georgeescott

Working on this myself at the moment, we've done it with the Prevent Microsoft Teams from starting automatically after installation GPO setting. Although if Teams is installed before this setting is set you'll need to run the Teams autostart reset script on a per-user basis to clear out existing autostart settings so it can pick up the GPO. You'll want to make sure you have a recent copy of the Administrative Template files (ADMX/ADML) for Microsoft 365 Apps for enterprise/Office added to your PolicyDefinitions central store too.

Haven't tried Spiceworks with PowerBI yet, but they have their own template you can use if you haven't tried it already: https://community.spiceworks.com/support/help-desk-cloud-edition/docs/reporting#advanced-reporting-with-power-bi.

We’ve just moved over to Bromcom. Has anyone managed to get this working without admin rights? Or at least running as the user and asking once to elevate to install it?

This is still happening in iOS App version 7.1.211 (214). If an Edugeek thread is linked to using the /showthread.php?t=212649 format then it works correctly. But if it's linked to using the full /forums/edugeek-net-site-problems/212649-link-bug-ios-app.html format then this causes issues with links within the app.

Mentioned in your Mac Management thread about this, your best bet will still be https://github.com/carlashley/appleloops. You can use it as a script or a pkg. You could also setup content caching on a Mac to speed up the download process on other Macs. The #musicsupport channel in the macadmins slack is a good place for advice on this too!

I can understand them not wanting you to over-explain on every ticket as that time can add up, but surely they can’t argue with something short and to the point listing what you did to fix the issue. Seems a strange stance to take. Especially on the tickets that you spent a while finding a fix for, it’s worth the extra few minutes writing what you did to save yourself (or a colleague) potentially hours in the future! Not sure if you can start a chat with yourself on Teams, I’ll have to try it out! Maybe there’s a bot that saves chat messages to OneNote/Excel that would have a similar effect?

I regularly document things in a shared OneNote if I feel they’re harder to find than a quick Google and it’s not a one-off thing. Or if they’re important steps that team members should probably know if I’m sick/on holiday. Always writing what the fix was in the ticket is helpful when you need to look back at it or have a similar issue. We have a shared teams chat called ‘changelog’ which is an easy way to keep everyone up to date with any changes being made like GPO/Firewall changes etc.

Ditto, we use multiple Edge profiles as well and works pretty well! Users can pin each Edge profile as a separate icon in the taskbar for quick access.

We’re using https://snipeitapp.com. So much better than using an Excel spreadsheet! We pay for cloud hosting but it’s free if you self-host.

Not had this before but is this a single device or all of them? Happens on existing or cleanly imaged devices? Tried it on a domain joined PC that’s excluded from all GPO’s to see if it’s a GPO causing it? If you run ProcMon and filter the process name for Premier what’s it trying to do when it gets stuck here?

Got CloudDriveMapper across most of our schools. Most of the time it works great and definitely helped us transition from local file servers to SharePoint/OneDrive. It obviously requires a constant internet connection to SharePoint so the moment the wifi/network drops out even for a second then the drives disconnect and have to be mapped again which typically takes 30-60s. This mainly happens when students roam or are in areas of poorer wifi coverage though. It’s unusable if staff take their laptop home and have a slow internet connection though. If you use folder redirection then it can cause a few start menu/taskbar issues sometimes before it’s finished mapping but this isn’t frequent. Not sure what the native OneDrive client is like these days as we had loads of issues with syncing a few years back which you don’t have to deal with with CloudDriveMapper. Overall it’s a good product though and their support are usually pretty responsive.

I'm running the EduGeek 7.1.211 (214) app on iOS 15.3.1 When trying to reply to a thread, I'd expect that clicking the 'Write a reply...' field at the bottom of a thread to show the reply dialog. Instead, you have to tap the + icon to reply. As just about all other iOS apps are the opposite, it's a little counter-intuitive and i find myself initially going to click this field before realising that the + has to be tapped. Could this be changed so that replying works when tapping the 'Write a reply' field at the bottom of a thread too please?

The GDevelop installer supports the /S silent flag so at least users won’t be shown that it’s installing in the background, but it sadly doesn’t support any flags to install it for all users. Other than installing it at logon (supported), the best (unsupported) option is to run it from a network share or repackage it to install to Program Files [emoji52]

Looks like the MSI has the ALLUSERS property set to 2 and the MSIINSTALLPERUSER property set to 1 which will default it to the Local AppData folder. If you run the .msi with ALLUSERS=1 then it'll install it to Program Files (x86). E.g: msiexec /i MuEditor-win64-1.1.1.msi ALLUSERS=1

You can also go to chrome://policy in the browser to confirm that a policy is being set on the device/user to block notifications. From there, you can run RSoP in GPMC for the computer/user affected to see which policy it's getting it from. If you don't have the Chrome ADMX's on the client/server you're viewing it from, it'll probably be listed under "Extra Registry Settings" in the report. If you cant remove the setting via the RMMC, just remove it from the affected GPO directly instead.

I came across this while reading another older post on EduGeek and this looks interesting! @Steve21 is EduLock still something you’re developing? The website isn’t available. If not, would you be interested in open sourcing it on GitHub for others to develop perhaps?

I wish we could! 1:1 devices for staff would be the dream. The free DfE devices aren’t great in terms of performance but could offer us an alternative to those who don’t have personal devices at home or who refuse to have Intune. Absolutely, it could cost well in to the hundreds of thousands if not millions to fully recover from a ransomware attack. Security has to be the priority. Just might be a bumpy road to get there!

That's true, Intune does make that part easy. I'm 100% for it, we need to secure the devices our users are accessing our data on. My concern is the non-Microsoft services that can't be enforced via Intune, and the initial setup and backlash from hundreds of staff we'll have to enforce this on. Apple's User Enrolment method is still in preview for Intune so once that's released that should quell some privacy concerns from some staff. Android 'work profile' has been supported by Intune for some time so that makes life easier. Cyber essentials requires personal devices accessing corporate data via RDP and other corporate web-based systems to be in scope. This isn't as simple as enabling a conditional access policy like it is for O365 services unfortunately. Perhaps Azure AD Application Proxy may be the saviour here for some systems. Others... idk, perhaps a combination of policy and technology.

If you don’t want to use any server-based deployment tools you could look at Windows Configuration Designer along with the standard ISO, speeds things up a bit! https://channel9.msdn.com/Events/Ignite/2015/BRK3339 https://docs.microsoft.com/en-us/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment

A lot of questions, confusion and unhappiness! Yes, I agree, the principal is good and generally sets a good benchmark for organisations to aim for. You can still carry out limited scopes (or now called 'subsets') for your cyber essentials assessment, so you could accredit just the finance department and their BYOD devices versus the entire institution if you wanted to. But many require the full scope for cyber insurance, grants or other compliance reasons so this wont be an option to them. JISC are expecting a rise in assessments for 'subsets' following this change. JISC are working with the NCSC/IASME so hopefully feedback from the community will reach back about this. Perhaps it could be implemented just for CE+ and not the standard certification as a compromise.

It was, by many IT folk. Although the supported and patched OS has always been a requirement for Cyber Essentials for personal devices accessing corporate data. But the change from IASME is that we now need a record of it, whereas before just an AUP stating these would have been enough. - - - Updated - - - Unfortunately not, even web-based interfaces such as webmail will be covered under this as it's still accessing corporate information regardless of whether it's saved or not. See page 8 of https://www.ncsc.gov.uk/files/Cyber-Essentials-Requirements-for-IT-infrastructure-2-2.pdf. There are ways to bypass protections from downloading e.g. screenshots, but it's definitely a risk-mitigation worth implementing. I completely understand the need for having a supported and patched operating system, but accessing/controlling this typically requires registration in an MDM which some users will be very hesitant to do on personal devices I'm sure (plus the cost implications of any additional MDM licences).

I’ve just attended the JISC security conference sessions for day 1. The last session I attended today was ‘Cyber Essentials Clinic’. JISC offer Cyber Essentials drop-in clinics which I’m now planning to attend. In this session, JISC notified us of changes to cyber essentials that will require us to report on just about all staff personal devices if they’re accessing organisational data in any form; whether this is O365 webmail, a web-based business system, through VPN/RDP, at home or mobile data. If they access this data, they're in scope. Student devices largely seemed out of scope as long as they're on their own network separate from staff BYOD devices. In a nutshell, we need a record of the device’s model and operating system and to ensure it’s in support and it’s patched recently. We need to put in technical (or manual) measures to prevent uncompliant devices from accessing these services such as Conditional Access Filter for Devices or we fail Cyber Essentials. This was quite the bombshell in the session for all of us attending. Did anyone else attend or has had to implement these kind of controls on personal devices for cyber essentials? Seems like it’s going to be an absolute nightmare to implement.

If you've recreated the boot image, have you made sure it's set on the Task Sequence? Software Library -> Operating Systems -> Task Sequences -> Right-click 'Your task sequence here' -> Properties -> Advanced Tab -> Tick 'Use a boot image' and select the appropriate one. Failing that, I've troubleshooted PXE issues with Port Mirroring and Wireshark (I do it in Hyper-V with a test VM https://www.vembu.com/blog/hyper-v-port-mirroring/) so you can see the response from SCCM to see what's going on.

Thanks for the recommendation! These Rankie adapters work on our DfE Dell 3190’s where our (normally working) Anker and AmazonBasics USB to Ethernet adapters don’t show in the BIOS to be able to PXE boot these laptops to SCCM. I’ve logged a ticket with Dell to get them to fix the dodgy firmware on this model but doubt I’ll get anywhere with it since the Dell adapters work ok.

Not sure on the difference between Xporter and Xporter on Demand (if there's a difference?) but I recently migrated our old SIMS server to a new one and contacted Groupcall for instructions. Got a reply within a day. They sent me a link to this: https://support.communitybrands.uk/s/article/Xporter-New-Server-Migration-Not-Hosted. As long as you have access to the old server then this'll work.