround is to get the user to sign out/ in again and everything works as expected. I understood this to be a problem in a previous version that had been resolved. Has anyone else encountered and solved this problem? Thank you in advance.

If only it was that simple. We're getting rid of AD in favour of Entra because of the constant demand to "do more with less" so we'll be losing our on site servers at some point.

Hi David, You're definitely more up on RPs than I am. The problem I've got isn't a question of hardware or connectivity, as such, it's more how can I safeguard the kids while they've got access to these computers? Originally I was hoping to isolate the RPs from ANYTHING on the net, then rely on RealVNC to be able to bring in e.g. downloaded scripts or other bits the students are putting together. It feels like the RPs are built with freedom of the user in mind. (Sign in as an admin, install things, delete stuff, knock yourself out). It just feels so anathema to everything we've built on the Windows network. How are you balancing safeguarding the students with allowing them to study using the RPs? Edit: Just as a side note - we took away users ability to change Wi-Fi settings on our Mac suite (spits on the floor) because the students found if they attempted to connect it to the Authenticated Wi-Fi (for BYOD) they could stop the Macs working until someone came along and undid it on all of them. That's the kind of thing I want to restrict. I want to present the device "as is" and add features/ apps as requested, but I get the impression that's NOT how it works with RPs? J

Hey everyone, I'm one of the IT techs for a busy secondary school and the Computing Department have bought Pi4s to teach coding, robotics etc. etc. We're also trying to tighten up all our security and safeguarding for the CE+ certification. (It feels like me and the team are gradually being stuffed into a mail sack from which we're expected to do the same job.) (Tangentially related: Our Windows and Mac devices use an Edge Extension to ensure Internet Filtering via Smoothwall, while Smoothwall also provides an app monitoring all Windows devices on the network for safeguarding concerns.) The problem I'm having is the Raspberry Pi 4s are not really conducive for this kind of strict security, filtering and monitoring. What I want is to plug the Pis in via USB and the students to RealVNC or similar to them from the suite computers. That way the Windows PC is doing the filtering and monitoring and the students can copy/paste downloaded files via VNC into the SD Cards of the Pi. I've followed the various instructions online: Installed Bonjour Print Services on my station. Added dtoverlay=dwc2,dr_mode=peripheral to the config.txt file. Added modules-load=dwc2,g_ether to the commandline.txt file. Pi boots up, connected via USB cable to my PC and... nothing. There's no peripheral device, I get a "USB Billboard Device" on Device Manager, which implies something isn't working. Has anyone been able to remote control a Raspberry Pi via USB on a Windows PC? How do you address safeguarding concerns, like: User identification, Internet Filtering, Safeguarding monitoring, on your Raspberry Pis? Thank you in advance, I am tearing my hair out...

Have had confirmation this is the case.

Update - it's not just us. It's being worked on. Lovely lady on the phone said: "I know exactly what you're gonna say..." Thank Primus for edulink...

We're getting: Fault Code: 1428-0441-5100 "My SIMS Documents" is denied. - currently 13th in the phone queue so don't think it's just us? J

Jamf Pro. Don't get me wrong, I think it's a GREAT MDM. I just resent having to use it at all!

Hmph. Took some more digging but I stumbled on the answer: between 2023 and 2024, Apple changed the context of the WiFi icon from "menuExtras" to "Control Center". I presume this is documented somewhere? Anyway, if anyone else is having this issue: REMOVE WiFi icon in Sonoma - Jamf Nation Community - 315435 "Domain" is now: com.apple.controlcenter Plist required is: WiFi 8 So it's not "This key is false", it's now "this key is 8" which makes perfect sense and is easy to use and administrate.

Hi gang, TL;DR version: Using Jamf with Entra to authenticate students. Need to hide the WiFi icon from the students. No built-in configuration profile payload to do so. Think it's a User Level configuration, rather than computer level. Can't apply User Level configuration to users because they are local users created using Entra credentials. Thoughts? Ranting version: First off: hate Macs. Hate that I have five suites up on our top floor and I seem to spend all my support time in the bloody Mac suite. We bought Jamf. Because the answer to "we bought PCs but more expensive, then we bought apps but more expensive" is of course "we bought an MDM to justify the expense of the first bit". The little darling cherubs (god love 'em) keep clicking the WiFi icon. (Apparently this is NOT in the menu bar, despite being in the menu bar, it is apparently in the control center). They then try to connect to a WiFi which causes all kinds of problems for the ethernet connection. (For reasons the WiFi is unauthenticated at connection and authenticated via capture portal.) We want to take the WiFi icon away from the darlings and while there is a "Do not show the WiFi icon" setting inside system settings, inside Control Center, there doesn't seem to be a pre-prepared Configuration Profile payload for it. I did find this in Jamf forums However it doesn't work for me and I think that's because it's a USER level configuration, rather than a Computer Level? We use M365, our users are Entra Users. The authentication via Jamf is Entra based (don't get me started on the password reset debacle/ can't delete that folder because I'm only the system administrator nonsense). I -THINK- because our users are Entra users, User level Configuration Profiles cannot apply? So my question is: how do I hide this icon and stop the little delights from messing up my Mac Suite and putting me back in there with the awful, awful devices? NB: Only a few users are Admins and Super Users. Obviously student accounts are not, so I don't know how to make a script run, on login that requires SUDO at the start.

How are they with things like: Video Editing (movie creation) Blender (or alternative) Python (or similar programming) Safeguarding Monitoring and Filtering I'm not familiar with Chromebooks, so I'm genuinely interested. J

We identified the offending account (our utility systemadmin) and amended the security on the printers to DENY that account permission to change the printer settings. This seems to have fixed it.

Hey everyone, really hoping someone else has cracked this. We have an InTune deployment, Windows 11. Our Languages Teacher has requested Chinese and German keyboard layouts for teaching. Installing language packs - no problem. Can be done at the device level. However: adding keyboard layout choices is proving tricky. Powershell: set-winuserlanguagelist command is the obvious method, but doesn't work in a locked down environment. It needs to run in the user context and I don't want users to be able to run Powershell. We also locked down the Settings App pages to prevent users leaving computer suites in confusing Cyrillic or whatever. Has anyone solved the problem of proving additional keyboard layout choices for select users or devices? Cheers in advance.

Not totally relevant but where I live, two rules apply to the road: Everyone knows where I'm going. The little blinky orange lights are a waste of space. If I can't see it, it's probably not on the road. This includes stuff I don't look at.

OK, so apparently the person is me. We have a Sys-admin account we use for admin stuff on stations and I logged onto a PC with Print Deploy Client, whereupon the account unshared the printer from the server. It doesn't do it all the time. How do I prevent it? Do I just submit this to Papercut? J

Just want to say, once again, big thank you to EduGeek. First time, thought: service hasn't started properly after an update. Third time, thought: have we got malware we don't know about? Fifth time, thought: someone's going to have an idea. Print Deploy has recently been installed here too and that's when we started having our main virtual print queue just unshare itself. Bizarrely we have another virtual print queue that remains unaffected. Thank you for pointing us at the Operational Logs - we'll review and submit the issue to Papercut.

Update - we may have got Single-Sign On to work on OneDrive.

Hey guys, My Google-fu is failing me and I don't actually know a lot about Macs. We got told we HAD to have them and now they're comfortably eating up two or three times the support time of any other suite in the school. We can't get Single-Sign On for Office Apps to work. We can't get the OneDrive client to single sign on when students sign in. We can't get the Adobe Creative Cloud to single sign on when students sign in. So at the moment a student signs in with their password a minimum of four times. (Not counting all the "bonk - you wrote that wrong" sounds. That little dull note makes me grind my teeth now.) I'm looking for a solution to stop the students from saving to /users/username/documents/ because they've usually given up on the third "bonk" noise and just saved to the Mac's local harddrive. So now the Harddrives are rammed with Photoshop and Sibelius compositions. I want to hide documents folder from finder AND from Finder's sidebar, but I don't know where to start. Also I hate the Macs, with a passion, and I find myself unconsciously resisting learning more about them. I mean: I'm also having trouble packaging Adobe Apps for the Macs and the only discovered solution is: Package the Package and sign the Package with an Apple Developer Certificate that you somehow paid for and acquired. I'm not joking when I say they are causing me stress. I don't want to package the package. I want it to install the package. But anyway: Finder customising for all users on login? How? Please? Pretty please?

Hi, largely the instructions WERE correct, but they were also naff. They needed a couple of readings to parse properly.

Sorry to resurrect this thread, but I wanted to say a big thank you to everyone who contributed, you've just saved my school a fortune as we've upgraded the Kitchen workstation from Windows 10 to Windows 11. We convinced Civica to send us the installation files and it included the worst written ReadMe which missed off stages. "At the end of the install 2 errors will pop up if you hit ok for the first one then ignore the second one." I mean, don't update your installers guys, just leaving it erroring. Don't worry about an automatic updates to your software, we'll just copy/paste everything in the folder to another PC. No worries. But ending optimistically: thank you everyone.

I work for a High School and we've taken on a Primary School. They have some old USB Lego WeDo 1.0 kits which they program with Scratch 2.0 (the later and online versions of Scratch don't do WeDo 1.0) I created a package and tested/ deployed it at our High School - absolutely fine. I deployed the same package and found that clicking on "add extension", clicking "Lego WeDo 1.0" and clicking "OK" does nothing. No response at all. There's a generic Stack_Buffer_Overrun error in Event Viewer and that's it. There's very little difference between our two sites (when we took them on, we created a new Domain for them, mirroring ours and migrated users over to it. I can't see what's causing this problem when there's so many similarities between the two sites. Has anyone else encountered this? Did you have any luck fixing it? J

I don't know about you lot, but I was done talking about this...

I think the primary concern is litigation. It SOUNDS like the driver of a truck filled with calor gas tanks is expected to slam on his brakes as a mother of three jumps out from between two vans with her buggy, because the driver of the truck "bears the responsibility". Anyway, back on topic, as you say. "Yes, we want you to help us, but no, not like that. In a way that allows us to seamlessly integrate with... whatever it is our laptops DO, without bothering us about it. Make it just work." Yeah, no, hotspot yourself or shove off to Costa and use their Wi-Fi.