Martin48

recommend running "gpresult /h path_to_store_report.htm" on each of the accounts on the client pcs to see what it actually processes and sees..

2 sites here: Aerohive installed by LAN3 highly recommended, no issues even use it to diagnose our aging lan network. Unifi installed by XMA is ok does the job for the budget.

How big is your new default profile? sometimes they can be 900mb even though literally only logged in then copied, you may want to trim some fat off them by deleting uneccessary files, you can get this down to 5mb. (best one for increasing speed) Is it first time login for user or 2nd time aswell? (win10 even ltsb sets up metro apps which can be slow, you can use scripts to remove uneeded ones and if you have enterprise app locker to disable them) Is it within 5 mins afterboot? (win 10 gets false fast boot speeds by delaying boot jobs which can slow the initial login after a boot up) An SSD is recommended for 10 if possible it does like to read the disk a lot and do a lot of searches and precaching on login, we still have spinnies on some student pc's their is a noticeable performance loss, but not 90 seconds.

Anyone else concerned with classflow encouraging online accounts and storing and sending passwords as plain text? this is a big no for us for any website or service.

Fair enough, ours is more for students we allow staff to put a ticket and have us do it then usually send a generic guide saying they could also do it themselves which reduces calls. (to new staff and cover) I wouldn't trust our staff to change each others passwords!! although considering to allow business manager to do it at a primary via the mmc method (since we are not onsite all the time) I know your looking at azure ad, don't know if you are using office 365 with azure ad connect, because the newer tool allows password write back allowing self service via the microsoft 365 portal but that might require a personal/work phone number or email as secondary authentication which you would have to look at your policies about and a security risk. edit: just thought the password write-back might not be too useful for people already onsite... for reference we get around 50% of our staff forgetting their password at the end of summer, make for a busy inset day, then about 5 or so on other holidays and about 1 every other day. Typically even the less tech savvy get embarrassed with having to call up every time, and lets face it most people just change the last digit of their original password, or write it on a post-it note (we ask they don't do that but what we ask is not always what we get)

We use a custom mmc snapin displaying the students ou, with cut down ad tools installed and delegated permissions only to teachers for only resetting passwords on students, also the ad-tools are only installed on teaching pcs. Free, all microsoft tools, already got mmc on the machine. Only ourselves can change the staff passwords.

Just to add make sure laptops come with a battery warranty of more then a year, some companies which shall remain nameless don't care if all their batteries stop working at a year or 200 cycles. Also consider computers are usually on and updated, it will take time out of lessons to grab the laptops sit down, start them up, login then shut them down and put them away at the end of the lessons.