HereIGoAgain2601

Is this difficult to setup? Hadn't thought about this.

Thanks guys for your input. Getting lots of blow back from staff saying that not being able to jump into kids folders will cause them an incredible amount of delays and they won't be able to do their jobs! We may end up having to keep pupil data on-premise.

Hello, How are people managing computing staff accessing pupil home folders to retrieve work? At the moment we have a on premise file server that staff can dip into pupil home folders when needed. We are looking to move across to OneDrive/Teams/SharePoint at the summer and wondering what solutions I can give staff to get around this legacy way of doing things? Thanks Joel

I’d sell it and keep my existing gaming machine as it’s good enough for me 😂

We haven’t used Chromebooks with our Sophos appliance as we are mostly Windows or Max - that being said the Sophos platform is excellent and would highly recommend it. Only issue we have had over the last 4 years is with the Windows authentication (STAS) from time to time but this is a minor issue.

We are using Print deploy for our devices - they are all intune managed and aside from MF we have no on premise servers. Be interested to know how you got the SSO working - never quite cracked this but works fine when the user logs on manually with azure ad credentials. I’ve seen they have updated the Azure and papercut integration in a recent version of MF so maybe upgrading to this will help.

Just to say we went to Windows Update for Business on around 1000 devices over 2 years ago and it’s been fantastic, especially with large numbers of staff devices not returning to school for months of end. Some of our trust staff haven’t been into an office since 2020. It’s fantastic and the update compliance is so much more useful and up to date for monitoring purposes. We also had to put credit card in to setup but have never been charged as it is free.

Hi, We did make the move to the M365 licensing and activation for Windows 10. There was difficulty getting Microsoft to provide the upgrade key for Windows 10 Home to Windows 10 Pro/Education. Even though there is an article clearly showing your entitlement, it took us a few weeks to get them to approve this academic upgrade license. Even when they did, they limited us to 100 devices on the MAK key they issued - I think this was in relation to the number of M365 A3 licenses we had purchased. The 100 sorted out most of our devices (as it was a 3 form primary) that had purchased 50 A3 licenses. There are probably around 20 that are 'not activated' properly, but these have just moved up to the top of our replacement priority. The devices are 3rd gen i3/i5 with 4GB RAM and HDDs so we decided it wasn't worth the hassle of contacting Microsoft again and are just looking to replace these this academic year. We were lucky in that the SBM and HT were the ones really encouraging the cloud migration - so they were in effect happy to pay the difference to make it work. We had this discussion at length prior to migration and they were happy to assume the cost and risk of the move to A3 license. There is also a bit of a pain about part time staff who would normally only be 1 FTE on the old way of licensing... but will now need 2 licenses for M365... but it was just one of those things we accepted as part of the strategy to go fully M365 / Intune based and the costs were factored in. It was a bit nerve wracking at the time doing away with KMS and wondering what would happen, but has to be said the best thing we ever did and we have no regrets. The whole thing is just so much easier to work with day to day and we aren't tided to any on premise deployment or management systems. We just need to get PaperCut MF moved to Hive and then we are completely serverless at this particular site. Good luck! Thanks.

Happy to discuss if you wish James. We are looking to move away ASAP - they have been promising things for years and never deliver. The new bosses have simply realised that a lot of schools has had enough and they are deliberate trying to stop us from being able to get a new MIS that is modern and more useful. Nobody actually believes that SIMS is going to be truly cloud based even within those 3 years. I went to a meeting of the Capita big wigs 4/5 years ago and there has not been 1 bit of actual change or progress since then. It is disgraceful behaviour by basically forcing us to stick with something for 3 years or putting pressure on schools that we don’t need to now get this done quickly.

We also managed to save a lot of copying/postage costs for EHCPs at our special school by adopting SharePoint a few years ago. The admin staff were against it and first but it saved hours of time for them and money! Greatest thing we did and proved it’s worth during COVID.

We have been running the H2 editions of Windows 10 for a number of years - I agree with earlier posters that the upgrades have got a lot easier in recent times. Back when Windows 10 was first released it was a nightmare trying to keep the devices in a supported channel but Microsoft has put a lot of work into making this pain free. On our 'modern' devices users are not aware the upgrades are even taking place. Admittedly some of our older devices still take a little while to upgrade but the process is fully automated and we use this to encourage users to replace their ageing devices. We ditched WSUS years ago as it was a massive pain and was always crashing. We use Windows Update for Business with group policy to defer the feature updates by 12 months so we always stick on the H2 editions and this has worked really well on the whole. The Azure monitoring is also really useful and shows us the statistics on whats updated and whats not. We still have an SCCM server for imaging but this is being phased out and will be replaced with InTune within the next 12 months if things go according to plan. Supporting roughly 1400 Windows devices at present.

In recent weeks quite a lot of our devices keep reverting to Chrome as the default PDF viewer. We have set this back for a number of users only for it to revert back to Chrome a few days later. Is anyone else seeing this behaviour? We haven't changed our default file association XML in years and all has been well.. until now! Thanks

I tried to do this earlier in August and got nowhere ☹️ Working with a school that had A1 plus for faculty but not students! Couldn’t get anyone to understand what I wanted from Microsoft they just kept saying you already have A1!

We use Sophos XG - it’s not Single Sign on as yet with Azure so we have deployed the authentication client via MSI that prompts for Azure credentials

We are estimating it as £90 a month but it could end up being more. We are also using the Secure LDAP for authentication to our web filter / firewall. We have added it to our Microsoft CSP agreement so we can pay it to the reseller on invoice rather than credit card etc

We have done exactly this earlier in the break and seems to work well. We are using Azure Domain Services for authentication with Secure LDAP

Hi, Does anybody happen to know the URL/Ip endpoints for Office 365 click to run installers.... I have tried googling but can't seem to find the definitive answer? Our Sophos XG is blocking the download from happening.. have tried looking in the logs at IPs and allowing them but don't seem to be getting anywhere. Thanks Joe

Hi Can’t say we have had this exact issue but we had a few bumps along the road in getting this setup. In the end we were using Azure AD with Secure LDAP and it was getting a bit confused even then.. had to deploy and remove the printers a few times before it actually worked When we did get it to work we then find out that the universal print limits how many copies you can do based on your license! So in the end 20 prints a month per user was a no go for us and had to abandon it all. Joel

I should add that they are domain joined currently so must have some windows 10 pro license of some sort but not sure if it would be hardware or a MAK key that the old IT company had “found” Thanks

Hi, We are looking at getting a CSP agreement. To confirm, we have devices currently on Windows 10 but not sure how it’s been licensed by the old IT guys. There are no VLSC agreement in place so assuming it was built into the OS. Some are still on Windows 7 Pro and will need upgrading. If we buy the A3 and blanket wipe to Windows 10 Pro Will they connect to our intune and activate windows 10? Thanks Joel

Thank you again for taking the time to explain this it has given me some food for thought. Just wondering did you go with the Azure Domain Services extra add on for the secure ldap - and if so how did you get this? I’ve been trying to see if we can get the license somehow through CSP but nobody seems to know. It’s running on trial credit on Azure at the Moment. I’ve managed to get the Azure printing solution setup via the papercut mf as it has a connector already built in so this seems easy to deploy for us. Thanks again

Thank you - I am happy with the skillset of Azure AD and Intune and got our policies 90% right… so that’s not worrying me I was just concerned I would come across something later on that I’d regret and have to go back to an on premise!

Hello, I am working with a school that is already pretty cloud focused - they have Arbour Cloud MIS and all of their data is in Teams, SharePoint or OneDrive already. Long story short, their on premise AD is massively out of date - users and polices are not configured correctly and there is no Azure AD connect or similar setup. Essentially we would have to rebuild the AD to make it useful and up-to-date. We are looking to use Intune for the management of their devices and everything looks reasonable here in terms of policies and restrictions, Autopilot etc etc. The only on-premise software they need to run is authentication to the Sophos XG web filter and PaperCut MF. MF can be synced with Azure Active Directory via Secure LDAP. I've got this up and running in a test environment and everything seems to work as expected. Sophos was a bit more a pain and would require the MSI connect client but would achieve the end goal allbeit with another logon to the client. Is there anyone already doing this - and if so is anything obvious I am missing with this *almost* serverless approach? Is there going to be some big gotcha and I will end up wishing we had just built an on-premise AD? Thanks Joel

We had this issue on a couple of machines. Reimaged and went away. Hasn’t occurred since. It happened around the time of an in place upgrade so wondering if something went wrong.

Thank you - I thought this might be the case. Unfortunately this isn't an option in this particular scenario - the school is using a legacy G-Suite tenancy that we are in the process of retiring this term as they transition into our Trust Office 365 / Google platform that is already linked. Just didn't like the idea of them being single factor until September.