LRSFC_DanJ

We're looking at setting things up so that our Games Development course can do Unreal Engine game development for Meta Quest VR headsets. One stumbling block that we've come across is that part of the packaging process in Unreal Editor calls out to Command Prompt, which is blocked for student users. Our current advice has been that students will need to pass their project to their teacher for packaging, but we're looking into possible alternatives. It turns out that it is possible to do the packaging process on a separate machine/account via a command line rather than through the GUI, but we'd need some kind of workflow or orchestration engine to take care of receiving user requests, doing some basic validation on the supplied project (is the submitter a valid user, does the submitted path exist, does it contain a valid project file, etc), maintaining a queue of requests, running the packaging process (one at a time, as it's quite the intensive process), then feeding back to the user that their project has been processed. I could write a script to do this kind of orchestration myself, but it seems like the kind of thing that should already exist? Does anyone know of a package that can do this that can run on Windows?

I think we'll go with the easier suggestion of buying a commercial domain direct through Cloudflare and using that instead.

Does Entra Application Proxy have any web application firewall functionality? As we'll need that as well, hence looking at Cloudflare as they have a WAF option.

No, the other end is controlled by our third party admissions platform provider. We also would not want them "inside" our network boundary, which would be the case if we had a tunnel directly to them.

In order to integrate with the admissions platform we're using, we'd like to use a Cloudflare tunnel and web application firewall to make the API endpoint for our MIS system available for their system to connect to over the internet, without needing to expose our MIS system directly to the public internet. However looking at Cloudflare's documentation it seems like you have to switch your whole domain's DNS over to Cloudflare as part of the Cloudflare onboarding process? We don't want to do that as we are an .ac.uk domain holder and as such we use Janet DNS for our public DNS. Is it still possible for us to use Cloudflare's tunnels, or do we need to look for a different solution? Entra Application Proxy was something else we looked at but this appears to require an Entra sign-in, which is no good for an API that is only going to be used by automated systems.

The full "Microsoft 365 Copilot" licenses would be prohibitively expensive for us to make available for all our staff users, so they do not have access to "Copilot in PowerPoint 365" and can only generate text-only presentations with the regular Copilot Chat. However we do have Copilot Studio licenses and a pack of 25,000 Copilot Credits, so we were wondering if it's possible to create an Agent with Copilot Studio which can generate a PowerPoint presentation which includes images, when requested to do so by our staff members?

I put it in as a startup script in a GPO but there's no reason you couldn't have it run in other GPO areas or as a scheduled task or something like that. Unlike DisplaySwitch.exe it should work fine if the computer is at the lock screen as it's not doing anything that requires an interactive session. Wherever you're running it though, it does need administrative permissions due to the registry keys it accesses, so you can't run it in a user context (but then you don't need to run it in a user context, as in the user context you can just use DisplaySwitch.exe instead).

Since nobody on the entire internet seems to have a solution for this problem, I plugged away at it for a bit and managed to come up with one myself. Presenting "FixDuplicateDisplay.ps1". Stick this as a PowerShell Startup Script in a GPO targetting computers. NOTE: while I have tested this in our environment and it appears to work, you will need to make your own judgement as to whether you consider it to be safe. It does log everything to C:\Windows\Temp though. As for how it works, it creates the required monitor configuration registry keys and values and then restarts the graphics driver. # Configures registry entries so the system should think that its most recent display topology was clone mode # by Dan Jackson # 2026-01-23 initial version # 2026-01-27 now works successfully! # Log filename $logfilename = "C:\Windows\Temp\FixDuplicateDisplay-" + (Get-Date -uformat "%Y%m%d%H%M%S") + ".log" $transcriptfilename = "C:\Windows\Temp\FixDuplicateDisplay-Transcript-" + (Get-Date -uformat "%Y%m%d%H%M%S") + ".log" $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " FixDuplicateDisplay session start" $outLine | Out-File $logfilename -Encoding UTF8 Start-Transcript $transcriptfilename # Get connected monitors from WMI $connectedMonitors = gwmi WmiMonitorID -Namespace root\wmi # Do we have more than one monitor? if ($null -eq $connectedMonitors -or $connectedMonitors.Count -lt 2) { # Only one monitor or failed to get monitor IDs $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Only one monitor ID or failed to get monitor IDs, exiting" $outLine | Out-File $logfilename -Encoding UTF8 -Append exit 1 } $cms = @() foreach ($monitor in $connectedMonitors) { $monitorString = [System.Text.Encoding]::ASCII.GetString(($monitor.ManufacturerName | Where-Object {$_ -ne 0x0})) + [System.Text.Encoding]::ASCII.GetString(($monitor.ProductCodeID | Where-Object {$_ -ne 0x0})) + [System.Text.Encoding]::ASCII.GetString(($monitor.SerialNumberID | Where-Object {$_ -ne 0x0})) $cms += $monitorString } # Get existing monitor IDs from MonitorDataStore $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Getting monitor IDs from MonitorDataStore" $outLine | Out-File $logfilename -Encoding UTF8 -Append $monitorDataStore = (Get-ChildItem HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\MonitorDataStore).PSChildName # Filter MonitorDataStore down to monitors that actually exist and are currently connected $oldMonitorDataStore = $monitorDataStore.PSObject.Copy() $monitorDataStore = @() foreach ($monitor in $cms) { $monitorMatch = $null $monitorMatch = $oldMonitorDataStore | Where-Object {$_ -match $monitor} if ($null -ne $monitorMatch) { $monitorDataStore += $monitorMatch } } # MD5 hash required objects $md5 = New-Object -TypeName System.Security.Cryptography.MD5CryptoServiceProvider $utf8 = New-Object -TypeName System.Text.UTF8Encoding # Construct connectivity subkey string $multiMonitors = $monitorDataStore -join "^" $hash = ($md5.ComputeHash($utf8.GetBytes($multiMonitors)) | % {$_.ToString("X2")}) -join "" $connectivityString = $multiMonitors + "^" + $hash $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Connectivity subkey string constructed: '$($connectivityString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append # Construct clone value string $cloneString = $monitorDataStore -join "*" $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Clone value string constructed: '$($cloneString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append # Construct configuration subkey string $hash = ($md5.ComputeHash($utf8.GetBytes($cloneString)) | % {$_.ToString("X2")}) -join "" $configurationString = $cloneString + "^" + $hash $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Configuration subkey string constructed: '$($configurationString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append # Construct setId value string $setIdString = $monitorDataStore -join "^" $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " SetID value string constructed: '$($setIdString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append # Construct QWORD timestamp value $qwordTimestamp = [datetime]::Now.ToFileTime() $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " QWORD timestamp value: '$($qwordTimestamp)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append # Check if connectivity subkey exists $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Checking existence of subkey: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append if (!(Test-Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)")) { # subkey does not exist $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Creating subkey: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append New-Item -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)" -Confirm:$false -Force } # Check if Connectivity Clone value exists $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Checking existence of Clone value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)\Clone'" $outLine | Out-File $logfilename -Encoding UTF8 -Append $cloneObject = $null $cloneObject = Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)" -Name "Clone" -ErrorAction "SilentlyContinue" # If connectivity clone value exists, update it if ($null -ne $cloneObject) { # Connectivity Clone value needs updating $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Setting Clone value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)\Clone' to value '$($cloneString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)" -Name "Clone" -Value $cloneString -Force -Confirm:$false } else { # Connectivity Clone value needs creating $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Creating Clone value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)\Clone' with value '$($cloneString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)" -Name "Clone" -PropertyType String -Value $cloneString -Force -Confirm:$false } # Check if Connectivity Recent value exists $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Checking existence of Recent value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)\Recent'" $outLine | Out-File $logfilename -Encoding UTF8 -Append $recentObject = $null $recentObject = Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)" -Name "Recent" -ErrorAction "SilentlyContinue" # If connectivity recent value exists, update it if ($null -ne $recentObject) { # Connectivity Recent value needs updating $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Setting Recent value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)\Recent' to value '$($cloneString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)" -Name "Recent" -Value $cloneString -Force -Confirm:$false } else { # Connectivity Recent value needs creating $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Creating Recent value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)\Recent' with value '$($cloneString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)" -Name "Recent" -PropertyType String -Value $cloneString -Force -Confirm:$false } # Check if Connectivity SetId value exists $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Checking existence of SetId value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)\SetId'" $outLine | Out-File $logfilename -Encoding UTF8 -Append $setIdObject = $null $setIdObject = Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)" -Name "SetId" -ErrorAction "SilentlyContinue" # If connectivity setId value exists, update it if ($null -ne $setIdObject) { # Connectivity SetId value needs updating $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Setting SetId value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)\SetId' to value '$($setIdString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)" -Name "SetId" -Value $setIdString -Force -Confirm:$false } else { # Connectivity SetId value needs creating $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Creating SetId value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)\SetId' with value '$($setIdString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Connectivity\$($connectivityString)" -Name "SetId" -PropertyType String -Value $setIdString -Force -Confirm:$false } # Check if configuration subkey exists $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Checking existence of subkey: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append if (!(Test-Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)")) { # subkey does not exist $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Creating subkey: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append New-Item -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)" -Confirm:$false -Force } # Check if Configuration SetId value exists $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Checking existence of SetId value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)\SetId'" $outLine | Out-File $logfilename -Encoding UTF8 -Append $setIdObject = $null $setIdObject = Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)" -Name "SetId" -ErrorAction "SilentlyContinue" # If configuration setId value exists, update it if ($null -ne $setIdObject) { # Configuration SetId value needs updating $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Setting SetId value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)\SetId' to value '$($cloneString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)" -Name "SetId" -Value $cloneString -Force -Confirm:$false } else { # Configuration SetId value needs creating $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Creating SetId value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)\SetId' with value '$($cloneString)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)" -Name "SetId" -PropertyType String -Value $cloneString -Force -Confirm:$false } # Check if Configuration timestamp value exists $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Checking existence of Timestamp value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)\Timestamp'" $outLine | Out-File $logfilename -Encoding UTF8 -Append $qwordTimestampObject = $null $qwordTimestampObject = Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)" -Name "Timestamp" -ErrorAction "SilentlyContinue" # If configuration timestamp value exists, update it if ($null -ne $qwordTimestampObject) { # Configuration timestamp value needs updating $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Setting Timestamp value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)\Timestamp' to value '$($qwordTimestamp)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)" -Name "Timestamp" -Value $qwordTimestamp -Force -Confirm:$false } else { # Configuration timestamp value needs creating $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Creating Timestamp value: 'HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)\Timestamp' with value '$($qwordTimestamp)'" $outLine | Out-File $logfilename -Encoding UTF8 -Append New-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\GraphicsDrivers\Configuration\$($configurationString)" -Name "Timestamp" -PropertyType QWORD -Value $qwordTimestamp -Force -Confirm:$false } # Now all registry keys are set, restart graphics drivers! $timestamp = Get-Date -uformat "%Y-%m-%dT%H:%M:%S" $outLine = $timestamp + " Restarting graphics drivers" $outLine | Out-File $logfilename -Encoding UTF8 -Append Get-PnpDevice -Class "Display" | Disable-PnpDevice -Confirm:$false Get-PnpDevice -Class "Display" | Enable-PnpDevice -Confirm:$false Stop-Transcript

The above posters are correct - the most common issue being reported is that the monitor screen is black, as when logging on the teacher may not have switched the projector/IWB out of standby mode, but the computer still sees them as existing as displays.

Unfortunately this doesn't help at the login screen, which is the most common callout we have when this issue occurs.

Unfortunately it's the login screen that's the biggest problem.

Our classroom teacher PCs are connected to both a monitor and a projector or interactive whiteboard. Some teachers like to set the displays to "extend" for some reason, but this then confuses other teachers who then come to use the room, and despite having told them they need to use Windows key + P to change it back, we still get a lot of complaints. So I've been looking into if it's possible to have the computers automatically duplicate the screen on startup. I found there is an app c:\windows\system32\displayswitch.exe which if you give the /clone switch will duplicate the display. However if I put this in a scheduled task to run at startup, this does not seem to work. I've seen some solutions that recommend using psexec but we cannot use this in our environment as it is blocked by our security software. Does anyone have any ideas? Windows 11 Enterprise 24H2.

Ah yes, indeed that's true. I guess in that situation you'd have to introduce a dummy record in your on-premise DNS service? But either way there's definitely a problem at the Complete Maths end and they will need to be the ones resolving it.

It's not down, if you put the IP address in your hosts file it works, the problem is with their DNS servers.

I think their DNS has gotten screwed up somehow, if I go to DNS Dumpster and search up their domain I can get the IP, and if I put that in my hosts file I can make the website work.

I'm not getting any DNS responses for https://autograph.completemaths.com/ regardless of where I look, I've tried Google DNS, I've tried MXToolbox's online DNS lookup, and the AWS name servers that are supposedly the registered name servers for this domains are refusing the queries entirely. Nslookup.io also returns nothing: https://www.nslookup.io/domains/autograph.completemaths.com/dns-records/

Our maths department uses an app called Autograph Maths, which was made a free app with version 5 some time ago. We were looking to check if there had been any new versions, but the website completemaths.com seems to be inaccessible. Does anyone know what happened to this? Did the company go out of business?

Now that the new Cyber Essentials question set is requiring technical controls on BYOD device access to college resources, we're starting to test conditional access policies and compliance policies to achieve this. We've got a conditional access policy set up (scoped to just me as I'm testing at the moment) which should block noncompliant devices from accessing Microsoft 365, and an accompanying compliance policy that requires a minimum OS version (Android in my case). I've registered my device using Microsoft Authenticator (didn't know it could do that, but apparently it can) and verified in the Entra ID backend that the device exists in Entra and is correctly showing as a personally owned registered device. However when accessing the Outlook web app, I'm still getting blocked, and when I check the "Troubleshooting details" section it says my device is unregistered. How do I get it to recognise the device registration and let me in? Also, before I registered my device, it was doing the same thing - how do I get it to prompt me to register instead of just blocking?

If we can't pin a UNC path to a shortcut, do you know if there's a way we can pin a website? As that's what the UNC path shortcuts are in our settings. I will say though, these did work fine under Windows 10.

Do you actually paste the XML content into Intune, or do you have to put a path to a file name? As there seems to be conflicting opinions on that around the internet.

This used to work under Windows 10 and according to the Microsoft documentation the process is supposed to be the same for Windows 11 (just it doesn't support changing the Start Menu any more, only the Taskbar layout) but I don't seem to be able to get the taskbar apps layout working for our staff users. Here's what I've got: xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout" Version="1"> No matter whether I apply this through GPO or Intune though, it doesn't seem to be having any effect. What am I doing wrong? Have Microsoft changed how taskbar management works again and just not told anybody / not updated their documentation?

We did all that and it still only worked every second login instead of every login. In the end I've finally gotten around to writing a little C# console app that does what our printers script currently does, I'll be testing that on our test user account and then if it works I think we'll just go with that.

This is a good step forward, but how do we do this and also block student access to the PowerShell prompt? We currently use User Policies -> Administrative Templates -> System -> Don't run specified Windows applications to block powershell.exe and powershell_ise.exe. EDIT: this https://learn.microsoft.com/en-us/windows/security/application-security/application-control/windows-defender-application-control/applocker/script-rules-in-applocker says that PowerShell scripts will still run, just in Constrained Language Mode, when blocked in the way you describe? The description of this says "All cmdlets in Windows modules are fully functional and have complete access to system resources, except as noted. All elements of the PowerShell scripting language are permitted. All modules included in Windows can be imported and all commands that the modules export run in the session." so this doesn't really seem like enough to properly block it.

We block PowerShell for students because they can use it to access things they should not be able to access, such as the computer's C: drive. The GPO setting that blocks "command prompt" use does not block PowerShell. I would love to replace the VBScript printer script with PowerShell, but since it needs to run in the user context I don't see how you can block it for interactive use but allow it for noninteractive use without the student also being able to create and use their own .ps1 scripts. Is there a way to tell PowerShell to only run scripts through logon scripts or Group Policy? We'd need to impersonate the logged on user in order for this to be successful, otherwise the connection to the printer would not have the correct permissions (for example, students are not permitted to cancel jobs or clear the print queue as this can allow them to bypass print charging).

We don't have a support contract with Microsoft so we don't have a way to get them to fix their Group Policy Preferences not working every time.