Pashers

Roaming profiles is when the profile is copied onto a server and local machines. So for example the roaming profile would be \\myserver\profiles\%username%. So when a user logs onto a machine, it'll first create one on their local HDD (C:\users\%username%) then copied to the server. Roaming profiles is for the settings of the users In active directory within the profiles tab (I think) there's a map a users home drive section. So you can set the drive letter (let's say "H" for now) to \\myserver\homedirectories\%username%. This is so they can store their documents

You can do yes, so you can have the security groups specify what folder access they are allowed to have. Also if you wish, you can map the folder and assign it a drive letter if a user it to use it often. As you're new are you aware about the home directories and how to use them with AD?

The ABTutor features (form what I can remember, as I'm currently moving from working in a university to a school as a network manager). Monitor screens, share student/teacher screens. Policies - block internet, applications, restrict programs, Questionnaires/polling Messages/chat Lock screen Power up and shutdown machines Oh and you can run commands/programs

When they change grades, you just need to remove them from the old security group and add them to the new grade security group. They won't need to moved.

Just to make sure we're on the same page - AD [Active Directory], OU [Organizational Unit] (looks like the little folders), as a rough guide line and a brief idea you could have something like: mydomain.com (this should be your domain name. Right click here select organizational unit and call it Student Users) Users (this is a default OU, you could put Student Users in here as well, or you could create an alternative OU which includes all users. Personally I don't put them in the default Users OU) Computers (another default OU and again I don't tend to keep the computers in here.) All Users > Students Users > 2016 > 16jbloggs, 16asmith, these are the individual users for 2016. All Users > Students Users > 2015 > 15jbloggs, 15asmith, these are the individual users for 2015. All Users > Staff > Teaching > list of staff users or Staff > teaching > Blah Staff > Non-teaching > Blah User Groups > 2016 Grade 10 - Add the users within 2016 who are grade 10 to this user membership group. User Groups > 2016 Grade 9 - Add the users within 2016 who are grade 9 to this user membership group. User Groups > 2015 Grade 10 User Groups > 2015 Grade 9 User Groups > HOD User Groups > Finance (have as many groups as you like to help specify what requirements they may need). When you have created the OUs, students, and the groups. You've assigned the students to the correct groups then you can look at the architecture for your computers.

I've used it and was very happy (more importantly, the teachers were happy), you can download a trial. Very easy to use and I remember very cheap compared to others. You can set policies etc for the teachers, or they can create their own. I think the main thing that I liked was the one off fee. There is an annual option however. I can't compare it to any others unfortunately, so maybe someone else has used Impero and ABTutor. Also must admit, the teachers used a small percentage of its capabilities. Not sure if they did the report/polling or used many of the policies (probably just Internet blocking and locking screens)

You mentioned you look after a large number of schools. Have you thought about creating a SCCM site? You'll need a distribution point on each site locally and a primary site somewhere? This could potentionally save you time in the long run.

Just re-read the original again, you can just use one/two boot .wim files. If you create a boot.wim file using windows 10 (x64 & x86) then this will support deploying images in windows 7, 8 10 etc. It might help resolve your issue if you just use a windows 10 boot.

Sure, let me know if you get stuck.

I feel like I should rewrite the above and use less thens

In my oppinion I don't think you'll need the Grades to be in different OUs in AD. I'd have: Student Users > 2016 Student Users > 2015 etc. Then you'll create a membership group called "2016 Grade 10", "2016 Grade 11" etc. Then you can add the policies/restrictions based on the group membership rather than OU location. You'll add the users to the relavent group, then map the shared folder/drive depending on which group they are in.

Not used Impero, but I presume you can disable exes running from locations. If so then zipcentral may work by storing the exe in these locations: %localAppData%\*.exe %localAppData%\*\*.exe %localAppData%\Temp\*.zip\*.exe %localAppData%\Temp\\*.exe If so you can add the above to a group policy or in Impero to disable exes running from these locations. FatDex - Disable .exe’s from running inside any user %appdata% directory – GPO

Have you looked at ABTutor as an alternative? From memory it's a one off cost of about £500 per teaching machine. So it's the same cost for a lab of 20 as a lab of 100 if you have one teaching machine.

This might help https://www.technibble.com/bypass-windows-logons-utilman/ I've used this method a few times.

I wonder if it's a GPT format the FixMBR wouldn't work you'd need to recreate the boot partitions (too late now you fixed it, but just a thought)