jthompson

Can't think of any that didn't just work as expected. I will have added some options to turn off taskbar gadgets, since that's a Win 11 feature specifically. I created WMI filters to target Win 10 and Win 11, so that any GPOs that need to be specific only to one OS or a other could make use of those. WUfB GPOs are the only ones where we do that though, since we specify different target versions to upgrade to. Edit: Our Win 10 Start menu GPO uses the WMI filter, so that it doesn't apply to Win 11 systems. I've not bothered with any Start menu customisation in Win 11 so far.

Yes. Group policy user config applied to the user account that we run the software under.

Same here. WUfB has been really smooth and our machines work better for it. We never did driver or firmware updates through WSUS, so we had a spate of firmware ugrades after the initial switch. If you're concerned about firmware upgrades happening in front of students, then I guess you just need a range of models in a test ring so that you can spot them and get into rooms to nurse the computers through those particular updates. I find that Windows is far smarter these days when it comes to scheduling forced restarts, too. Our workstations just have a couple of policy options set now which govern update scheduling, and computers don't suddenly restart on people in the middle of lesson like we've had in years past.

In Group Policy, you can use "Specify source service for specific classes of Windows Updates" to make sure that computers don't get driver updates from WUfB. IME (Dell, mainly) most BIOS upgrades appear under the optional 'Other updates', and are only installed automatically via WUfB if the vendor has marked them as especially urgent. Also, the older the model, the less likely you are to see firmware updates coming through anyway.

You can get some WUfB reporting for free, btw.

MTA-STS won't have any bearing on outgoing mail, since it's a means of securing inbound mail transit.

I still see it listed here - https://www.freshworks.com/freshdesk/pricing/ The free tier used to include up to 10 agents, but they're in the process of introducing the new limit now.

We're using FreshDesk. The free option is limited to only 2 agents, so with 3 in your team you'd need to pay for it. It works well for us, whilst we're still eligable for the free option.

As you say, there doesn't appear to be a straightforward way to do that, but I did spot this python script that makes use of various gam commands to piece it all together. I haven't tried this myself, but afte casting my eye over it it seems promising. https://github.com/taers232c/GAM-Scripts3/blob/master/GetTeamDriveCountsSize.py

The URLs are working here, but yes, you'll need the Plus licensing. It's frustrating that Google haven't yet just included guardian views within the Google Classroom website and apps yet. Just let guardians sign into the app and see their childs classwork already! Whilst it's nice to have a live view of classwork at last (a guardian having a Friday snapshot in an email is not much use to them midweek) it's live views of each class, but only with URLs available if that calss was included in the last summary at all. No one view of everything, which amazes me somewhat.

To get Affinity to sign in via Canva (for both teachers and students), I've had to adjust the following setting in Canva: Settings -> Permissions -> Integrations -> Manage Integrations -> Disable the option "Enable integration restrictions". If I turn that option on, I only see Slack and Vela as available to allow. I'm assuming that I ought to be able to see Affinity listed there, so that I can allowlist that, but I don't. I'll check back in a few days. The Canva sign-in screen does reflect that state of that option, but it still lets you click Allow and hand back to the Affinity app anyway (Affinity just spins on its sign-in screen). +1 for reading things, I guess!

This is an absolutely incredible story. World-changing in its impact, I'd say. After this, what country isn't going to be sitting up and reviewing its supply chain security whilst also brainstorming what similar capabilities it could itself pursue?

IIRC you need it turned on to Advanced MDM mode to make use of Android work profiles (which are excellent btw) and to have an Android device in total company-owned mode.

Trying this this morning, but the "Sign in with Canva" option when launching the apps just spins (after the browser hand-off). Is anyone else getting that? I suspect it might be the Affinity servers under high demand following the announcement. Is anyone else seeing that?

Received an email from Canva this morning announcing that Affinity is now "free for all verified Canva for Education schools". That links to this article - https://affinity.serif.com/en-us/affinity-canva-free-for-schools/ - which includes some instructions. When launching the apps, users are presented with a sign in splash screen, on which they'd need to choose the Sign in with Canva option in the small print. This page gives instructions for obtaining MSI installers - https://support.serif.com/hc/en-us/articles/10397292284687-Creating-an-MSI-for-deployment-for-use-with-Canva-Education-and-Nonprofit-accounts. Download the "MSI/EXE" Windows installer and then run the command on that page to generate an MSI.

Yep, we do this, with great results. Our PE and dance departments use them, with photos and videos syncing automatically to Googe Photos. It works much better for them than the old way of having video cameras and SD cards. We've purchased a few refurb Pixels (6a iirc) which are nice and fast, with good cameras and another few years of software support. This is how they're set up: In Google Admin, add the device to the Company-owned inventory. The device's serial number will be required. This can be obtained on the device from Settings → About phone → Model → Serial number. The Google Workspace account which will be used as the primary account on the device will need either a Google Workspace for Education Plus or a Google Workspace for Education Plus (Staff) license. We use dedicated accounts for the relevant departments (e.g. [email protected] for any Android cameras in PE). The account will also need Android MDM options set to Advanced (this is applied to the OU in which those user accounts reside). The device will then need to be factory reset, with the Google Workspace account signed in during the device's initial setup. This will set the entire device up as a managed device (i.e. the device will be listed in Company-owned inventory as assigned and the account on the device will be the device's primary account, not an account in a separate work profile). The Advanced MDM options in Google Admin will allow you to govern what apps can be installed on the device, etc. Staff then add the relevant account(s) as additional profiles in Chrome on their laptops. Within that profile they can open Google Photos and see the photos and videos as they're automatically backed up from the device. EDIT: We just use WiFi on them, no SIM cards.

I wish I could cite a few things in support of it, but it's my understanding that social media firms have been taking inspiration from the gambling industry, hiring talent from casino tech outfits that wrote the book on how to get and hold user engagement on slot machines, etc. On the tobacco industry comparison, I'm in no doubt that the best research into the ill-effects of their products will have been carried out by the tech firms themselves, and buried. They'll know better than anyone what the impacts of their products can be, just as big tobacco knew better than most that cigarettes were both addictive and harmful long before they were made to admit it publicly. As to whether the big tech bosses do actually prohibit their own children from using phones and tablets, I can't say. It may just be a myth, but the fact that it's such a widely held belief speaks to the generally ickiness/suspicion attached to this stuff.

I think the differences are significant. Pupils are not responsible for keeping themselves in a paid position, so the motivation to not prat about on a mobile is markedly different. I should imagine lots of school children use up most of their self control just turning up and sitting in class, and therefore don't have much left to resist the pull of mobile notificaitons. My personal view is that the social media industry is the new tobacco industry. Their products are precision engineered and highly refined for holding attention, after all. Whether or not an outright ban is the most productive way forward, I consider myself unqualified to decide, but I do understand it.

It seems that Google Authenticator now can't be used for Pearson T-OTP. Trying to onboard a member of staff here the other day, and Google Authenticator wasn't reading the QR being displayed on the Pearson webpage. I'm fairly sure that it's worked in the past, judging by me earlier posts here. I wonder if Pearson have moved to deliberately make their system incompatible with it, ramming some extra stuff into the QR code to scramble the data and make it readable only by their own app. Google Authenticator is still able to scan in a QR code that specifies use of SHA-256 (MS Authenticor can not, and instead generates incorrect 6-digit codes). Using https://stefansundin.github.io/2fa-qr/, I generated a QR based on my existing Pearson MFA secret, using SHA-256, and Google Authenticator still scans it and generates the correct codes as a result. Thanks Pearson, you're shifting your user support responsibilites onto people like us.

Google don't provide a "don't ask for MFA in school" option. Also, Microsoft charge for that. I feel like those two companies need to be lobbied on that front!

This is on my list of Win11 things to investigate. The option in the Settings app to not hide any systray icons isn't there in Win11, but iirc you can opt to have particular icons always show. Hoping there'll be a way to reg hack that for certain things we deploy (Google Drive and PaperCut clients).

I feel like I'd want to hear a commitment from leadership about MFA for students prior to them bringing in a complete ban on mobiles.

Add " -ai" to Google searches to not include those ******* AI summaries.

I stand somewhat corrected: the version numbers from wmic do match up after a fresh deployment of the latest MSI. Our most recently deployed MSI was for version 12.something, and that never moved forward despite the app performing its own updates during launch. After deploying the latest MSI (v24.1) over the old one, our inventory stuff is reporting that version number.

The version numbers for this software shown by wmic or appwiz.cpl are different from those shown within the software and described in their advisory. This makes for a lot of tedious work when needing to check what version is deployed across our rooms.