DavR

Ahem - May have jumped the gun on this one a little. It was only one server that prompted for Bitlocker on reboot this morning. Turns out the other booted fine, but failed to find the network (the Network Location Awareness thing) and raised it's firewalls. So now it's just a question of what prompted this one server to go into Bitlocker recovery after this Windows update. Anyone know how to work out what condition prompts a Bitlocker Recovery screen?

I didn't need to tbh - just entered the Bitlocker key (which thankfully I had saved to SharePoint, not on a server) and back to normal. Interesting that neither of yours did, cos both of ours did. I wonder if it's something peculiar to us. To clarify, that was the physical hosts, running Server 2022, with Bitlockered C and D drives, that hit a Bitlocker prompt. None of the Server 2022 clients are Bitlockered, so not expecting an issue when they reboot, tho I will test.

Morning all I had a rude awakening this morning to calls from our SLT to say that servers were down. Turns out the Windows Update last night (January 2025 cumulative update KB504998) caused a BitLocker prompt on reboot, preventing server startup. Not sure why, and haven't seen it discussed online anywhere yet, but just an FYI, and to see if anyone else faced the same issue?

A bit like @Hoyt, we have some InTune licenses, but I've just not found time to set up our InTune environment. I'm hoping to do a hybrid thing with MDT - build the OS and basic program list using an MDT sequence, then join Azure AD, enroll into InTune, and let management take over from there. I'm still a big fan of doing annual reinstalls of workstations, it avoid so many headaches with aging OS installations (Heck, I even still do it on our iPad sets) so I'm hoping to keep hold of a full imaging solution as long as I can. But yeah.... following this thread and those like it with interest.

We use Sign In App, which is pretty cheap and cheerful. It will work on pretty much any recent model iPad, so if you've got any spares, you won't even need to spend much on the entry hardware. We only had to spend money on iPad mounts to secure the iPads to our reception desks. Can't comment on integration into Salto, but I think they offer some integration as an additional fee. Re the rest of your spec, I think pretty much every system on the market will do entry/exit/evacuation.

4GB as a starter, then up to 8GB if that's struggling. I've not yet seen anything needing to go above that. We're running a very basic setup here, though, just a couple of DCs, Print server, Legacy file server. Everything else is in the cloud.

This is my working theory at the moment, and the fact that your expired devices are showing as opted in @David44, but your currently not expired devices are not, would seem to support that. I guess we'll find out in our workspace next June (assuming I remember to look!)

I know there were some dud updates in Office 365 Apps recently, does anyone know if there were any equivalent bugs with Office 2021 LTSC? I've had a couple of users complaining about hangs and crashes, although I don't have much in the way of specifics, and I've not seen anything out of the ordinary myself....

Note sure where they're getting their VHS run times from 2 or 4hrs, and then 5hrs? Your average tape was 3hrs, which could hold 6hrs on long play mode. I think 4hr tapes existed? Which took the theoretical maximum to 8hrs, but quality would be pretty naff by then, and you'd be risking mangling the tape. I do miss the solid response of a rotary phone, though. We had one still in our house still well into the late 90s.

I think on the whole they're hitting dead spots in the wifi and not reconnecting again til someone uses the device a short while later. They mostly get brought home before the battery dies and they go offline. Short periods of offline I'm not worried about, it's when it's offline for longer that I want to be notified so I can look for them before the trail goes cold.

We moved from School Cash Office to Arbor in the summer, it was a manual process. I had to run off a report of all the existing balances, and manually input these into Arbor as starting balances (we don't use cashless catering). Beware - you can only enter these balances into Arbor once, then the option to do so on the staff/student record disappears. You need to get these right, first time (don't do what I did, and enter a test balance on one record, that took ages to re-balance lol)

Does anyone here have automatic alerts set up for when selected devices go offline in Meraki? We have a couple of iPad sets which, theoretically, never leave site and are online over the wireless at all times. I turned on the alerts for "An endpoint with X tag goes offline for more than 60 minutes" the other week, as we've been having issues with these getting misplaced, and no-one telling me until it's too late. Turns out our "always online" devices go offline a lot more often than I thought - I'm constantly getting notifications of devices going on and offline! The default notification rule only goes up to 60 minutes - I don't suppose anyone's had any luck with a custom notification rule that alerts them when something's been offline for say, a day or two? That would allow me to know that something is definitely misplaced, but, in time enough to trace it to a likely location within the building. We do have geofencing turned on, but, it's garbage and does nothing, so I have to keep quite a keen eye on devices to make sure they don't go walkies....

This is really useful, ta. I've been meaning to create a local-PC only admin account for workstation maintenance, and couldn't quite get my head round the best way of doing it. GPO to add the custom group to local Admins on PC, will give that a go in a bit.

Interesting. Have your devices passed their original support dates, into extended support, yet? I noticed yesterday that despite changing the setting to Allow, it still said 'Disabled - Opt in required' on the device record in Google Admin. Mine don't expire until June 2025 though, so I thought maybe they opt themselves in after the end of mainstream support. Be really interested to hear others experiences in this. Can't help by feel this field should show enabled, after turning on the policy to enable it, the fact that it still says opt in required suggests there's another step we're missing somewhere :/

Can't comment on the logins, I've not done that with ours yet. But all the rest - yep, sounds right. FYI Chrome device licenses shouldn't set you back more than £30 a piece before VAT.

Sorry to contradict, but everything I've ever heard is that you need to use a separate domain for Google Workspace vs O365. We got round this quite simply by using a subdomain of our main domain for Google Workspace. https://learn.microsoft.com/en-us/answers/questions/1195152/can-i-share-the-same-domain-in-google-sites-and-of

Ah, that makes sense. Shouldn't happen, but sometimes it does, I'm sure. I wonder if you could script something that enables and disables the wifi adapter, or runs Windows troubleshooter on the network connection, for that situation. Both probably require admin rights though :/

Out of interest, what is the usage case for allowing the children to turn off the WiFi on the device? I'd be more inclined to ensure that the wireless stays on, always, and then find another solution to the problem of occasionally needing to offline the device. I'm not sure about InTune, but we achieved this by either forcing a service on or off in Group Policy.

Just dropping this here for info, in case others hadn't noticed this. Most of us are aware that Google retrospectively extended the Automatic Update support date on quite a number of older devices, when they introduced their 10 year device support commitment. Great news! What I didn't realise is, that for some devices, you need to change a policy to 'allow' to enrol your older devices and receive this extended support. By default, this is turned off. The policy is here, in your Google Admin Console - https://admin.google.com/ac/chrome/settings/device/details/device_extended_auto_update_enabled_setting_group The reason I think it's off by default, is that it removes support for Android apps and Google Play Store, for those devices. I guess that's a condition of the extended support - they'll support the devices, but not with Android apps. This is fine for us as we're no longer using that feature, but others may need to bear that in mind. You can check your devices against this list for Extended Support - https://support.google.com/chrome/a/answer/14328032?hl=en - if it has one asterisk * by it, then it's extended support is conditional on the above setting.

It also depends how many users you've got, and what programs from the suite they use. We're only very light users, so I deploy the Adobe Creative Cloud app with nothing else, and enable to option to allow users to install whichever apps they want on demand. I must admit things have fallen by the wayside a bit for us, though, it's not being heavily used by many, except me!

We've just bought a batch of Asus CZ11, although I've not deployed them yet. First impressions are they're a little bit plastic-y, would have liked to have seen some rubber corners on there for shock protection, but we'll see how they play out. As far as I can see, they are the cheapest edu-spec thing on the market at the moment, with a three year warranty, 64GB storage, in the £160-£180 region. A run down of the other stuff we've had: Lenovo 300e - had a terrible failure rate, and are showing their age badly HP G6 11A - ugly, but they work well Dell 3100 - great, would buy Dell every day if I could Acer - fine for us, others have complained about build quality (we only had a few)

If they're student devices, I would go Chromebook, unless you've got any specific reasons to stick with Windows? Then you're running a locked down ecosystem, the device can be locked down to school accounts only, and you can also enforce an extension-based web filtering / monitoring solution. You'll need to agree with management how much filtering and monitoring goes on, as it's going to be outside of school and in the child's home.

InTune really is designed for a 1-to-1 device world, with the intervals between policies applying hours, rather than the minutes we're used to in GP, and not taking into account the different levels of restrictions when users log on and off. It also seems to assume a fairly light touch approach to restrictions, rather than the full lockdown that we're used to doing with children. We've got a bank of loan devices which I want to manage with InTune, but these don't have an owner, until they're loaned out. I still haven't got my head around how I'm going to manage that one!

We use ParentHub. The ideal implementation is that all parents have the app on their phone to receive comms, directed either to the whole school, or individual classes / groups. In the event a parent does not / cannot / will not install the app, it defaults back to email. If the parent doesn't read the message in the app within 24hrs, they also get a followup by email. We also have the option to send SMS messages, but reserve that for emergencies only. As for the question around families who do not have Smartphone access, we currently have 95% of children where at least one parent has the app installed. Although I acknowledge we're in a relatively well off area. I think ParentHub support said 80-85% was average. When we set this up, we tried to make sure that it was our primary method of communicating with parents, to replace a whole bunch of other ad hoc methods. In the end though we ended up with a separate app for our MIS and Payments, but, we're pretty happy we got it down to two, tbh.

That's outrageous. We moved MIS earlier this year, and not one of the systems who link to our MIS charged us for the migration.