DavR

I'll dig out the scripts when I'm next in the office. I'll warn you now, my vbs is a bit clunky, but, it does work.

I migrated all of our data at once, during the summer hols in 2022. We're not a huge school, and I had the luxury of mandating a two week full shutdown to do the work. It went fairly smoothly, all told, although I wasted a lot of time getting the new SharePoint sites to sync to PCs via OneDrive client, only to find out how horribly impractical that was in real usage. We got IAM Cloud Drive Mapper to replicate users mapped drives instead, whilst at the same time, writing user guides for people to use SharePoint natively from home.

Anecdotally, we heard from another school that CoPilot can be a bit... invasive... with regards to data. Accessing data sources which the user doesn't have permissions to see. I don't know how true or otherwise, but it's enough for us to disable it in our Windows 11 policies, as shown above. We'll consider releasing it again if anyone comes to us with a reasonable usage case for it.

Could you use GP loopback policy, to make computer settings apply to certain users? Not sure if that would overwrite another computer based policy, I'd leave the computer policies for power management blank to avoid a conflict between the two. And you'd have to have a power policy set for every user type, unless you're happy falling back onto Windows defaults.

Unless you have a very specific usage case, or a personal understanding of ADFS, steer well clear. It's almost certainly too complicated for what you need and is being deprecated. If the school are using M365, then it's Azure (now Entra) that will be managing their authentication to that underneath, which may or may not be sync'd with their onsite AD. It's Azure (Entra) that you'll want to connect to Canva for SSO. Sorry to be the GDPR bore, but have you done a DPIA on a) using Canva in school and b) connecting it to your Azure for authentication? You can probably get away without a) given that it's primarily a graphic design tool but b) connecting to your Azure user database, that probably should be assessed.

I still find it useful to have the complete separation of two browsers, for testing and for when things cock up in one. Case in point, Junior Librarian would only work in Edge, not Chrome, for a while a few months back, and I never did find out why. There's hardly any overhead to it, so we run both to let users choose. Also, it may be an illusion, but for stuff requiring Google accounts to be logged in, it feels like that integrates into the browser better.

We've got NetSupport Notify configured via vb script so that we have a big red button on certain users desktops marked INITIATE LOCKDOWN, which when pressed messages all workstations with an alarm noise and a message to enable lockdown, and another big green button LIFT LOCKDOWN that does a similar thing in reverse. Between you me and the gatepost though, our emergency and lockdown plans were made over five years ago, never reviewed, we've never had a drill, and I doubt any new staff are even aware of what the procedure is. At this point I think pressing the big red button would just cause confusion and distress.

On that score, I think it would be our cleaners, some of whom are 70+ years old now. They still work, but need a lot of downtime for maintenance, and parts are hard to come by.... On a hardware score, perhaps not the oldest, but, I have an HP LaserJet 1320 from 2008 under my desk that I was instructed to throw away because it kept jamming. That instruction was nine years ago, but I've had it sat under my desk, popping out maybe 10 sheet a week, ever since. I was only going to keep it til the toner ran out, but I'm still on the same toner nine years later, and still have one in stock. HP printers from the "golden age" will outlive us all. Might even outlive Keith Richards!

We have ours restricted so that only accounts from our tenant can log in to OneDrive, don't know if this might help - GPO ref - https://learn.microsoft.com/en-gb/sharepoint/use-group-policy#allow-syncing-onedrive-accounts-for-only-specific-organizations. When I mucked up some of the initial settings for our OneDrive deployment, I found that if you wanted to flatten someone's OneDrive config and start again, removing this registry key should do the trick. [color=#333333]reg delete HKCU\SOFTWARE\Microsoft\OneDrive /f[/color] This worked well for us, either in a script or as a "run once" item in GPO prefs, as we had the rest of the OneDrive config running silently in the background.

I'm assuming this is an OVS contract? Sounds like one, if you're still paying for Office Pro Plus rather than Office 365. But yeah, echoing Martyn above, the Office Pro Plus is your annual MS Office licensing. If you're not paying for Office any other way, you will need to keep this item on your agreement. "M365 Apps Enterprise" is essentially a freebie for Office Pro Plus users, that your reseller can add to your Office 365 tenant. It gives M365 users access to Office apps to install on devices, plus additional OneDrive storage. Combining M365 Apps Enterprise and Office 356 A1, gives you an O365 feature set more than 0365 A1, but not quite O365 A3 (I was setting this up for our tenant last week).

Is the HDMI output still the default audio device? We have some devices that we use the analogue stereo jack output for audio output, so I have to set the analogue audio as the default. This sounds similar, but in reverse. Right click on volume control, Sounds, Playback tab. Have a look at which devices are your defaults. The other thought is, do you have anything plugged into the analogue audio outputs - front or back of the PCs?

I wonder if anyone here has managed to make sense of the licensing requirements for Office 365 email retention policies? I've struggled, and my reseller isn't entirely clear either. We have O365 A1, paired with ProPlus on an OVS, so we've got the real basics when it comes to the online elements. Are we we entitled to use any of the retention policy options under the Data Lifecycle Protection in M365 Admin? There are quite a few there, and we have built up effective retention policies, but after speaking to Microsoft support, I've found we're not licensed for a lot of what we're using. I had it in my head that we'd be OK to use just a simple whole school email retention policy (rather than different policies per mailbox, and/or the adaptive scope options), but actually I can't find anywhere in the documentation which supports that. If we can't use any of the DLP retention policy settings, is there another way of implementing a basic "delete after three years unless user places hold" retention policy? I've seen auto-archiving mentioned as an option, but then seen others saying this too is an add-on for Exchange Online Plan 1, so we're back to where we started. Thanks in advance folks!

Going off topic, I know, but.... I think the argument against pass-thru is that you can leave trailing wires, which can short out, even cause fire in certain applications. Bit of a reach for most applications, but.... I'm curious though - what is the benefit you're getting from pass-thrus?

I bought some of these just recently, as I need to repair a couple of cable runs that have been damaged - https://www.ebay.co.uk/itm/381501842274 Punch down looked the way forward, rather than having those additional points of failure. Glad to see the general consensus agrees!

This was a while ago now, but I think I just used the below in a logon script. reg delete HKCU\SOFTWARE\Microsoft\OneDrive /f You could also just do a registry preference to delete that key, and tick one time only. As per my comment above though, the next problem I faced was deleting the versions of files which had already been cached. In the end I wrote something quite convoluted that renamed and hide the files I didn't want to see.

It's bizarre, isn't it. Have they spent a lot of money on the software, or is there just one person in management who's adamant it's a good idea and will just keep doubling down until the facts fit their expectations? I don't know whether it's ironic or just damning that the organiser of the UK/World's leading Ed Tech event keep trying to push a terrible technical solution no-one asked for

I missed BETT for the first time in years, this year. I'm sad to have missed the opportunity to meet people and have a few chats, but I didn't really have the time for it, and we're not really in the market for any particularly interesting tech next year. Connect @ BETT and all the extended stuff they've been pushing were a real put-off for me, I just ignored it all. I've always just visited suppliers at stands, and I will continue to do so until BETT no longer allow it!

I think that one of the deciding factors was, originally, the source IP / domain that the traffic originated from. So it's not just policies viewed, it was a pattern of behaviour, from a certain location known to be OFSTED offices. I believe those origin tracking features have been turned off or reduced in Google Analytics now though.

There are at least two variants of the 300e around - one with MediaTek chips, and ones with AMD chips. It'll say either MTK or AMD in the product name / on the label. It's the MediaTek ones that have been dying like flies for us, the AMDs have been fine.

It's either Ofsted, or a parent is about to kick up a massive stink about something! Hell, most of the staff have never read the policies....

Arrived today! Thanks very much VeryPC, loving the latest design

I'm fairly sure it specified work addresses only. Fingers crossed mine come in the last Royal Mail post of the year, which for us is tomorrow!

FWIW, if you've got MFA set, there are some occasions where, even with the conditional access, that you'll get an MFA prompt whether in or out of school. Usually only stuff like changing your account details etc. So MFA, is protecting MFA settings, if you like. You shouldn't be prompted for day-to-day usage though.

We stuck with IAM Cloud Drive Mapper. We haven't found large files too big an issue, although yes, large video files don't always open successfully first time, but then, our Internet connection is a dedicated 400MB line. Which is not to say that we're not looking forward to something better than WebDav. I honestly wouldn't consider SharePoint sync for anything beyond a) areas of only a few GB or b) manual syncs for users who know what they're doing. It would be REALLY nice if there was a way of just dropping a list of SharePoint sites into the Open/Save dialogue box for Office, but that option just doesn't seem to be there, which is a real nuisance.

Yeah, not massively intuitive! I haven't looked for activation numbers yet myself, but, it used to be with the license keys, so might be under there again.