cstreet

We were running v21 before and needed to update the drivers for newer panels so went for latest, why not! Confirming that to resolve the issue on this post, we rolled back to v24. This meant sending an uninstall of v25 to SCCM deployment, then setting up a new v24 deployment and pushing at the same time. SCCM seems to process the uninstall first luckily and then the v24 can install. A little messy but worked for our teachers who confirm that the issue is gone in v24 and everything else seems to work. When a working version of v25 is release later, we'll plan to update to v25. Probably not until next year now so as not to upset our teaching staff any more!

+1 !! We've just pushed Notebook v25.0 to one of our schools and multiple teachers have reported the opening with Chrome thing. We have Windows 10 + Sophos + Smoothwall Webfilter Appliance + Classroom.Cloud + Microsoft Office 365 Apps It's intermittent for us. On a fresh reboot of a laptop, the program functions fine as expected. Teacher showed me that they could trigger the issue on purpose at the end of the day - laptop been on for a while - then try opening Notebook documents until it triggers. After about 3-4 docs open, SMART threw an error up and then started opening with Chrome then downloading a copy of the document. Sometimes happens on a fresh reboot too apparently but we couldn't replicate this at the time. On a refresh reboot of a modern laptop recently deployed with fresh Windows, the issue doesn't occur and Smart Notebooks open fine. We opened about 12 docs and it kept going! It seems to occur after the laptops have been on for a while, or something else triggering it in the background. Another app open perhaps. Not worked it out fully yet but we're looking at if we can just jump back to v24 anyway until it's solved. Workaround suggested at the moment it that when we close all other Notebook documents, wait 30 seconds, then start again, they open fine. (shrug)

Senso DEV team are currently working with one of our machines to see if they can fix the backwards compatibility or provide some sort of working setup. Our school environments are all the same with: - Sophos Enterprise Cloud installed on all Windows clients with HTTPS inspection enabled - Smoothwall Appliance on Leeds 73 (latest) - Smoothwall Proxy configured on clients with HTTPS inspection (full decrypt and inspect of sites unless whitelisted in Smoothwall) - Many common sites that are whitelisted in Smoothwall also whitelisted in Senso monitoring (by domain/URL in a massive uncategorised list) - No smoothwall software or drivers are installed on Windows client (upstream proxy only) - Senso Cloud client installed on every Windows client (currently with filter drivers disabled and features lost) Before the Senso driver update on Monday everything was working together.

I can confirm that this has impacted all of our schools - and it's a Senso change/update that initiated the problem, not Smoothwall. Senso have updated the Senso WFP filter drivers on Monday 17th April. These drivers are using TLS 1.3 - claiming to be backward compatible however aren't working with Smoothwall TLS 1.2. We noticed that YouTube stopped loading yesterday morning on some clients, getting worse as the day went on (as more and more Senso clients updated). While Smoothwall should be working with TLS 1.3 by now, they are probably holding fire until their new release, which will be properly tested before launching into the wild. No point asking Smoothwall for support here, it's caused by Senso. We have a temporary work around by disabling the Senso filter drivers. This removes some features of Senso but allows the basics and also all HTTPS inspection now working. Please seek support from Senso to ask if you need this temp fix for your environment. Senso on the released an impactful driver update that clearly hasn't been tested with Smoothwall customers. I'm disappointed, for the second time. We've had this before when it was clashing with Sophos. Not impressed but happy that Senso are working on it with us directly.

Note: Just tried running the Task as a user, Administrator on the server, same result I'm afraid. CleanMgr fails to end/close which stalls the task as well. Closing the CleanMgr.exe process in task manager works and the task can also be ended by simple right click and end (or by setting the task to end after x minutes). It's just not a clean end! Ironic? If you're using a PowerShell script action started by a task, ending the task does NOT close CleanMgr.exe. You must start CleanMgr.exe as a direct action of the task in order for it to be terminated by the task controls.

This is also happening for us, same setup. Running the task on Server 2019 and Server 2022 has same result. Seems to be doing the job but not returning the completion result to the task. For us, CleanMgr.exe is left running and idle. If we run the task in PowerShell a CleanMgr window appears and runs the sagerun process as expected in about 2 minutes (as it's already clean). But running from a scheduled task results in CleanMgr.exe being orphaned idle and task never ends cleanly. Did some work today and have tried adding the command as a Task action directly, as well as having a PowerShell script (.ps1) running with CleanMgr command in there. No joy, same result for both. I also tried excluding Windows Updates and Microsoft Defender targets as those take the longest to run when we do it with GUI visible. Manually run command with GUI popup works: Task with hidden GUI does not end properly though. Our PowerShell manual command runs as a user, the task runs as system. Any solutions or other suggestions welcomed

SDS does not remove the data from Azure when a contact is excluded, this is the whole point of trying to overwrite the existing with a false one. I know it's not tidy, but neither is the guardian email data! Update: Sadly however, it seems SDS doesn't overwrite the email and instead adds another duplicate parent instead Still working on a solution.

Hi, It seems that uploading the new email address is adding an extra record for the same parent rather than overwriting it! Annoying! Salamander can exclude parents with a UDF which be needed to prevent them uploading, however I was trying to automate the process by overwriting the existing email instead. It seems I am foiled by Microsoft SDS once again as it just adds another duplicate record! I will raise a ticket with MS support and see if they think it's a bug with the sync as I'm sure this worked in testing a month ago. Please note: Microsoft do not remove addresses when they fall out of sync. You can exclude them to stop them going back in, but you have to run a powershell script to delete parent data. This is what I was trying to avoid! The script is here... https://github.com/OfficeDev/O365-EDU-Tools/blob/master/SDS%20Scripts/Reset-Guardians.ps1 You have to add a custom App Registration in Azure to get an API ClientID and ClientSecret for the script. The data is in Graph and special permissions need granting for editing that. The permissions are below... The script can remove all parents from one student, or all parents from ALL students. It does not remove one parent from one student as it is. Here is how I currently call it: # Set common params $TenantDomain = "mydomain.uk" $ClientID = "7jief9ej42-dfht-4444-5555-123456787tth" $ClientSecret = "2Afrgh755gyh6PfgthuyfrthjuJLAM446hhr" # Remove all guardians from one user $student= Get-AzureADUser -ObjectId [email protected] .\Reset-Guardians.ps1 -OutFolder . -clientId $ClientID -clientSecret $ClientSecret -tenantDomain $TenantDomain -studentAadObjectId $student.ObjectID # Remove guardians from all users in the tenant .\Reset-Guardians.ps1 -OutFolder . -clientId $ClientID -clientSecret $ClientSecret -tenantDomain $TenantDomain You can strip out the data manually with the script and then use Salamander with a UDF so you can exclude the parent from the CSV uploads in SDS. Perhaps there is a way to automate the script as well. I have one idea where we ask Salamander to write an extra CSV with any of the opted out parents in it. We could then run the Reset-Guardians script against the contents of the opt out csv on a scheduled task. If I figure this out I will update again. Sorry! Chris

Hello, I've been working to find a way to opt out an email address from Teams weekly digest and have finally come up with a manageable solution that I thought I'd share. We have SIMS for our MIS and Salamander Active Directory provisioning Teams Classes and Parent data via the Microsoft SDS sync. Salamander creates nightly uploads of the SDS csv file set and they offer this for free using their tool here... https://www.salamandersoft.co.uk/free-utilities/salamander-for-school-data-sync/ This fix is for those that have an automated SDS sync upload rather than the free run-once option. The problem: A parent contacts the school to say that they do not want to receive the Microsoft Teams weekly digest email. You need to keep the email in the MIS for other systems. The Microsoft SDS already has the parent email address and it's only possible to remove the email from the Azure Active Directory by using the reset_guardians.ps1 script provided here: https://github.com/OfficeDev/O365-EDU-Tools/blob/master/SDS%20Scripts/Reset-Guardians.ps1 Once you reset the guardian contacts for a student, all of the contacts are removed from the student, not just the one that wish to opt out. The other contacts for the student do not automatically reappear on the next csv file upload and it's only possible to get the contact data back again if you run a Full Sync reset on the SDS profile - something that cannot be automated (at the time of writing this). Removing an individual is possible via PowerShell if you read into the script. You can adjust the contact array on the student object in the graph data to contain what you want manually or via a script. However that's not so easy for your admin/data/pastoral teams to manage themselves and would be an administrative headache for any IT Support Team. A simple solution: Rather than thinking about removing the parent from the student contacts on the Azure object, we can simply update the email address to a new value instead. The SDS sync process will push changes to values and add new values but will not remove them. So all we need to do is flag the contact in the MIS and have the process replace the email with a non existent one that will bounce. Simple! For our setup we added a User Defined Field in SIMS in the Contacts data set. I called ours "NoTeamsEmail" and set it as a True/False type value. I then asked Salamander to add the new "NoTeamsEmail" UDF to the parent data extract, and use the value of the field to determine what the email address will be in the users.csv file creation workflow for SDS. The logic is that if the value of "NoTeamsEmail" field in SIMS is set to True (ticked) by the school's staff, Salamander will use a fixed value of "[email protected]" instead of the actual parent email address. SDS will then process this change when the files upload and the parent will no longer be receive the weekly email. Note: The email address you choose should be at your own school domain or a domain that you control to ensure that it is never going to exist. This works in any automation on SDS if you can identify the parent/guardian users somehow and just replace their email in the process if they are flagged. Thank you to Salamander who have implemented this for us - developers changed their SDS process to accommodate it. Top marks Thanks, Chris

You can fix the DNS hijacking by setting the DNS suffix search order in windows. For some reason Windows appends the domain on all requests when on a domain joined PC. On Virgin, try doing nslookup for google.com and you get google com.mydomain.org. Try nslookup mydomain.org and you get mydomain.org.mydomain.org. If you set the append suffix search order in windows networking to... . (Dot on it's own) Mydomain.org ...then it fixes the problem. The dot on it's own means - don't append any suffix. The reason the default DNS suffix behaviour doesn't work with many remote access methods is because the connection attempts to resolve... Myservice.mydomain.org.mydomain.org. ...which on Virgin will resolve to their bogus DNS intercept IP.

I've been pulling my hair out also. We have used Direct Access and it does not work on some ISPs, and here is the reason! DNS service "helpers"! Virgin consumer market routers always return a success record for any bogus DNS lookup you make. I think the idea is to offer a fancy DNS error page or a list of search results. Windows default DNS lookup behaviour on a domain joined PC is to append the domain suffix. If it's a toplevel domain the expectation is for the initial lookup to fail and then it resolves what you want. I saw that when doing an nslookup for google.com on virgin that it would return a result for... google.com.ourdomain.org Windows added our domain suffix and Virgin DNS servers resolved it! What a pain. Of course when you lookup... DAServer.mydomain.org.mydomain.org It fails to resolve the correct IP address and instead tries to connect your device tunnel to their bogus DNS intercept. This causes DA to fail to connect. The fix is pretty simple and can be delivered with Group Policy I believe. We just set the DNS suffix search order manually to append in this order... . (Dot on it's own) Ourdomain.org The dot on it's own signifies - no suffix. Reboot after applying and DA connected just fine! Hope that helps some folks keep their hair for a little longer. Thanks, Chris

https://github.com/OfficeDev/O365-EDU-Tools/blob/master/SDS%20Scripts/Reset-Guardians.ps1 I booked a call with MS support to help me register an application API in Azure AD for the script. It includes adding the required permissions on the API registration for the script to run with.

I've dealt with our parent emails this week and this may be of interest... I'm using salamander AD to create the csv files. They are pushed up automatically every day early hours. Be mindful for your user provisioning flow with SDS uploads: check that any new student/teacher accounts ilare created in 365, and have a licence applied, BEFORE your SDS csv upload includes them. Otherwise SDS will have validation errors if new accounts included in the csv don't actually exist in 365 yet. Next, check that Salamander filter which parents are included. In SIMS we have priority 1/2/5 for parent contacts. Our P5 are normally grand parents or god parents who won't want extra emails! Or contacts that are related but have no access to students for safeguarding. Queue GDPR complaints. We include only P1 and P2 parents in our csv now. Finally, I can tell you that parent emails do not get removed automatically. If you stop uploading them, they still remain in SDS. You can see the parent emails in SDS if you go to the People list and open up a student. The guardians and emails appear at the bottom of the student fly out details pane. There is a way to remove parent emails using a graph API script provided by Microsoft support. Once set up you can reset parents for a single student, or for all students. When your csv uploads again it will put only the parent you need back in again. I am in the process of installing the script as a scheduled task on our server to run on a Friday evening, removing all parents. The next csv upload would be Sat early hours and contain the correct parents for the weekend summary to build. The parent emails are processed by Microsoft from Saturday afternoon. Please appreciate the scale of this task! The entire world's parents all getting an email. It is for this reason that there are no controls over exactly when your tenant is processed. It just happens whenever Microsoft get to your tenant as quick as their servers can process it. I feel like I have got to grips with SDS and parent emails now so if anyone would like a hand, drop me a PM! Hope this helps someone

Hi, the legal text registry settings are applied via group policy. You need to use Group Policy to apply the registry settings with the Item Level Targeting as per my instructions. Before you apply the registry settings you should check that the legal text is NOT applied anywhere else. Please remove your legal text from everywhere and attempt to build a machine with MDT. This will make sure that MDT is working in your environment. When MDT is tested working you can then try adding the legal text as I explained in my post.

Hi namarjeet, MDT gets stuck after the workstation is added to the domain if the legal notice is configured before it's finished. I'm guessing that if you're having this issue you have a legal notice already configured. How are you configuring the legal notice text? A) Are you using the native Group Policy for that computer? Check in the policies for... "Interactive logon: Message text for users attempting to log on" "Interactive logon: Message title for users attempting to log on" Located here... Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options ...and remove this from your policy. Set it to Not Configured. B) Is it in the registry of the build image? Check the registry of the computer before you capture it. Look for... "SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnoticetext" "SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\legalnoticecaption" ...and remove them. C) Are you using my suggestion to deploy the registry items using Group Policy?