Julian

We have been using local profiles for a few years, It really helps to spped up logon times. I have an extra mapped drive which has shortcuts for apps / websites that will not go onto the start menu.

The no phones for staff is a problem, when certain critcal web apps require Google authenticator for 2FA (Bromcom I am looking at you).

We also use Examscreen, it works, its simple to use, and it dispaly the center number, and the exam lenghts.

Please rember that DHCP, and DNS are seperate systems, with DNS layed on top of DHCP. So you need to see if he issue is with DHCP or DNS. Ping is very helpful here, if you can ping 8.8.8.8 (Google DNS server), then you know you have a working connection to the internet, and you issue is with DNS, failure and you need to look at your internet connection.

As others have already said, without layer 3 routing, each layer 2 vlan needs its own DHCP server. This can be useful! I have used this to keep BYOD traffic away from my core network traffic. (I assume that all BYOD devices, are virus infected, and wish to compromise the school core network, so I do not allow them to see the school core network). My BYOD DHCP functionality, is provide by the router, which also provides NAT mapping.

For free screen recording software, Xbox game bar (built into windows 11) OBS studio, more complex but powerfull. (this is the software most gamers use). If you wish to record HD quality HDR @ 60fps you will need very good system.

The school regularly has a issue, with proving we are not bots to Cloudflare. I think this is because we are NATed, and all the many requests come from one ip address, and they are expecting only one person, on one ip address, so get confused with the request from several hundred people.

Are you using a Version 3, or Version 4 printer driver? (Microsoft printer driver specification, see https://learn.microsoft.com/en-us/windows-hardware/drivers/print/v4-printer-driver) With version 3 driver, the driver gets installed on the local computer. With version 4 drivers, “Microsoft enhanced Point and Print” driver is installed on the local computer, and the device specific driver is only installed on the print server. As the “Microsoft enhanced Point and Print” is part of Windows, setting it up is fast, particularly if you have multiple printers all using this driver.

Papercut cat be configured just to use a PIN code for users to identify themselves, rather that requiring a login. this less secure, but after observing a group of year 7 trying to login, I configued our printers to only accept a 5 digit pincode, so that users can quickly get at there work. And then put a poster over the printers informing then how to login to Papercut, to get there own code. I used a 5 digit code so only 1 in 10 codes are valid, and random codes fail.

Correct, the school is running its own internal CA, which I used to generate a code signing key. That key was then added to Group policy, as a domain policy, saying that I was trusteed to code sign software. The only problem is that the certificate only lasts 1 year. So, document well what you code sign.

Group Policy at Machine level, to require signed Powershell scipts. I use Powershell to deploy some applications (Python, MS Office,...) so I need it runnable, but limited to trusted scipts.

Was the original a full Backup? Copy only copies what was backed up, If you want a full backup on a NAS box, you will have to run a full backup on the original, or run a seperate full backup, with the NAS box as the destination.

The Start2.bin method works, but you do have to have the referanced programs in the "All Programs" list first.

Windows 11 breaking changes; Group policy not backward compatable. (This sounds worse that it actually is, your old policies will mostly work). Start Menu changed again. (Has been extensivly discussed in the forums) Windows 11 needs Server 2022, or Server 2025. (it can work with earlier versions, but fetures like SMB3 need both ends of the connection to be able to do SMB3)

I am also running Applocker, in allow list mode. It can be a problem for some applications, but as most apps are now signed, it easy to allow a publisher, so signed updates just run. Like most school we have some wanbe junior hackers, Applocker helps keep them frustrated.