NicholasEsping

Here is a good article that shows how to enable S mode in 1803 and how to create a bootable iso. You would just need to change the the one line that says pro to enterprise or education which ever version of windows you decide to use.

You should be able to use powershell to change them all automatically https://gallery.technet.microsoft.com/office/Update-AD-Users-UPN-with-d9722293. For new users if you set the correct email and UPN in AD when creating the account it will sync over properly the first time.

If you can just do a migration that would transfer all previous emails, calendars, and everything else your after. Then you can just change their primary SMTP and UPN so they can log in with the new email format.

If you can't just migrate and let them use the same email address I would add the @lea.sch.uk domain to your tenant and have it be used as an alias for your staff. Then you don't have to manage their previous mailbox for forwarding and can just get rid of the exchange server.

That is correct onedrive will fall under the sharepoint license under the A1 subscription.

I've seen this with windows 10s. It seemed to be fixed after running some windows updates.

Yes you will just need to add this line in the XML to exclude outlook and you can modify it to get rid of any other apps you don't want.

Personally I would try to get away from the mandatory profile and create accounts for all of your students but if that is not possible in your situation I would assume you would want to exclude outlook when you create the proplus installer so you don't have students trying to set that up and just force them to use the web browser to sign into their email accounts.

If that's the case I think this is what you are looking for device based activation. http://boards.microsoft.com/public/item/143236?token=f55452094b

Here is a link explaining how activation works on a shared computer. https://support.office.com/en-us/article/Overview-of-shared-computer-activation-for-Office-365-ProPlus-836f882c-8ff6-4f19-8b24-0212e0111c94

You should be able to change the install location when creating the package on the package details page there is a spot on the bottom where you can change custom settings and specify the install location.

If you use a MDM to manage the iPads you could set a WiFi profile to automatically connect them to the right SSID and add a profile for the Guest Network with autologon off so they don't automatically connect to the Guest Network.

You could use these registry keys to auto log on a user and then have IE/Edge in the startup folder with the web page as the home page. [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"AutoAdminLogon"="1" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"DefaultUserName"="[uSER NAME]" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"DefaultPassword"="[PASSWORD]" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"DefaultDomain"="[DEFAULT DOMAIN]" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"AltDefaultDomainName"="[COMPUTER NAME]" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"AltDefaultUserName"="[Alt UserName]" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"DefaultDomainName"="[COMPUTER NAME]" [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\WinLogon]"ForceAutoLogon"="1"

Here is an article on how to disable group creation: https://support.office.com/en-us/article/Control-who-can-create-Office-365-Groups-4c46c8cb-17d0-44b5-9776-005fced8e618?ui=en-US&rs=en-US&ad=US I do not know how this will work with classroom as we do not use it.

In the sharepoint admin center if you go to user profiles under My Site settings if you click on Setup My Sites and scroll down a ways there is My Site Secondary Admin if you have that enabled and you are the secondary admin everyone's files will be shared with you. Which would explain why you could see all of the headteachers documents. As for your other question I was looking at my settings and I also have the Everyone except external users with read access not sure what its for but I would assume it is normal.

Are you by chance a secondary Site Collection Administrator for your users?

When you turn teams on you can choose to turn it on for the faculty licenses and the student licenses. Unless you give all of your users the same license you will be able to choose which group you turn it on for. If you are curious how to turn it on under settings go to services & add-ins and select Microsoft Teams.

I was just at a conference and found out the method I stated in my previous reply is a little outdated and students will still be able to create groups that way. The new method involves creating a security group and allowing that group to create office 365 groups. There are some pretty good instructions on how to do this here: https://support.office.com/en-us/article/Manage-Office-365-Group-Creation-4c46c8cb-17d0-44b5-9776-005fced8e618

I would use powershell to make sure group creation is still disabled. If its enabled disable it and see if they can still create groups. $creds = Get-Credential $Session = New-PSSession -ConfigurationName Microsoft.Exchange ` -ConnectionUri https://outlook.office365.com/powershell-liveid/ ` -Credential $creds -Authentication Basic -AllowRedirection Import-PSSession $Session Get-OwaMailboxPolicy "Student Mailbox Policy" | selectGroupCreationEnabled Set-OwaMailboxPolicy –Identity “Student Mailbox Policy” –GroupCreationEnabled $false

We use the windows store for business along with applocker to make sure kids can't install apps we don't approve.

You can do this through group policy pretty easily. User Configuration\Policies\Administrative Templates\Control Panel\Prohibit access to Control Panel and PC settings.

I do not currently have SSO setup but even without SSO after running the script it should just ask for your password and set up the drives.

I would keep using AD Connect. With the new updates coming to AD Connect you will be able to allow sso for your domain joined computers without ADFS and your users will not need to remember two passwords. If you ever have an issue with Azure AD Connect it is easy enough to reinstall or install it on another machine and start syncing again.

You just need to copy the line and add it right below it with your other sharepoint site like this: $sharepointMappings += "https://ogd.sharepoint.com/site1/documentsLibrary,ExampleLabel,Y:" $sharepointMappings += "https://ogd.sharepoint.com/site2/documentsLibrary,ExampleLabel2,Z:"

If you sign in to onedrive for business in a browser and click on sync that will do it or you can copy and paste the url from the browser.