georgeescott

Why do you think this is a bad idea? We currently bind our Macs to AD. Students log in with their AD credentials. We don’t enable ‘mobile accounts’ except for staff MacBooks. I hope to replace AD binding with the ‘Platform SSO’ coming out with Ventura though https://developer.apple.com/videos/play/wwdc2022/10045 (11:20). Or you can use NoMAD or something like Jamf Connect. In previous years, we mapped their home drive stored on a Windows file server. Now, we force them to log in to OneDrive on login and set that as their default Finder view. Students save directly to OneDrive where the app/file type will allow, or save locally and then copy it across at the end of the lesson. We’ve started refreshing our Intel iMacs for M1 models, but they come with smaller SSD’s and the costs to increase the capacity are eye-watering. Going from a 1TB HDD to 256GB SSD is a big step down. We started running in to storage issues quickly as we have Adobe, Logic, GarageBand and Sibelius. Including the massive sound libraries that to go with them. I created a startup script that cleans up the /Users libraries only (documents, desktop etc.) after several weeks of no modification, but keeps the ~/Library folder so that they’re kept signed in to apps like OneDrive/Office. If they then haven’t logged in for at least a month, we clear their profile from /Users and /Library/Managed Preferences/. I’ll start looking in to OneDrive Known Folder Move (KFM) for macOS later in the year to see how it works with apps, but I’m not holding my breath.

Microsoft 365 let’s you setup room and equipment mailboxes which would be more suitable than a standard shared calendar: https://learn.microsoft.com/en-us/microsoft-365/admin/manage/room-and-equipment-mailboxes. Snipe IT isn’t really designed for short term bookings for equipment like this. You may be better off with a 3rd party system that’s specifically designed for this kind of thing. Especially if you have lots of equipment.

The method of user profile you use is up to you and what works best for your environment. Worth reading http://www.edugeek.net/forums/windows-10/228829-what-best-user-profile-method.html.

I recently remade our mandatory profile here and I used a combination of https://learn.microsoft.com/en-us/windows/client-management/mandatory-user-profile and https://www.htg.co.uk/blog/mandatory-profiles-in-windows-10-creators. I've made registry changes to remove references to the Administrator user that were hard-coded in the NTUSER.dat. I also applied the following changes to avoid any issues: https://learn.microsoft.com/en-us/troubleshoot/windows-client/user-profiles-and-logon/slow-logon-with-blank-screen https://learn.microsoft.com/en-us/windows-hardware/customize/desktop/unattend/microsoft-windows-shell-setup-copyprofile (step 6 to remove file associations from NTUSER.dat or you get loads of notifications on logon where app associations get reset) The mandatory profile shouldn't include the Local and LocalLow AppData folders, you only need Roaming.

I've been looking in to preventing users changing their O365 photos recently. It seems the Teams route may now be restricted too! I also followed the CodeTwo article and applied the following changes: Set-OwaMailboxPolicy OwaMailboxPolicy-Default -SetPhotoEnabled $false It took a few hours for the settings to apply, but with a test student account I've tested all the possible ways I could find to change their profile photo: https://portal.office.com -> Account menu (top-right) -> Hover over the profile picture Before: After: https://portal.office.com -> Account menu (top-right) -> My Office Profile (goes to Delve) Before: After: https://outlook.office.com/mail/changephoto Before: After: Nothing happens, you just get standard Outlook and no 'Change your photo' dialog. Teams -> Account menu (top-right) -> Hover over the profile picture Before: After: Even the teams app blocked it! https://portal.office.com/account/#personalinfo -> which goes to http://portal.office.com/userphoto Before: After: So as far as I can tell, profile picture changes from the web or apps have now been prevented!

What does your unattend.xml file look like? Can you post the full sysprep command you’re using?

You can request it here: https://vimeo.zendesk.com/hc/en-us/articles/360057696072-I-need-to-be-able-to-restrict-access-to-mature-content-for-my-students

Depends what GPO settings you have set. You can restrict it to only SSIDs you’ve configured, or you can just add a default SSID while still allowing other connections. See if you have ’Prevent connections to ad-hoc networks’ ticked on the wireless profile.

A) It really depends on your environment and how restrictive you want to be for downloads that have the potential to be malicious. Looking at Edge, ‘BlockDangerousDownloads’ will “Block malicious downloads and dangerous file types”. A sensible setting to protect users, but this won’t allow them to override the block. https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#downloadrestrictions. B) In Edge, there is an exceptions list you can set https://learn.microsoft.com/en-us/deployedge/microsoft-edge-policies#exemptfiletypedownloadwarnings to allow specific domains/filetypes through. Alternatively, you could leave it un-configured or set the 'DefaultDownloadSecurity' option and this will continue to block them, but allow users to ‘keep’ it via a context menu option. Worth a read: https://learn.microsoft.com/en-us/deployedge/microsoft-edge-security-downloads-interruptions.

I had a lightspeed rocket many years ago and it had SSL inspection along with capturing search engine queries so I believe it’s possible. Worth checking their knowledge base or contacting their support on what it’s like now. https://help.lightspeedsystems.com/s/search-page?s=SSL%20decryption

Could try a winsock reset or to reset the TCP/IP settings? I’ve had that work before to fix Outlook issues. netsh winsock reset netsh int ip reset

Standard mail merge won’t cut it for attachments that need to be different for each recipient. You’ll need a 3rd party tool for this. I’ve used Mail Merge Toolkit https://www.mapilab.com/outlook/mail_merge/ before which we used for a similar scenario. Worked pretty well!

We’ve also had similar experiences with AB Tutor v9. Often have to restart the service on the server or close/re-open the admin console or it doesn’t work properly. Would avoid it if you want it on macOS too. The current client version sometimes crashes Macs or makes the screens flicker on Big Sur+. Had to remove it in our Mac classrooms.

This explains the performance issues first week back then!

Weird that the normal ‘Move’ isn’t working. https://support.microsoft.com/en-us/office/move-your-form-to-a-group-921a6361-a4e5-44ea-bce9-c4ed63aa54b4. I’d log a feedback ticket with Microsoft to get them to check why it’s failing. Worth looking in Dev Tools at the network and console tabs to see if there’s any detailed info behind that error. You can also do it if they’ve already left, not sure if this will work with a current user?: https://docs.microsoft.com/en-us/microsoft-forms/admin-information#form-ownership-transfer.

Looks like OP posted this twice. Was resolved in /showthread.php?t=229288.

If it’s not an obvious config setting in the printer web interface like TLS or the port, I’d first check to make sure the credentials work on the same VLAN the printer is on. You can do this through PowerShell http:// https://connectioncloudsupport.zendesk.com/hc/en-us/articles/360061978013-Test-the-Office365-SMTP-Relay-Service-from-PowerShell. If they do, can you post a screenshot of the SMTP section?

Previously I’ve used Sharepoint to track requests for changes and then they get approved from there by a Change Advisory Board (CAB). Now I’m in a smaller team, we don’t formally request changes like that now (obviously we meet and plan for it) but we use Microsoft Planner to plan changes, then a Teams chat as the ‘changelog’ so that changes are posted there and made visible to the whole team.

You can change the services in the licence groups at any time and click ‘reprocess’ which will update the licences on users of that licence group. But this will be a manual job.

We use licensing groups (http:// https://docs.microsoft.com/en-gb/azure/active-directory/enterprise-users/licensing-groups-assign) to assign our licenses to users. Through this you can disable services by default. Why do you need to disable services after they’ve signed up and not before?

Anything special going on in your image? Removing any appx apps or anything?

What do you mean by UX GPO’s? What settings are you applying there? So if you keep all GPO’s enabled but unscope these UX GPO’s, the problem goes away?

Depends on your needs/budget but something like https://www.airserver.com/airserver-connect-2 might also be useful so that it’s not limited to Apple products.

What’s the shared location? Is it a mapped drive or the domain share or something?

If the device is Azure AD joined or Hybrid Azure AD joined (which you generally want with Intune), then compatible browsers and software will usually try to SSO using the logged in Azure user. This can be a pain when you have more than one account to log in to as it’ll keep trying to log in to the current user’s account. Setting up a new Edge profile and signing in with the other user account is a way to combat it at least.