ThomL

The issue comes that it is an entity/organisation/charity/business/...whatever of it own right that sits outside of the school, has it's own books/finance etc. Ideally this should mean it has it's own internet that is managed as part of that business, but as it's a businesses started by the school (I believe) there would never be the investment in this. The school has internet connectivity, so just as it's the schools rooms/facilities that are let by this other organisation (that I believe to be owned by the school), the internet would fall into the schools resources they wish to make available. To be clear - I'm not looking to evade anything/ get around DfE stuffs. More seeking advice and trying to produce a strategy that will work here with their setup. As an example, there is a letting that will have multiple different vendors with the site basically used as a convention centre in a few weeks. Vendors require internet access to complete card transactions as well as just general access, it's part of the stipulation for the letting - card machines aren't going to work with radius auth, at least not in the easy way needed for the vendors or with MITM in place - they are expecting a network they can just join. If this is a separate organisation that has made the letting agreement with these vendors (even if owned by the school) surely the DfE stuffs don't hold relevance, it now becomes about legal obligations and duties similar to a convention/business centre or even a pub that offers WiFi would have to honour? The lines feel blurred for this situation, these visitors aren't guests of the school - or have any relevance to the school, they have hired a venue from an organisation that isn't the school... I'm not being combative, or trying to play the system. Just trying to give more info and seeking thoughts and advice if anyone wants to share any thoughts. The school's actual WiFi strategy is still a bit of a problem - it was/is felt that MITM is too hard to implement on guest devices - we are going to shift to radius auth for guests so at least traffic is tied to a user account.

@Primus just for clarification - are you decrypting guest device traffic with MITM for your VPN mitigation/filtering strategy? If so, how do you handle onboarding regarding installation and trusting of required certificates? This thread has me thinking of our strategy and if we are in our best stance moving forwards - we have complications that letting of the school room/pitches/etc. to the public/third-parties is handled by a separate business, the use of internet has been included with these lettings. At this point I'm not sure if the DfE holds relevance for this situation - it is not the school itself granting the internet access, however it is piggy backing the schools connectivity. Thoughts anyone?

I threw in an edit to my post - interesting idea, good luck!

Interesting project. I've never touched once of these servers - just the traditional SIMS server config. Is there a VPN setup on the server to connect it to the cloud infrastructure? **EDIT** A quick search of the forum suggests VPN would be used as well as this gem: "New Third Party connectors:If you re-image or replace a machine with the TPC installed, then you'll need to log a new install with the ESS 'Professional Services Team' which will charge for each new TCP you need installing.(I think around £350-£400 per install, so worth trying to avoid re-installs if you can.)" Assuming they have their cloud environment segmented you'll need several nics on the VM with each one configured with relevant VPN, some tweaking of the connect ini to connect to the different SIMS instances via the different VPNs - not even sure this can/will work to be honest. You might need multiple instances of software like Wonde installed and configured - this could also be painful. Might not need multiple VPNs depending on how this is all configured and works? Seems like it will be a pain in the arse! Still think it could be an interesting project.

We have the same stance and purchased eStream as an alternate to Microsoft Stream.

Our support company contacted ESS, they provided a patch that we could then use with a CSV to wipe all current student emails and replace with the details in the CSV. CSV had to be called "EMAIL_PHONE.CSV" and have the headers: person_type: S for student surname, forename, midname: leave blank upn_adno_ni_tt: admission number (leading zeros will be applied automatically on import, if necessary) email_phone: email address If this exists already, it will be updated with the flags (below), otherwise created (with flags) notes: leave blank location: W for "work" main: T for true primary: T for true USE_FOR_FEES_DOCS: leave blank Patch applied was "Patch 23212 [3.62.669-3.64.999] PRB16051 - OD Bulk import Email address" this maybe out of date now with a newer version of the patch needed, we applied this patch in March 2024

I wanted to get this setup recently - speaking with Smoothwall they said support for the iMac IDex client would be dropped in upcoming releases and it would stop working if we did install the old version of the software - not sure if this is really the case or if they were trying to make sure I setup a supported configuration. This doesn't help much, sorry! Just sharing my experience. My fix was to stop using Mobile Accounts on the iMacs when students login, this causes the login authentications to reach AD rather than being cached on the local iMac, then the IDex software installed on our DCs syncs the logins to the Smoothwall without needing the IDex client on the iMacs.

ChatGPT produced the following code, which seems reasonable on first review: # Import SharePoint Online Module (Make sure SharePoint Online Management Shell is installed) Import-Module Microsoft.Online.SharePoint.PowerShell -ErrorAction Stop # Parameters $csvPath = "C:\path\to\users.csv" # Path to the CSV file with user details $adminGroup = "SecurityGroupName" # The security group you want to add as Site Collection Admin $tenantAdminUrl = "https://yourtenant-admin.sharepoint.com" # Your SharePoint admin URL $tenantDomain = "yourtenant" # Your tenant domain # Connect to SharePoint Online Connect-SPOService -Url $tenantAdminUrl # Import users from CSV $users = Import-Csv -Path $csvPath foreach ($user in $users) { try { $userPrincipalName = $user.UserPrincipalName Write-Host "Processing OneDrive for user: $userPrincipalName" # Get the OneDrive URL for the user $onedriveUrl = "https://$tenantDomain-my.sharepoint.com/personal/$($userPrincipalName.Replace('@', '_').Replace('.', '_'))" # Add the security group as a Site Collection Admin to the user's OneDrive Set-SPOUser -Site $onedriveUrl -LoginName $adminGroup -IsSiteCollectionAdmin $true Write-Host "Added $adminGroup as Site Collection Admin for $onedriveUrl" -ForegroundColor Green } catch { Write-Host "Failed to process OneDrive for user: $userPrincipalName" -ForegroundColor Red Write-Host $_.Exception.Message } } # Disconnect after operation Disconnect-SPOService CSV would contain student email addresses: UserPrincipalName [email protected] [email protected] You'd create a group to add the members of staff requiring access first and update this in the script as well as the other option that need updating - target a single test user first to hopefully work out kinks, then load up the CSV with all student email addresses once happy it's working. Maybe?

We outsourced to our support company too, having someone to contact if something is misconfigured/if there is fallout was deemed worth is when we carried out risk analysis. I don't think it was too expensive either, included reconfiguration/setup of solus too.

We've had similar buzzing that was remedied with Ground isolators like the one you've purchased - we have many rooms with this issue, I don't want to spend £5 per room to resolve the issue. I'm hopeful to find a cheap and easy way to DIY the ground isolation, but haven't spent time digging into this yet.

quick google - £735.00 road tax a year

Seems the guys in this thread managed to use discover to get it working: [sIMS] Custom Behaviour Alerts (edugeek.net)

Not sure how many emails your sending but lots of good things said about SMTP2GO: Reliable & Scalable Email Delivery Service on reddit - the free tier allows 1000 emails sent a month I believe

Transparent setting: Web filter policies: This might be the part you're missing? The unauthed requests being assigned to a group in the transparent polices and then allowing all traffic from that group on the web filter side?

We have this config at the moment, using a location for the guest WiFi - location is the subnet used by the guest WiFi:

You've double checked the computer is a member of your new custom collection that has the task sequence deployed to it? Maybe right client the computer in MECM and clear required PXE deployments (or something like that)

Something like this, maybe? Updating this part to contain the username: if (!inputs.job.username == "USERNAME HERE?") { // Not the target user return; } /* * Daily color page limit * * Sometimes, a high price tag just isn't enough to discourage users from * printing in color. This recipe imposes a fixed limit on the number of color * pages a user can print per day. * * Imposing a color page quota is a better solution than separate balances for * color and black & white. Separate balances are more confusing (two accounts * to manage) and also can lead to waste. The user may for example run out of * black and white credit, and therefore be forced to print in color wasting * resources. This method (an overlayed color quota) solves these issues. */ function printJobHook(inputs, actions) { // Modify this value to change the daily color page limit. var MAX_COLOR_PAGES_PER_DAY = 20; if (!inputs.job.isAnalysisComplete) { return; } if (!inputs.job.isColor) { // Not color so no need to check and apply any limits. return; } if (!inputs.job.username == "USERNAME HERE?") { // Not the target user return; } var currentColorCount = inputs.user.getNumberProperty("color-per-day"); if (currentColorCount == null) currentColorCount = 0; var currentDayIndex = inputs.job.date.toDateString(); var dayLastSeen = inputs.user.getProperty("color-day-last-seen"); if (dayLastSeen == null || dayLastSeen != currentDayIndex) { // It's a new day. Reset the current count value to zero. currentColorCount = 0; } currentColorCount += inputs.job.totalColorPages; if (currentColorCount > MAX_COLOR_PAGES_PER_DAY) { var deniedMessage = "This print job has been denied. You have exceeded" + " your daily limit of " + MAX_COLOR_PAGES_PER_DAY + " color pages per day. Please print in grayscale."; actions.client.sendMessage(deniedMessage); actions.job.cancelAndLog("This job was denied because you have exceeded" + " the daily color quota."); return; // If we're here, then it's OK for the job to proceed. // Save the current daily count actions.user.onCompletionSaveProperty("color-day-last-seen", currentDayIndex); // Note: Set is used for simplicity (see "Rate limit by department" // for use of increment). actions.user.onCompletionSaveProperty("color-per-day", currentColorCount) } }

This isn't a very helpful reply - we have Meraki via CtC with a smoothwall and didn't experience the issues you describe, we allowed the traffic for the Meraki devices through the smoothwall and all has worked well. Slight slowness in responsiveness of the Meraki dashboard sometimes, but that's about it. Guess what I'm trying to say is although painful at the moment, it shouldn't be and should be easy to manage once you have things setup correctly!

Chat GPT's finest: # Save the current settings for dsa.msc $currentKey = Get-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" $backup = @{ NoViewOnDrive = $currentKey.NoViewOnDrive } # Enable advanced features by setting the appropriate registry key Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name "NoViewOnDrive" -Value 0 # Launch Active Directory Users and Computers with advanced features Start-Process dsa.msc # Pause for the user to close dsa.msc Write-Host "Press any key to revert the registry settings and exit..." $x = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") # Revert the registry settings foreach ($key in $backup.Keys) { Set-ItemProperty -Path "HKCU:\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" -Name $key -Value $backup[$key] } Write-Host "Registry settings reverted. Exiting..." "Explanation: Saving Current Settings: The script saves the current registry settings related to the advanced features to ensure it can revert them after usage. Enable Advanced Features: It modifies the registry settings to enable advanced features. Launch dsa.msc: It starts the dsa.msc console. Revert Settings: After the user closes dsa.msc, the script will revert the registry settings back to their original state. Running the Script: Open PowerShell as an administrator. Copy and paste the script into the PowerShell window or save it as a .ps1 file and execute it. This script ensures that the changes are temporary and are reverted back to their original state after usage." This wont work as it's not the correct registry key - a quick google didn't reveal the correct registry key. So I told Chat GPT that the registry key was incorrect and this is the next result: "Apologies for that oversight. Here’s a corrected PowerShell script to enable advanced features for Active Directory Users and Computers (dsa.msc):To enable the advanced features in dsa.msc, you typically use the GUI to check the "Advanced Features" option in the "View" menu. However, there isn't a direct registry key to enable this feature, but you can use PowerShell to open dsa.msc and automate the enabling of advanced features if needed. Here is a script that launches dsa.msc and interacts with the UI to enable advanced features: # Add-Type for using Windows API functions Add-Type @" using System; using System.Runtime.InteropServices; public class User32 { [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)] public static extern IntPtr FindWindow(string lpClassName, string lpWindowName); [DllImport("user32.dll", CharSet = CharSet.Auto, SetLastError = true)] public static extern IntPtr FindWindowEx(IntPtr hwndParent, IntPtr hwndChildAfter, string lpszClass, string lpszWindow); [DllImport("user32.dll")] [return: MarshalAs(UnmanagedType.Bool)] public static extern bool PostMessage(IntPtr hWnd, uint Msg, IntPtr wParam, IntPtr lParam); public const int WM_COMMAND = 0x111; public const int ID_VIEW_ADVANCED_FEATURES = 0x2D3; // Assuming the ID for Advanced Features } "@ # Start dsa.msc Start-Process dsa.msc # Give it some time to launch Start-Sleep -Seconds 5 # Find the dsa.msc window $windowHandle = [user32]::FindWindow("MMCMainFrame", "Active Directory Users and Computers") if ($windowHandle -ne [intPtr]::Zero) { # Find the View menu (assuming it's the third item in the menu) $viewMenuHandle = [user32]::FindWindowEx($windowHandle, [intPtr]::Zero, "MMCChildFrm", $null) if ($viewMenuHandle -ne [intPtr]::Zero) { # Post message to enable Advanced Features [user32]::PostMessage($viewMenuHandle, [user32]::WM_COMMAND, [intPtr]::op_Explicit([user32]::ID_VIEW_ADVANCED_FEATURES), [intPtr]::Zero) Write-Host "Advanced Features enabled in dsa.msc" } else { Write-Host "View menu not found." } } else { Write-Host "dsa.msc window not found." } Explanation: Add-Type Definition: Adds the necessary Windows API functions using Add-Type to interact with the GUI. Launch dsa.msc: Uses Start-Process to open the Active Directory Users and Computers management console. Sleep: Adds a sleep period to give the application time to open. Find the Window: Utilizes the FindWindow and FindWindowEx functions to locate the dsa.msc window and its menus. Post Message: Sends a message to the application to enable the Advanced Features. Running the Script: Save the script as a .ps1 file, for example, Enable-AdvancedFeatures.ps1. Open PowerShell as an administrator. Run the script by executing .\Enable-AdvancedFeatures.ps1. Note that UI automation can be brittle and might need adjustments based on the actual menu structure and window hierarchy, which can vary between versions and configurations." Run at your own risk! ...I'd just click the advanced features button from the menu tbh.

SharePoint can also be used for ticketing, there's a built in template I think. It might also include asset tracking, not sure though.

Did he ever release his meal log from super size me?

I didn't realise sub-processes were being spawned by the setup.exe - I thought you were doing this with more lines in the script, that's annoying.

Are you able to share the full startup script? Someone might spot the issue - the second error message makes it seem that the cmdlet 'Remove-AppxProvisionedPackage' isn't being given a package name to remove.

Does the PS method work more consistently if you copy the packages to the client in the PS and then run them from the client rather than unc?

Could it be because you're using UNC path? Maybe worth copying the setup.exe & .xml files to a folder on the client and then running the PowerShell using the local files to see if this behaves itself?