HPlum78

Just a thought about using sleep mode, if you secure your desktops/ laptops using bit locker there are some considerations around the security of the keys. End user devices are not my thing these days so things could have changed.....

I know someone has mentioned the sysinternals PsShutDown but another utility in that is the PsLoggedOn command, I will also point you at the godfather (Ed Wilson) of scripting post about this https://blogs.technet.microsoft.com/heyscriptingguy/2011/03/17/use-powershell-to-detect-if-a-workstation-is-in-use/ as he has already written the powershell for you.

If you are using o365/ exchange online the power of the security and complience centre is really good in fact the information that is held in your tenant re user access and the likes is massive. You should only be accessing this in line with the law and an information security ofiicer with a policy mind. Don't forget the admin is not exempt from the law!

Yeah I would try to not install your root CA on your DC if you can avoid it. If you follow the strict guidelines on this you should try to have an offline root and an intermediate CA, but I suppose its all about scale. Sha-2 not 1 any other things I can think of I will post......

ALL maybe over stating it! I am in your camp just not as blunt.

And none of your staff have just hit the remember button in their browsers?

Yeah I suppose putting a seamless SSO solution in front of SIMS is like putting lipstick on a pig! :-P

How does having a separate login stop kids access a laptop that has been left open in the classroom? chances are from what I have seen in the past SIMS (insert your own MIS/ web service here ) will be open anyhow! The issue is understanding that SSO is only part of IAM (Identity and Access Management) if you just talk about SSO then you are missing a much larger picture and you will always fail to deliver a seamless user experience and introduce identity/ password fatigue. You could deliver SSO to your MIS solution and enable two factor authentication to increase the assurance around who is actually accessing it for instance (you could also limit the token life, to solve the issue of the application being left open). I will include this https://social.technet.microsoft.com/wiki/contents/articles/15530.the-four-pillars-of-identity-identity-management-in-the-age-of-hybrid-it.aspx#Defining_Identity_and_Identity_Infrastructure its a little old now and has been updated but its a starter for ten.

That would be part of the redirect (googles page) need to ask them but not beyond the wit of man.

SharePoint online with a mix of teams along with flow and forms can do this, thing is it needs development to get the functionality ticking.

Skype!

have they got imap enabled? use PowerShell - Get-CASMailbox %name% First place I would start

PowerShell connect to the database, look for new/ disabled users and create/ disable accounts form that. To achieve this in a more efficient manner you should probably create a delta view of the iSAMs DB and connect your PS to that DB. I am sure you get the idea.....

Get-ADUser -SearchBase 'OU=External,OU=User Accounts,DC=Sch,DC=UK' -filter * | select samAccountName | Add-ADGroupMember -identity '%YourGroupName%' That would do it off top of my head....

Are the devices work placed joined?

I work somewhere else! and will say this on the subject, as far as I can see there is no debate to what we should be doing in schools with desktop OS. Schools should be encouraged to offer a suite of desktop OS's, in the most part when our children leave school they will probably end up using Windows but they may end up using Linux. If they go on to FE/HE then they will undoubtedly sit in front of both and that's not a bad thing in my book and something that should have been done in schools for the past few years at least! That said and cost is not something I am going to argue here MS made end users not have to care about the details and every desktop OS release has moved this concept forward so the argument about file extensions/ drivers/ memory management and all those things we had to care about 20 years ago have faded fast so that end users can be just that end users. Conversely and as I am a man of many (RED) hats for my sins, Linux has also been fighting the self same fight I remember installing Linux for the very first time and having to do a lot of work to make it sit happily on the hardware I had at the time, I now just throw in the media (however that may look or come!) and in the most part its fire and forget (just like MS, they are making the end users not have to care). The change in landscape has been massive and if I look back could I ever have seen MS embracing Linux like they do today or would they have even considered being an open source developer like they are now, would Linux (Red Hat) back then considered a partnership with MS like they are now, BASH on Windows, PowerShell/ .NET on Linux things are changing and if we want to keep paying the bills so must we, offering multiple end user experiences is a must and should be now common place, stop debating it and just get it done! That covers the desktops. Servers are a different matter, along with what the infrastructure behind that looks like and that don't come free!

This is still in preview and there are some known issues and bugs with PassThrough auth so without digging into it too much I would guess you are hitting one of those potentially.

You can do this via ADFS https://technet.microsoft.com/en-us/library/hh526961(v=ws.10).aspx

You may just want to raise a MI here and stop all changes to AD and your DC until you get to the bottom of what's happening.

hold on a second I have just reread your initial post can you check in each of your domain controllers for event id 2095 (in the directory service log)... Let's rule out any usn rollback issues here as well.

Do you know if you are replicating the sysvol/ netlogon shares via FRS or DFSR? If it's via DFS can you check on the original DC(s) for event 2213 in the DFS replication logs(if it's FRS then the 2016 DC will never get the sysvol/ netlogon and that needs sorting first). When you are browsing to the netlogon/ sysvol shares where are you doing this from? As don't be fooled in to thinking that these are being replicated if you are just \\ ing these from a client. A quick way to verify that each DC has these shares is to \\ each DC directly so \\SVR-DC-02\ you can even try creating a file directly in each servers netlogon folder and then watch it appear in all the other servers netlogon folders for a quick a dirty test. Also when you say restored what have you actually restored? The whole DC the contance of the sysvol / netlogon shares? I see you used the PowerShell to move the FSMO roles from a post a few days ago like @FN-GM has said just check what DC thinks it's holding the FSMO roles. The following tool is really useful https://www.microsoft.com/en-us/download/details.aspx?id=30005

You could home brew with a Rpi and I think if I remember rightly the NetPi image that you can down load freely (look it up). Could build a little intergrated unit with a small touch screen I am sure.....

https://powerapps.microsoft.com/en-us/tutorials/getting-started/ https://flow.microsoft.com/en-us/

So here we go (from memory) I used share point lists for the stock lists and used InfoPath to create a form that pulled the info from the SP lists to give the user nice drop down boxes and quantity fields and the like. After the user had selected all of the items they required this was then saved in to another SP list, using SP designer I then setup some workflows that would look up a users manager/ budget holder and make some decisions about what authorizations where required and the like. After these workflows had been completed a mail would be sent to a stationary order mailbox that all the finance team had access to and the user that made the request (and anything in between like if the users manager/ budget holder refused the request and the likes...) finally the finance team would mark the order as ready to collect and this would again kick of a workflow that sent an email to the user who made the request. Now we are in the world of SharePoint online (365) I think that some of the products I used to create this system have been changed rebranded to PowerApps and Flow, but I am sure that this is more than possible and easier than it was back in the days of SP 2010/13.

I did a stationary ordering system for my old finance office in SharePoint had all the workflows and the like.