jthompson

Thank you for sharing your story. It reminds me of a moment a few years ago when, about 2 hours after realising that we'd been the victom of a catastrophic ransomware attack, my LM came to see me in the server room, waved a hand at the stack of dead servers and told me in no uncertain terms that all of that could be replaced but that I should under no circumstances be killing myself to get things up and running again. In the darkest moment of my career, my employers were making sure that my wellbeing was not unduly compromised, which meant a great deal (I still felt dreadful and didn't sleep a wink that night, but it will have relieved a significant amount of pressure). My personal circumstances (father of two) are now far less conducive to working a bit late each day or checking in from home of an evening, which I've been guilty of in the past. I find turning off easy now, because I have to. In another sense, I'm working around the clock in the form of automations that I've written. We're lucky in that we can still perform aspects of our job without having to actually pay any attention

TBF, whilst MCM still feels in places like MS have lost interest (applying Windows updates in a TS without using its WSUS-based approach requires some custom PS scripting), the application deployment looks like something we'll be able to lean in to more, as an alternative to doing all of our app deployments via GPOs.

I've been working on this quite a bit now and my level of knowledge of SCCM/MECM/MCM is now comfortably into the 'Dangerous' zone I know that the build & capture approach is out of fashion now, but that's what I've been working at (that's what we currently do with MDT). I've got Office, .NET 3.5, some custom PowerShell tweaks and Windows updates (using PSWindowsUpdate to pull them direct from MS) in the build & capture TS, and then able to deploy that image out using a basic OS deployment TS. The way MCM handles drivers is pretty unweildy, but I've imported drivers packs for our various Dell models regardless, with model-specific TS steps to install them. Longer term I imagine shifting towards a thinner image and deploying Office and other big apps after imaging. I still like capturing an image with the most recent cumulative updates applied, though. All very interesting.

If there are devices being supplied by the organisation, then those ought to be being used as a matter of principle, really. There may be policies such as screen lock timeouts, full disk encryption, application allowlisting that are set by the org on those devices, to mitigate against unattended devices in classrooms, etc. With BYOD devices being used, those sorts of organisational stances are weakened. It's also a matter of how far the IT support is expected to go. With org-managed devices, you can support people doing their work on them, but BYOD, not so much. You won't necesarily have spare chargers to help keep a lesson on track, for instance.

Our [then] 2019 print server ended up with broken print queues after an in-place upgrade to 2022. Never worked out why, but be ready to roll back. Probably printer drivers, let's face it.

I think you need senior management in your corner to be most effective, and you should also look at technical restrictions to put downward pressure on it, too. For instance, are you able to restrict access to work MS/Google accounts from unmanaged browsers?

I think I would start by asking "When you say Dropbox, do you mean OneDrive?" in case they're using the name interchangably.

IME it's the other way around: it's the KMS keys that require a phonecall to MS support.

I've almost finished upgrading everything to 2022.

Gmail has some built-in templating, which they refer to as 'layouts'. Might be worth seeing if that does what you're after. https://support.google.com/mail/answer/13397089?hl=en

Are the target machines officially supported for Windows 11? If not, they may not get offered a feature update, even if they're happily running Windows 11.

Good point, I would second that too. Windows 11 24H2 now has checkpoint updates, which are meant to serve as differential updates from one monthly update to another, rather than each one being entirely cumulative each time. I'm not sure exactly how that will play out in terms of DO and bandwidth savings, but I would imagine that if the bulk of the fleet keeps pace with updates each month, then there'll be a significantly lower volume of downloads/peering going on.

It's now a core Workspace service, which I should think explains why there's no differentiation (or specific consent required) for use by under-18s. https://workspaceupdates.googleblog.com/2024/10/gemini-app-enterprise-data-protection-core-service-expansion.html

With WUfB you can use Grou Policy to specify how many days (up to 30) quality updates are deferred by. That allows you to phase your updates. I use WUfB on servers now, too. Windows 10 and 11 clients can be configured with an organisation ID so that you can see reporting of updates in an Azure dash (known as "Windows Update for Business reports"). Servers OS's aren't included in WUfB reports, so you need to find your own way of monitoring updates on servers. There's Azure Update Manager for doing that, but that's not free for on-prem servers any more.

My gut feeing is that you'd need/want 1 VM per school. Nothing to stop you hosting all of those centrally, I shouldn't think, but that's probably the extent of the consolidation that'd be feasible. If you have any agents that need to communicate with other on-prem systems for a school (e.g. EduLink needing AD access), then that'll ad an extra layer of complication for you.

Actually, instead of $folder.FolderName you'd need to use: $($folder.FolderName) So your code would be: $libraryName = "" $folders=Import-csv "" foreach ($folder in $folders) { "$($folder.FolderName) $libraryName\$($folder.FolderName) does not exist" }

You might need to reference the column heading from the CSV. For instance, if the relevant column heading was "FolderName", in your foreach you'd use $folder.FolderName instead of just $folder

Anthropic's Claude can now perform tasks on your computer by viewing what's on the screen and controlling mouse and keyboard input. https://www.anthropic.com/news/3-5-models-and-computer-use "Claude, I'm gonna need you to goo ahead and come in tomorrow to do those TPS cover sheets. Mmmkay".

Thank you. Yes, a mix of that and also not having any boundaries or boundary groups configured. My "Hello World" TS that just installs a vanilla 24H2 image now appears to be progressing.

Okay, I think I'm over-thinking things. I'm going to ignore the whole updates thing, and assume that when I get as far as sorting out a task sequence, I'll be able to include steps in there that can check for and install updates from Windows Update directly, just like I've been doing with MDT. i.e. either updating during deployment TS or updating during a build & capture TS. I've managed to finally get a VM to PXE boot from it, but encountering errors about the boot image not being located on a distribution point. I'm not likely SCCM/MECM/MCM so far - it's like a big bowl of jargon soup.

Currently using WUfB for both clients and servers. Is there some way that I can "just use WUfB" in MCM? It seems like it wants to do things the WSUS way, with synchronisations, approvals, packaging updates into deployment packages, etc. I just want it to be able to check for and install directly from Windows Update.

I'm looking to move up from MDT to MCM for our OS deployment. I'm looking for some basic tips on getting started with it. I've got a fresh server, fresh install of SQL Server, latest ADK and WinPE pack installed. I like MDT quite a lot, but the writing is very much on the wall for it now. I want to start off with MCM by basically replicating what we're doing with MDT (a near vanilla OS being deployed along with Office and maybe the .Net 3.5 feature added). MCM seems like a beast, and I'm feeling the ick right away with having to have the WSUS role involved (we happily ditched WSUS a while back). Can anyone give me or point me towards some good guidance for getting started with MCM for relatively basic OS deployment to PXE clients? I'm finding it hard to get a good feel for MCM, given that it's quite a slippery thing to Google (most of the Internet wants to reference SCCM, which is a few product names ago now).

How about having a local scheduled task run a script that first checks for the presence of a file on the network before proceeding with shutting down? If the file isn't there, it skips the shutdown command and leaves the machine up. On an open evening, or whatever, you just need to drop the file into place. You could even have another script on a server scheduled to drop said file so that you can schedule your shutdown exemptions well ahead of time.

Seems like a Google service issue rather than anything in config.

What happens if they browse directly at https://drive.google.com/drive/shared-drives