PiqueABoo

Well they did apologise: We apologize for the late notice and any potential confusion to your user base. Everyone went to one when they were kids. I concluded they understood perfectly but did it anyway.

Never mind that: Light Blue Touchpaper and learn something about security (research) and associated politics from folk with a definite clue.

Mmm.. it's a thought. I only kept taskbar pinning because the beeping tooltray Volume thing exposes the control panel Sound app stuff I had deliberately turned off in control panel, so I decided to make a shortcut to sndvol32.exe instead and pin that to the taskbar. Might revise this and see if I can get away with having a normal shortcut to sndvol32.exe in the Accessories group.

Roaming: I'm pinning *shortcuts* to the task bar and start menu, the same trick but I wrote powershell script for it which writes an HKCU regval for a "first run" check so it does nothing the next time they logon. Unpinning the taskbar defaults is a PITA e.g. Explorer, Media Player, beacause they usually don't get pinned during a first logon until after the script has run.

Oh the grandiose twaddle we all casually accept and regurgitate: First they'd have to figure out each child's "full potential" and that is clearly beyond the wit of man. Sprogette is God Empress of the Galaxy a few billion, trillion parallel universes away and they're not going to make that happen here are they? What it really means is something like: Achieve some reasonably safe prediction of their ability to surmount the extremely limited set of banal, slightly height-adjustable educational hurdles that we can afford right now. I'm certainly not questioning schools having to produce documented predictions and outcomes etc., just our ready acceptance of political bulshytt[1]. All those years of civilisation and we're still doing this, in fact doing it more. [1] It's very useful and has a different etymology ;b

Punching outbound holes through proxys/firewalls for things like this can be a complete PITA - the MS lists/ranges just for Live@Edu are rather big and they have been know to change. Office365 will add to that, especially Lync which might be problematic. I think it's best, in fact it's probably necessary, for it to be tackled centrally by some rocket scientist at the [RBC|Whatever] rather than have folk doing it at the school level.

With cloud Exchange 2K10 I just give the security group permission and it apparently works fine (no users have scwtheamed) e.g. Add-MailboxFolderPermission -Identity SomeUser:\Calendar -User SomeGroup -AccessRights Reviewer Members of SomeGroup now have Reviewer access to SomeUser's calendar.

If you're on a 2003 server you don't have the powershell stuff.

It's quite hard to pin things down, but my current(!) theory is: However you get to Office365 (via one of the migration phases or a brand new one) you can get a variety of different licences for free and the licence type you assign to a given user determines what feature they get. If you just want users to have the same-as-Live@Edu e-mail then you can assign Exchange Online (Plan 1) licences to them, and for testing sharepoint+lync at your leisure assign Microsoft Office 365 (Plan A2) to test accounts until you've got it all working & shiny, at which point you can upgrade all your users to A2. I haven't checked every last detail for devils yet, but as above the user e-mail experience is effectively identical. You lose any branding you've added to [email protected]. no more "St Trinians" and titchy logos, just the generic Office365 one. No SkyDrive etc. links in the banner, you get Home, Outlook & Team Site links instead.

What do you folk do about this for multi-user shares e.g. some share you might have for all staff? Is or isn't it possible for someone to accidently revert entire folders etc? Or do you ensure they're not somewhere with shadow copy turned on?

I do get the rationale but decent prior notice would have been good and it's obvious that you're asking kids, in some cases Primary kids for their mobile phone numbers etc. tOH (teacher) was bugging me about this: Is it some kind of ID hack? She wasn't going to bleeping well hand over her mobile phone etc.

My first stop for any Exchange WAN connectivity issue of any nature is: https://www.testexchangeconnectivity.com/. It's very useful. With that you can decide whether the problem is client-side or server-side. If it is server side then you typically have enough information to figure out what you need to fix, although it isn't necessarily handed to you on a plate e.g. last time I used it to test autodiscovery somewhere is said autodiscovery was working - which it was, but looking at the XML it had obtained I knew there was some expected data missing. Edit: I did initially/quickly question DNS but this essentially works by: a) establishing a tunnel to an RPC proxy which has to be an external (accessible from the net) name, b) connecting to your Exchange server's *internal* name via that tunnel. If for instance you try the testexchangeconnectivity RPC test you'll have to supply both names in the right places. I don't know, but I guess it's possible that you might see that internal name in some Outlook connection error.

Despite the increasingly woeful state of PKI I don't rate the net traversal as much of a threat, and if they need more than 25GB then I think "tough" is a perfectly reasonable response - it's not that long ago when it was 1/3 of a max Standard database size and if they all start doing that you're probably doomed e.g. 100 x 25GB locally? Not in my neighborhood - thank you. I agree that link speed and staff naivete is something to consider. Visibility drives me up the wall: They're either saying "Oh no! Students must not see staff because they might get sent some evil mail!" or "Oh no! Staff must not see students because they'll accidently select and send them the wrong mail by accident!". The only good news in this area is that Microsoft did fix the age-old problem of not being able to hook Outlook up to a hidden account - I can connect Outlook if I'm hidden, but I'm not sure if that works for connecting to a second mailbox yet (it didn't a few months ago). On a related note Automapping in the cloud hasn't worked reliably for me, so I take care to turn that off and add secondary mailboxes to Outlook the old way. One of the key problems for me with Live@Edu/Office365 is that it's largely a one way deal - much easier to put your stuff in than get it out (although AIUI the hybrid online+onprem stuff lets you move from online->onprem) - exporting to PST with Outlook doesn't exactly scale past an occasional handful of mailboxes. MS have also picked a good area for their charging in archiving.

Disabling Explorer context menu is easy and that's a virtue. Keeping it and getting rid of the stuff you might want gone is the hard part... previous versions, share with, briefcases, include in library, properties security tab and so on. Then there's 3rd party extensions - do you ban them all or permit some e.g. Intel's Graphics Options->Output To is usually needed on the desktop context menu on staff laptops for IWBs. This is another area I think got nastier (than XP) with Win7.

Read this sometime: How We Solved Problems With Exchange Running on a Domain Controller in EBS. Bear in mind that's three years ago talking about Exchange 2007 and some aspects might have changed. The DR point snagged my attention in an "oh.. ughh" way, but I don't know whether that's still the case with E2K10 and likewise for them saying that if it is a DC it will benefit from being a GC. Update - MS Quote (from a context that does encompass E2K10): If Exchange Server is running on a domain controller, you must also make that domain controller a global catalog server.

Catch 22: Microsoft do not support changing that Exchange box from a DC to a member server. I don't know if that's because Bad Stuff[tm] will happen or not, but superficially at least "not recommended" seems like a better place to be than "not supported".

You can target GPPs based on Site so is there a reason you're not doing that? Or are these not proper AD Sites?

Again because they don't care that much about folk who are doing what we do. I doubt school-level lockdown shared workstations are an important proportion of their sales, especially at those prices. You buy Windows regardless of how easy/sensible they make it for you.. and interestingly most people appear to think Windows 7 is fabulous despite all the evil hacks and compromises you have to make. More directly most installers do two fundamental things: a) Copy files places, b) Make registry additions/changes. A typical GPO setting is just another registry addition/change that is in some key-path with "Policies" in it (some of the time), and there's nothing much to stop an installer fiddling with a theoretical 'Pinned Items' registry value normally set by a GPO.

Pragmatically I think this is over the Tech-Fix-For-Social-Issue line: Forwarding is forwarding and those staff need to know how to handle replying to those the same as everyone else does. Perhaps there's a product/solution out there, but tech-wise I can't think of anything simple offhand... you could for instance give someone a special send-as address they use specifically for this kind of forwarding and it might be possible to make a transport agent that acts on forwarded mail from that specific address, gropes around in the message to get the original sender and either puts that in the From or Reply-To. Might.. and a transport agent means writing real potentially destructive (of all your mail flow) code for min. Exchange 2007 though.

I suspect that narrative is either: a) a complete crock to shore up the obvious Metro familarisation mission, b) a consequence of corporates turning off tat like Customer Experience that is apparently the source of their data-that-does-not-lie (ROFL). Windows 2000 was the last one that felt "corporate". Windows 7 is already well biased towards to Consumer land with stuff you turn off here popping up there in addition to the pinning faff (pinning is a 'personal' thing hence no GPO, plus there's that don't want 3rd party apps doing it excuse). Windows 8 is just further up the exponential curve. MS haven't ever cared that much about helping folk lockdown shared corporate Windows boxes.. if they had we'd have long seen some easy abstraction where you could click a few things to achieve your aims in < 1 hour as opposed to that interface to ~3500 GPO settings (GPP is a helpful addition, but seems neglected and isn't the easy abstraction I had in mind). I think a better whinge is: How the [bleep] did we arrive in a massively overcomplex place where apparently no one, really knows how key things work any more e.g. look at the only supported method for making a Default Profile and the info void on what customisation is and isn't preserved from that. There are so many more significant things where that came from.. the perils of folder redirecting the first folder in the list (roaming appdata), or Libraries. the NTFS junction epidemic etc., etc.. It's way out of control, literally I think..

This is a better link to the TechEd Presentation I posted above.. video is in varios formats (so you get to see the right hand side) plus the powerpoint slides. Look at the powerpoint if nothing else, informative upgrade info is slide 15 onwards.

Thanks - will play when I've got a minute.. Possibly October! If anyone else has way too much time on their hands and plays, could you please post a quick opinion. Key point for me isn't the perfection/otherwise, but is it enough for say small schools with occasional tech support who might have got them a Live@Edu to quickly get something useful out of the O365 Sharepoint?

So I just did a fresh signup which claimed to verify without issue, possibly because it was a "sch.uk", or one under an existing Live@Edu tenancy, perhaps they don't care at this initial point - dunno. I added two A2s (Students A2, Faculty A2). Total cost £0.00, had to do something on the payment page so opted for annual rather than monthy invoice, skimmed and ticked box to agree to legalese and MS now own my house.... sorry I mean the new plans were immediately available to assign to users (as are the existing trial A3s that will expire in a few weeks). So you are making an agreement on behalf of the org and if you're picking stuff with money attached it's obviously serious, but it's all online and there was no absolute requirement for manglement-bothering/signing/faxing/other. -- Unless I'm looking in the wrong place no sign of education-ish sharepoint templates e.g. "Class' so I guess that fell off the MS to-do list. This is actually a bit sad because of the numerous small schools using this who don't have time/skills/money to get it sorted.

Sure, I'm not especially concerned about the agreement per se, I'm trying to nail down what hoops you have to jump through to agree: Can I tick a few boxes on a web page similar to making a Live@Edu tenancy, or is E1->A2 more formal so I'll need to factor in gettting risk-averse mangelment types to do something in a timely manner (can be challenging at the best of times)? [some of the schools I have in mind don't have existing EES subscriptions etc.]

Found this on the new MS O365fE pages you linked: "You will be required to sign a contract and attest that you are an eligible customer. Microsoft reserves the right to verify eligibility at any time and suspend the service for ineligible customers Still not obvious how that fits with Live@Edu upgrades, but I'm imagining you'll have to do the same signing to go from the default E1 -> A2?