NicholasEsping

In Intune if you go to your proactive remediations you can copy and paste the script from the settings page for each remediation. You will likely need to re-sign the script and upload it again. You might also just be able to turn off Enforce script signature check for the one that is giving you problems.

Veyon is open source and has some paid add ons. The free version works well for us. Veyon | Cross-platform computer control and classroom management

You can deploy store apps through the company portal with Intune if you are blocking the Microsoft Store.

I might be wrong, but I believe that will depend on how your workloads are set up with Co-Management. Switch co-management workloads - Configuration Manager | Microsoft Learn

Is the user you are testing this with licensed for Intune? What are a few of the settings you are trying to set differently for Staff vs Students? I can see if I can make them work in my environment. For us we don't really assign different user policies if a staff member uses a computer in a lab, they will get the same policies as the students get. This way we avoid any delays in waiting for Intune to sync when a different user logs in.

The policies should get applied after the device syncs after the user has logged in. Depending on the policies you are trying to deploy this does not always work well if you have staff and students use the same computers with different policies this might not be the best solution.

We had to allow the copilot extension ids for it to start showing up and working correctly for us. Copilot or Discover browser extension not working as expected for managed Edge browser - Microsoft Community Hub

If you use office 365 you could do something like this with PowerShell to send an email using Microsoft Graph API with the user logging in and workstation name. [color=#CCCCCC][font=Consolas] [color=#9cdcfe]$user[/color] [color=#d4d4d4]=[/color] [color=#dcdcaa]get-wmiobject[/color] [color=#d4d4d4]-[/color]Class Win32_Computersystem [color=#d4d4d4]|[/color] [color=#dcdcaa]select-object[/color] Username [color=#9cdcfe]$workstation[/color] [color=#d4d4d4]=[/color] [color=#9cdcfe]$env:Computername[/color] [color=#6a9955]#send email[/color] [color=#9cdcfe]$AccessSecret[/color][color=#d4d4d4]=[/color] [color=#ce9178]""[/color] [color=#9cdcfe]$AzureAppID[/color] [color=#d4d4d4]=[/color] [color=#ce9178]""[/color] [color=#9cdcfe]$tenantID[/color][color=#d4d4d4]=[/color][color=#ce9178]""[/color] [color=#9cdcfe]$tokenBody[/color] [color=#d4d4d4]=[/color] [color=#569cd6]@[/color]{ [color=#9cdcfe]Grant_Type[/color] [color=#d4d4d4]=[/color] [color=#ce9178]"client_credentials"[/color] [color=#9cdcfe]Scope[/color] [color=#d4d4d4]=[/color] [color=#ce9178]"https://graph.microsoft.com/.default"[/color] [color=#9cdcfe]Client_Id[/color] [color=#d4d4d4]=[/color] [color=#9cdcfe]$AzureAppID[/color] [color=#9cdcfe]Client_Secret[/color] [color=#d4d4d4]=[/color] [color=#9cdcfe]$AccessSecret[/color] } [color=#9cdcfe]$tokenResponse[/color] [color=#d4d4d4]=[/color] [color=#dcdcaa]Invoke-RestMethod[/color] [color=#9cdcfe]-[/color][color=#9cdcfe]Uri[/color] [color=#ce9178]"https://login.microsoftonline.com/[/color][color=#9cdcfe]$tenantID[/color][color=#ce9178]/oauth2/v2.0/token"[/color] [color=#9cdcfe]-[/color][color=#9cdcfe]Method[/color] POST [color=#9cdcfe]-[/color][color=#9cdcfe]Body[/color] [color=#9cdcfe]$tokenBody[/color] [color=#9cdcfe]$headers[/color] [color=#d4d4d4]=[/color] [color=#569cd6]@[/color]{ [color=#ce9178]"Authorization"[/color] [color=#d4d4d4]=[/color] [color=#ce9178]"Bearer [/color][color=#569cd6]$([/color][color=#9cdcfe]$tokenResponse[/color][color=#dcdcaa].[/color][color=#9cdcfe]access_token[/color][color=#569cd6])[/color][color=#ce9178]"[/color] [color=#ce9178]"Content-type"[/color] [color=#d4d4d4]=[/color] [color=#ce9178]"application/json"[/color] } [color=#9cdcfe]$MailFrom[/color] [color=#d4d4d4]=[/color] [color=#ce9178]"[email protected]"[/color] [color=#9cdcfe]$MailTo[/color] [color=#d4d4d4]=[/color] [color=#ce9178]"[email protected]"[/color] [color=#9cdcfe]$URLsend[/color] [color=#d4d4d4]=[/color] [color=#ce9178]"https://graph.microsoft.com/v1.0/users/[/color][color=#9cdcfe]$MailFrom[/color][color=#ce9178]/sendMail"[/color] [color=#9cdcfe]$BodyJsonsend[/color] [color=#d4d4d4]=[/color] [color=#ce9178]@"[/color] [color=#ce9178]{[/color] [color=#ce9178] "message": {[/color] [color=#ce9178] "[/color][color=#9cdcfe]$user[/color][color=#ce9178] has logged in to [/color][color=#9cdcfe]$workstation[/color][color=#ce9178]"[/color] [color=#ce9178] },[/color] [color=#ce9178] "toRecipients": [[/color] [color=#ce9178] {[/color] [color=#ce9178] "emailAddress": {[/color] [color=#ce9178] "address": "[/color][color=#9cdcfe]$mailto[/color][color=#ce9178]"[/color] [color=#ce9178] }[/color] [color=#ce9178] }[/color] [color=#ce9178] ][/color] [color=#ce9178] },[/color] [color=#ce9178] "saveToSentItems": "true"[/color] [color=#ce9178]}[/color] [color=#ce9178]"@[/color] [/font][/color] [color=#DCDCAA][font=Consolas]Invoke-RestMethod[/font][/color][color=#9CDCFE][font=Consolas]-[/font][/color][color=#9CDCFE][font=Consolas]Method[/font][/color][color=#CCCCCC][font=Consolas] POST [/font][/color][color=#9CDCFE][font=Consolas]-[/font][/color][color=#9CDCFE][font=Consolas]Uri[/font][/color][color=#9CDCFE][font=Consolas]$URLsend[/font][/color][color=#9CDCFE][font=Consolas]-[/font][/color][color=#9CDCFE][font=Consolas]Headers[/font][/color][color=#9CDCFE][font=Consolas]$headers[/font][/color][color=#9CDCFE][font=Consolas]-[/font][/color][color=#9CDCFE][font=Consolas]Body[/font][/color][color=#9CDCFE][font=Consolas]$BodyJsonsend[/font][/color]

You could make a scheduled task with a script that sends an email when a user logs in.

Try blocking the ms-appinstaller protocol. I do this with Intune but you should be able to with GPO.

I would go with Full Flash Update images and Windows Configuration Designer. Should be able to deploy images within minutes with this method. Capture and apply Windows Full Flash Update (FFU) images | Microsoft Learn GitHub - rbalsleyMSFT/FFU: Using Full Flash Update files to speed up Windows Deployment

I don't use power automate but it looks like you just click on the three dots and then choose save as.

Try it like this and it should add users from both groups into the new group. user.memberof -any (group.objectId -in ['xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx', 'xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx'])

Can you confirm the app is actually getting installed? If it is just failing on detection, it would still be installed on the computers but only reporting wrong in Intune. Is your detection rule just detecting the file or are you checking for version? I have seen some files not have version info and be a problem.

You can use mailflow rules to either have the email approved by someone before they are sent to the teachers or just block the students from sending emails.

If you have SCCM set up you should be able to set the co-management to use Intune policies. Below is some information on licensing the section on co-management talks about not needing individual licenses if using SCCM. Product and licensing FAQ - Configuration Manager | Microsoft Learn

If you don't have A3 or A5 or standalone Intune licenses you will need to have SCCM set up to add devices as co-managed to Intune. That would allow you to use Intune policies without Intune licenses.

We block the store and use the Company Portal app to deploy store/non-store apps.

We set MFA for our staff users using a conditional access policy. This allows us to assign the policy using groups and exclude accounts that we do not want to have MFA enabled for.

We use a synology disk station to backup our office 365 tenant. It can backup shared mailboxes. Admin Console | Active Backup for Microsoft 365 - Synology Knowledge Center

I used S Mode with Windows 10 from 2017 until switching to Windows 11 over the summer. Traditional S Mode is no longer a thing with Windows 11 you can look into Windows 11 SE but you will need to purchase new devices that come pre loaded that way. When we made the switch to Windows 11, we implemented WDAC and replicated the S Mode settings. We did loosen things up a little by adding IME as a managed installer to allow for easier application installs. Overall, I would highly recommend using WDAC on student devices but there is a pretty significant learning curve.

You can sync Apple School Manager with your SIS and that would identify Staff vs Students.

Here is the PowerShell I use to create new accounts from a CSV file. I don't use home drives, but I did add it to the script for you. Import-Module activedirectory #Store the data from ADUsers.csv in the $ADUsers variable $ADUsers = Import-csv "C:\oneroster\newadaccounts.csv" #Loop through each row containing user details in the CSV file foreach ($User in $ADUsers) { #Read user data from each field in each row and assign the data to a variable as below $Firstname = $User.givenName $Lastname = $User.familyName $Username = $User.username $Password = $User.password $OU = $User.ou#This field refers to the OU the user account is to be created in $userprincipalname = $user.email $displayname = $user.displayname $jobtitle = $user.jobtitle $department = $user.department $Group = "Students" $homedrive = $user.homedrive #Check to see if the user already exists in AD if (Get-ADUser -F {SamAccountName -eq $Username}) { #If user does exist, give a warning Write-Warning "A user account with username $Username already exist in Active Directory." } else { Write-host #User does not exist then proceed to create the new user account #Account will be created in the OU provided by the $OU variable read from the CSV file New-ADUser -Name $displayname -SamAccountName $Username -UserPrincipalName $userprincipalname -GivenName $Firstname -Surname $Lastname -Enabled $True -DisplayName $displayname -EmailAddress $userprincipalname -Description $jobtitle -Title $jobtitle -Department $department -HomeDrive $homedrive -AccountPassword (convertto-securestring $Password -AsPlainText -Force) -changepasswordatlogon $true -Path "$OU" Get-ADUser -Identity $displayname | %{set-aduser -identity $_ -add @{proxyaddresses = ("SMTP:"+$userprincipalname)};} Get-ADUser -Identity $displayname | %{set-aduser -identity $_ -add @{targetaddress = ("SMTP:"+$userprincipalname)}; write-host account has been created for $displayname} Add-ADGroupMember -Identity $Group -Members $username }} #end function

Mosyle themselves have always been very helpful for me.

Can you start/stop any services with powershell? I think when the options are greyed out there a required service is not running. The service that greys out the domain options is LanmanWorkstation. Start-Service -Name "SERVICE-NAME" Random thought did you maybe create a new task sequence for this deployment and forget to add the admin user to the administrators group?