Julian

We have been using local profiles for a few years, It really helps to spped up logon times. I have an extra mapped drive which has shortcuts for apps / websites that will not go onto the start menu.

The no phones for staff is a problem, when certain critcal web apps require Google authenticator for 2FA (Bromcom I am looking at you).

We also use Examscreen, it works, its simple to use, and it dispaly the center number, and the exam lenghts.

Please rember that DHCP, and DNS are seperate systems, with DNS layed on top of DHCP. So you need to see if he issue is with DHCP or DNS. Ping is very helpful here, if you can ping 8.8.8.8 (Google DNS server), then you know you have a working connection to the internet, and you issue is with DNS, failure and you need to look at your internet connection.

As others have already said, without layer 3 routing, each layer 2 vlan needs its own DHCP server. This can be useful! I have used this to keep BYOD traffic away from my core network traffic. (I assume that all BYOD devices, are virus infected, and wish to compromise the school core network, so I do not allow them to see the school core network). My BYOD DHCP functionality, is provide by the router, which also provides NAT mapping.

For free screen recording software, Xbox game bar (built into windows 11) OBS studio, more complex but powerfull. (this is the software most gamers use). If you wish to record HD quality HDR @ 60fps you will need very good system.

The school regularly has a issue, with proving we are not bots to Cloudflare. I think this is because we are NATed, and all the many requests come from one ip address, and they are expecting only one person, on one ip address, so get confused with the request from several hundred people.

Are you using a Version 3, or Version 4 printer driver? (Microsoft printer driver specification, see https://learn.microsoft.com/en-us/windows-hardware/drivers/print/v4-printer-driver) With version 3 driver, the driver gets installed on the local computer. With version 4 drivers, “Microsoft enhanced Point and Print” driver is installed on the local computer, and the device specific driver is only installed on the print server. As the “Microsoft enhanced Point and Print” is part of Windows, setting it up is fast, particularly if you have multiple printers all using this driver.

Papercut cat be configured just to use a PIN code for users to identify themselves, rather that requiring a login. this less secure, but after observing a group of year 7 trying to login, I configued our printers to only accept a 5 digit pincode, so that users can quickly get at there work. And then put a poster over the printers informing then how to login to Papercut, to get there own code. I used a 5 digit code so only 1 in 10 codes are valid, and random codes fail.

Correct, the school is running its own internal CA, which I used to generate a code signing key. That key was then added to Group policy, as a domain policy, saying that I was trusteed to code sign software. The only problem is that the certificate only lasts 1 year. So, document well what you code sign.

Group Policy at Machine level, to require signed Powershell scipts. I use Powershell to deploy some applications (Python, MS Office,...) so I need it runnable, but limited to trusted scipts.

Was the original a full Backup? Copy only copies what was backed up, If you want a full backup on a NAS box, you will have to run a full backup on the original, or run a seperate full backup, with the NAS box as the destination.

The Start2.bin method works, but you do have to have the referanced programs in the "All Programs" list first.

Windows 11 breaking changes; Group policy not backward compatable. (This sounds worse that it actually is, your old policies will mostly work). Start Menu changed again. (Has been extensivly discussed in the forums) Windows 11 needs Server 2022, or Server 2025. (it can work with earlier versions, but fetures like SMB3 need both ends of the connection to be able to do SMB3)

I am also running Applocker, in allow list mode. It can be a problem for some applications, but as most apps are now signed, it easy to allow a publisher, so signed updates just run. Like most school we have some wanbe junior hackers, Applocker helps keep them frustrated.

The password advice these days is not to change passwords (so it is not written on a post-it and stuck to the screen). Just use password complexity rules so it is a strong long password. (I set a minimum of 15 characters). After a compromise (password was typed in the username field, on a projected teacher’s computer), I gave a new temporary password, and used A/D forced a password change.

Same here for a A level students with a listening exam, USB headphones, VLC, exam accounts, and students fully in control of their individual playback.

Make a new group policy with the updated software, and allocate that to A/D organisational unit only containing your test computers.

We are using Bromcom MCAS (My Child At School), to handle all of our parent payments. It works, It is not the most intuitive of systems. It helps that not using PatentPay reduces the number of logins that parents need, to get school information. MCAS communicates with a separate cashless catering system, with two-way communication, so that parents can see exactly what their children bough for lunch. One good feature is that selected persons (admins) can see what the parent would see in MCAS, very useful for trouble shooting, or explaining to a parent who is having difficulties.

1 Sep 2024 to 31 Mar 2025 884,662 Printed pages 90% grayscales, 10% colour. Duplex 70%, single sided 30% Reprographics accounted for 1/3 of the total, and Exam printing was a significant ammout of that. 1200 students 120 staff 13 large photocopies / printers (for follow me printing) Papercut is used a combined staff / student, printing / photocopying management solution. We use “follow me printing”, as forcing users to go and collect printing makes them think about if they need to print. While student do print, compared to staff their usage is very small. I have configured Papercut so that everyone has their own code, there are no department codes. so, printing/photocopying is all tracked to a person. Department do have an account, and staff can select from the appropriate account for who is paying for their photocopying. An automatic report each month tells each head of department who is spending the departments money. It is up to the HOD to manage their budget.

I have 2 virtual servers, running load balanced DHCP, DNS, and A/D, each server on a diffrent vmware host.

I have had this iisue with one computer, finally did a full rebuild of that machine, and that solved the problem.

Similar experience, HDMI over copper does not like long lengths but sometimes can be made to work (by reducing the data rate, turning down the resolution, or reduce the refresh rate), always use good quality HDMI cables. USB similarly, we have had to use a powered USB hub as a USB repeater, to get working USB over the required length.

Windows 11 has both a repository of packages, and set of installed packages. Thus to fully get rid off a package, you have to remove twice. Please try both of the commands below Get-AppxPackage -AllUsers -Name "MicrosoftWindows.Speech.en-GB*" | Remove-AppxPackage Get-AppxProvisionedPackage -Online | Where-Object DisplayName -eq "MicrosoftWindows.Speech.en-GB*" | Remove-AppxProvisionedPackage -Online

You are going to have to rerun the office setup tool, which only works with .XML config file, (no gui). Use the online Office configuration tool https://config.office.com/deploymentsettings) to create a .xml file of your desired configuration. The run "setup.exe /configure yourconfig.xml" where setupe.exe is the office setup file to get Office into its desired state. The online office configuration tool is fairly flexible, you can tell it which version of Office to use, which apps to deploy, setup the licence key. state from where to get the Office files, and import and export existing .xml files, so tweaking a working setup is not hard.