stevec_

You only want the to copy the <RuleCollection> tags/contents in your XML file (i.e. not including the <AppLockerPolicy Version="1"> part). Save it in notepad as EXE.xml with UTF-8 encoding and upload it to your intune policy. <RuleCollection Type="Exe" EnforcementMode="Enabled"> <!-- Baseline allow: Windows folder for Everyone --> <FilePathRule Id="11111111-1111-1111-1111-111111111111" Name="Allow - Windows Folder (Everyone)" Description="Baseline allow so Windows binaries run" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%WINDIR%\*" /> </Conditions> </FilePathRule> <!-- Baseline allow: Program Files (64-bit) for Everyone --> <FilePathRule Id="22222222-2222-2222-2222-222222222222" Name="Allow - Program Files (Everyone)" Description="Baseline allow for 64-bit Program Files" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="%PROGRAMFILES%\*" /> </Conditions> </FilePathRule> <!-- Baseline allow: Program Files (x86) for Everyone --> <FilePathRule Id="33333333-3333-3333-3333-333333333333" Name="Allow - Program Files (x86) (Everyone)" Description="Baseline allow for 32-bit Program Files" UserOrGroupSid="S-1-1-0" Action="Allow"> <Conditions> <FilePathCondition Path="C:\Program Files (x86)\*" /> </Conditions> </FilePathRule> <!-- Allow: %USERPROFILE%\Desktop\home.exe for Users --> <FilePathRule Id="44444444-4444-4444-4444-444444444444" Name="Allow - Staff Desktop home.exe (Users)" Description="Allows home.exe from the user's Desktop for Users group" UserOrGroupSid="S-1-5-32-545" Action="Allow"> <Conditions> <FilePathCondition Path="%USERPROFILE%\Desktop\home.exe" /> </Conditions> </FilePathRule> <!-- Allow: %USERPROFILE%\Desktop\Home.exe for Users --> <FilePathRule Id="55555555-5555-5555-5555-555555555555" Name="Allow - Staff Desktop Home.exe (Users)" Description="Allows Home.exe from the user's Desktop for Users group" UserOrGroupSid="S-1-5-32-545" Action="Allow"> <Conditions> <FilePathCondition Path="%USERPROFILE%\Desktop\Home.exe" /> </Conditions> </FilePathRule> <!-- Admin exemption: allow EVERYTHING for local Administrators --> <FilePathRule Id="66666666-6666-6666-6666-666666666666" Name="Allow - All for Administrators" Description="Full exemption for local Administrators" UserOrGroupSid="S-1-5-32-544" Action="Allow"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> <!-- Global deny: EVERYTHING for Users (non-admins) --> <FilePathRule Id="77777777-7777-7777-7777-777777777777" Name="Deny - All for Users" Description="Blocks all EXEs for Users unless explicitly allowed above" UserOrGroupSid="S-1-5-32-545" Action="Deny"> <Conditions> <FilePathCondition Path="*" /> </Conditions> </FilePathRule> </RuleCollection> This is what ours looks like after uploading:

Device Based Licensing is different to Shared Computer Activation. You can use Shared Computer Activation if you are on OVS-ES and have assigned Microsoft 365 Apps for enterprise licenses to your users. It will sign them in to O365 but not count against their activations. Add to your customization xml file.

How to configure the Automount of Teams Sites and how to solve the delay (call4cloud.nl) Can help with the 8 hour issue.

Username format: {cohort intake year}{first 4 characters of last name}{first 2 characters of first name} e.g. 21bloggjo Incrementing numbers suffixed for duplicate usernames. All punctuation is removed from first/last name. Email format: {first name}.{last name}@school... All punctuation except for hyphens are removed.

We've previously fitted Viewsonic CDE7500 as they were decently priced at around £1200 ex VAT, but the prices of these have gone up recently. We recently fitted a SMART Board 2075 (75", 4K, non interactive) screen. Price was £1145 ex VAT but it doesn't come with a wall mount so we got the CHIEF LSA1U mount (~£90) to go with it. It's the first non-interactive SMART Board we've had and we have no complaints. Only been installed a couple of weeks so can't give any long term review on it though!

We've had issues in the past where 3CX had added the IP of the phone to the blacklist (Security > IP Blacklist), which prevents the handset from auto-provisioning.

Don't have experience with S2D yet myself, but when I was researching recently, MS Docs suggested the cache could be as little as 5% of the storage capacity for all SSD solutions and 10% for HDD solutions: Choosing drives for Storage Spaces Direct | Microsoft Docs

We've used Synology for our NAS's for the past few years, no complaints so far. Plenty of built-in apps for things like syncing to another NAS. You can buy them empty and fill with drives of your choosing or buy them pre-populated. Would definitely recommend.

When we want to identify unique individuals from SIMS we usually use their Person_id field - don't think you can see this from the UI but you can export the information via a report.

You would need to advertise the 10.0.0.0/24 network on Switch1 and Switch2 so that they would form an adjacency.

Like so: ^(sch1|sch2|sch3)\.mat\.uk$

In that case the following should work for you: Get-WmiObject win32_printer -Filter "SystemName!='$($env:COMPUTERNAME)'" | Select-Object Name,Location,SystemName,ShareName | Export-Csv -Path "\\path\to\printers.csv" -Append

Providing all your clients are on at least Windows 8 the following quick and dirty script should do the trick: Get-Printer | Where-Object { $_.Type -eq "Connection" } | Export-Csv -Path "\\path\to\printers.csv" -Append

Not tested but you could try the following, just modify the IP_Ranges table as required $IP_Ranges = @{ "10.30.*.*"="PAL-"; "10.10.10.*"="BAL-" } $My_IP = ( Get-NetIPConfiguration | Where-Object { $_.IPv4DefaultGateway -ne $null -and $_.NetAdapter.Status -ne "Disconnected" } ).IPV4Address.IPAddress $IP_Ranges.Keys | ForEach-Object { if ($My_IP -like $_) { $i = 1 while ($true) { $PC_Name = "$($IP_Ranges[$_]){0:d3}" -f $i if (@(Get-ADComputer $PC_Name -ErrorAction SilentlyContinue).Count) { $i++ continue } Rename-Computer -NewName "$($PC_Name)" -Force -Restart break } } }

AD connect uses the UPN from active directory (User logon name + UPN Suffix). As long as this field matches the already created O365 accounts they will be associated with the correct account.