CyBeRkId2002

Hi all, Started a new role just before Christmas so I am likely to start spamming these forums as I get to grips with things over the coming months! My first question is regarding licensing... I have just found the trust has just signed a new OVS-ES agreement which now does not expire until June 2026! Having been familiar (and a big fan) of the EES agreement (saving money in most scenarios and being a key factor in moving towards a more cloud-centric approach - particularly with Intune) this is a right pain. My questions are: Has anything changed with regards Microsoft's position on the OVS-ES that lets schools / trusts leave early in favour of a JISC / EES agreement? Would be over the moan if I could investigate this at Y1 renewal in June/July I can see a 'Microsoft 365 Apps for Faculty' licence on the Admin Portal. Does anyone have any details on what this covers (Office Pro, Office 365 Desktop Apps, CALs). I am hoping they at least have the 'Desktop for Education' bundle currently What are the options for replicating similar to Microsoft A3 on the OVS-ES system. I am guessing if all FTE's are licenced under Desktop for Education I would need to add AD P1 for conditional access, and then possibly Intune if we want to start moving workloads over to that. Anything else I would be missing out on over Microsoft A3? Final more technical question... how do I view the current OVS-ES licences in the Admin center. I am a domain admin and can see online subs, but not any Desktop / Server licences. Do I still need this delegating seperately in the old VLSC?

One thing I think a lot (and I mean a LOT) of people miss is there understanding of how conditional access works. Many times I have read that by implementing conditional access to ignore internal addresses staff who are resistant to register for MFA simply don't have to do it as long as they don't want external access. This is not protecting your network. In this scenario the first person to get the registration prompt is the cyber criminal who can just register with their details. All staff members (particularly those with access to sensitive info) should have to enable MFA on their account. We run reports periodically to make sure this is the case and it is part of our IT induction process. I am not saying that there isn't the argument for or against personal devices / hardware keys etc. but conditional access is not a replacement unless you configure a group of those who refuse and actively block their access externally (also possible using conditional access but not what I think most are referring to)

Thanks Kieran. My knowledge on 802.1x is limited at best (and more on the WiFi / certificate side) so I have some follow-up question if that's ok. Is the 802.1x setup on the Sophos, or the wireless system? I am guessing the former. Do you have an open network for the actual WiFi? What do you use for the RADIUS Auth? Microsoft NPS? What certs are required for the client? One from the Microsoft CA? Or just one you download from the Sophos. How do you get this on Client devices? Simple instructions for students to follow? I presume they have access to where this is hosted before full authentication. So many questions. Did you get someone in to configure, or sort it in-house

Cross posting as I think this may be a more appropriate forum: Morning all, I am starting a new job in the next few months and my brain is already ticking over on a number of systems I haven't used before. One of these is best practice using a Sophos XG for BYOD (something we do not use in my current workplace) and iPads (which we do use). I am well versed in Safeguarding requirements and have been using a combination of Securly and Classroom.Cloud - but need to get my head around what is possible with the Sophos. Understandably the school will want and expect any changes to be as seamless and frictionless for students as possible. BYOD So far I have concluded my options may be: Open access on to the WiFi (obviously with locked down access to just internet / DNS / DHCP etc.) coupled with a captive portal for the Sophos where users enter AD credentials. This is possibly my preferred option. Potentially setting up 802.1x on the Wifi and passing through the authentication credentials to Sophos XG? Not sure if this is possible Some kind of MAC restriction and logging who has what IP. Seems longwinded and slightly archaic What are others doing and are there any other better options I have missed? Regarding the first option (if that is best), what are likely to be the areas of friction? I will want a secure connection to the Sophos for auth so suspect purchasing a certificate would be best so users do not have to install one for that purpose. Even so, I suspect a certificate would need to be installed for SSL inspection if going down this route. Ipads Options for these I think are similar to the above but again would love to hear what others are doing. With the captive portal option I guess I can set a timeout of inactivity for authentication. My thinking is I would probably want this shorter for iPads (possibly 15 minutes or so) which are used by multiple students, than BYOD devices which will be 1:1. I suspect with the captive portal it will be a one-size fits all though. Any guidance on best practice in these scenarios would be greatly appreciated! If people have any consultants who they can recommend who really know these areas to help in best practice particularly in the education sector again, it would be much appreciated.

Another could be to stick a conditional access rule on in Azure AD that signs out after xx minutes?

Morning all, I am starting a new job in the next few months and my brain is already ticking over on a number of systems I haven't used before. One of these is best practice using a Sophos XG for BYOD (something we do not use in my current workplace) and iPads (which we do use). I am well versed in Safeguarding requirements and have been using a combination of Securly and Classroom.Cloud - but need to get my head around what is possible with the Sophos. Understandably the school will want and expect any changes to be as seamless and frictionless for students as possible. BYOD So far I have concluded my options may be: Open access on to the WiFi (obviously with locked down access to just internet / DNS / DHCP etc.) coupled with a captive portal for the Sophos where users enter AD credentials. This is possibly my preferred option. Potentially setting up 802.1x on the Wifi and passing through the authentication credentials to Sophos XG? Not sure if this is possible Some kind of MAC restriction and logging who has what IP. Seems longwinded and slightly archaic What are others doing and are there any other better options I have missed? Regarding the first option (if that is best), what are likely to be the areas of friction? I will want a secure connection to the Sophos for auth so suspect purchasing a certificate would be best so users do not have to install one for that purpose. Even so, I suspect a certificate would need to be installed for SSL inspection if going down this route. Ipads Options for these I think are similar to the above but again would love to hear what others are doing. With the captive portal option I guess I can set a timeout of inactivity for authentication. My thinking is I would probably want this shorter for iPads (possibly 15 minutes or so) which are used by multiple students, than BYOD devices which will be 1:1. I suspect with the captive portal it will be a one-size fits all though. Any guidance on best practice in these scenarios would be greatly appreciated! If people have any consultants who they can recommend who really know these areas to help in best practice particularly in the education sector again, it would be much appreciated.

Hi all, I am trying to create a flow that clears out a certain folder based upon a defined retention period. The files are easy and working, but folders are proving a little more problematic. They require a 'Send HTTP request to SharePoint' API call as there is no action for deleting files but it doesn't seem to be working and I get a System.UnauthorizedAccessException. Does anyone know permissions required to run these commands? Is it, as I suspect, a Sharepoint Admin role? For information the user I am using does have permissions to browse and delete files within this folder on Sharepoint.

Morning all, Really quick one. Has anyone found a way to set a custom password policy from within Azure AD. We would like to adopt the NCSC best practice (no special character requirement, 12 char plus passwords etc.) which is easy on our on-prem environments (which will then sync) but as we allow users to change their password in the cloud (password writeback enabled), as well as having a significant number of cloud only accounts, I am looking for a way of enforcing the same in the cloud.

A colleague currently has an issue with the speed of syncing large OneDrive folders when staff roam from computer to computer. Situation is: Staff members regularly use different machines, meaning profiles have to be created for the first-time Where staff have a large amount of files in their documents, or a Sharepoint folder shortcut within their Docs, it takes a long time for these user accounts to be fully functional (and by that I mean have access to all of their files) I don't think there is an obvious solution to this other than trimming down Documents, only adding shortcuts to necessary sub-folders etc. I wondered if anyone else had an ingenious suggestions beyond using laptops and docs (which is what we have started to do this academic year). Has anyone used CloudDriveMapper and if so how has the experience been? - - - Updated - - - Should add the Files on Demand is turned on, it is just the share number of files that causes the issue.

Think you have posted this to the wrong forum... but I will try to answer this anyway! There are several layers to this. By default everyone receives the Default GAL which includes everyone on the tenancy ... to my knowledge this cant be amended. You can create your own GAL with whatever filter you like, but these need to then be assigned to an Address Book Policy (along with Room List, Address List). We script this (using powershell) to first assign a blank one (just as a belt and braces approach) then assign the correct one based upon Company, Department etc. Faffy but it works.

The supply into our cab room is from a C19 plug and we have always had a UPS with a C19 input. Our needs have dropped and we have very little equipment in there now and a much smaller UPS would be suitable. Unfortunately these all seem to come with C13 inputs. For some who knows more about power than me: Is a C19 to C13 adapter safe and compliant Do you know of any small, cheap UPS's (~500w / 1000va) that have a C19 input Thanks in advance

It is funny... from a management perspective I have found some of the tasks that are second nature on the Microsoft platform extremely hard to administer in Google, and I wonder whether that is just because I have an MS mentality. I suppose I am thinking more specifically about Classrooms vs Teams. For example, Classroom management - how do you go about this as an administrator? We have had instances of teachers (who were owners of a particular classroom) leaving and simple management of that classroom has become hard to the point of unmanageable and 100s of resources had to be shifted. Which leads to my second point... Structuring of files seems very proprietary on Google Classrooms compared with a Teams file store... If we wanted to export, move, manipulate uploaded resources in any way I am finding it virtually impossible. This would be no problem in Teams Again, may be my mentality, not understanding the tools or missing something very obvious but Classrooms in particular seems to be missing the equivalent of the Teams Admin Center for better centralised management. Having said that we do have an increasing number of Chromebooks in the school and as a cheap, fast to boot, easy to access tool they are hard to beat and are likely to become our go to devices outside of dedicated IT suites. Pair them with Azure AD sign-on, Azure Provisioning and some shortcuts to, ahem, Teams / Office Online and you have the best of both worlds.

Hi. Can't vouch for how up to date these are, nor whether they are the ones we settled on (found in my admin area as I can't download the file from intune) but I think they should give a good starting point - remove any you want to keep and whatever you do test, test, TEST before rolling out to production: Computer Context Powershell: Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*Microsoft.windowscommunicationsapps*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.displayname -like "*MSTeams*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*Microsoft.GetHelp*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*Microsoft.GetStarted*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*xbox*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*feedback*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*phone*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*gamingapp*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*solitaire*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*BingNews*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*MicrosoftTeams*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*Zune*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*Terminal*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*Alarms*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*Todos*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*HPAudioCenter*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*appup.intel*"} | Remove-AppxProvisionedPackage -online Get-appxprovisionedpackage -online | where-object {$_.packagename -like "*Microsoft.549981C3F5F10*"} | Remove-AppxProvisionedPackage -online User Context Powershell: Get-AppxPackage Microsoft.windowscommunicationsapps | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*Teams*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*GetHelp*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*GetStarted*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*xbox.tcui*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*xboxGameOverlay*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*xboxGamingOverlay*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*XboxIdentityProvider*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*Microsoft.XboxSpeechToTextOverlay*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*feedback*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*phone*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*solitaire*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*windowsalarms*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*Zune*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*Todos*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*HPAudioCenter*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*appup.intel*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*terminal*"} | Remove-AppxPackage Get-AppxPackage | where-object {$_.packagefullname -like "*549981C3F5F10*"} | Remove-AppxPackage

Oh, and for info we use Securly and Classroom.Cloud in conjunction with each other

In my opinion there are filtering platforms which provide some level of monitoring effectiveness. And safeguarding platforms which provide some level of filtering effectiveness. I don't feel there is a service out there (at present!) that covers both aspects in a way that is fit for purpose and has led most schools to adopt a separate platform for each. I think the closest might be something like securly *if* you are a purely Google School but if you have to support any other devices, online platforms such as Microsoft etc both in and out of school usually a two platform solution is necessary. I would hope this would change over the coming year or two, with filtering platforms providing agent based monitoring tools and vice versa but for now I am personally not aware of one.

Yeah, the upload doesn't worry me... but I absolutely cannot find a way to get the files from Classrooms in a decent format. Files are structured in classrooms using topics but I cannot find any way to export these in any kind of structured way. I was even hoping to be able to download the files and an associated XML file that showed this information (so I could script a solution) but I am starting to think it is impossible! Has anyone migrated from Classroom to Teams? If so how have you achieved this?

Before I delve down this rabbit-hole... does anyone know of any way to bulk download resources under the Classwork tab in Google Classrooms in bulk? Or even better, move all of this directly into Teams/Sharepoint?

Also worth considering the implications of something like this in regards filtering and, more importantly, monitoring given the KCSIE guidance. If they are unauthenticated, how can you tell who is who

Just to update - implemented this yesterday. Works perfectly and definitely streamlines our onboarding process. Would recommend to anyone who has a hybrid setup.

Trying to streamline our onboarding process and aiming to have students be able to logon for the first-time either onsite (AD) or online (Azure AD). At present if the 'User must change password at next logon' box is ticked, the password doesn't sync. I am fairly sure all we need to do is run "Set-ADSyncAADCompanyFeature -ForcePasswordChangeOnLogOn $true" on the server. Has anyone done this? Any drawbacks? Our password writeback is working so looks fairly straightforward, just the ForcePasswordChangeOnLogOn looks quite scary, and just want to check this doesn't change any attributes within AD, but simply propagates these settings to the cloud.

Just wanted to post a quick message regarding Securly filtering and the excellent service we have received thus far. Having used the solution for some off-site laptops for a while now we took the plunge and began the rollout at our Secondary a couple of months ago. We had a bit of a rocky start - no fault of Securly, we really struggled to get what we thought was a simple DNS query to pass through our ISP untouched - but Securly's support team were absolutely fantastic. Sales team do not give the hard push, but simply allow you to try the product and find out yourself if it is a good fit for your environment. Jump forward to this week and we managed to rollout a larger scale trial of the solution to 7 primaries in one day (albeit a fairly busy one). A couple of things we like so far: Single pane of glass management for a growing trust No on-site hardware requirement Great SSO with online services (such as Azure) that does not require any additional authentication on most devices Variety of different deployment options depending on need Early days but given that I am always quick to post when we don't have the best experience, I thought it would be nice to share the good so thanks to Securly - and in particular Andy & Olu.

Hi all, Trying to deploy Windows 11 to some of our legacy equipment (due to be replaced this year) but the workarounds I have found online do not seem to be working. Have added the regkeys below but they dont seem to work: HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup\AllowUpgradesWithUnsupportedTPMOrCPU HKEY_LOCAL_MACHINE\SYSTEM\Setup\LabConfig\BypassTPMCheck HKEY_LOCAL_MACHINE\SYSTEM\Setup\LabConfig\BypassSecureBootCheck Have this workaround been removed with 22H2? Anyone found any other way to support on unsupported hardware - particularly using SCCM / WDS? Was wondering about editing the Windows PE image to add in the above?

We are in the process of rolling out Windows 11, and as we progress with the rollout our internet bandwidth seems to be suffering. Some of this was anticipated due to the following: Increase in the use of OneDrive (utilising Files on Demand) Co-management of devices with SCCM None-the-less, we are still hitting greater bottlenecks than I would have expected and I am currently trying to diagnose the cause. One possibility is that Windows Apps are updating automatically. I wondered if anyone could explain exactly how this works, and what others are doing about this - if anything. My main questions are: Are all built-in apps updated when a user logs on. If so, does the update apply to the OS or, as I suspect, the individual user. This would mean that any updates for all pre-provisioned apps are being re-downloaded at every user logon (we don't keep profiles for long so this would mean pretty much every time a user logs on How are people dealing with this? Do you disable store app updates using GP? Are these app updates included in cumulative software updates (which we currently push out with SCCM) Any pointers on how this all works and the best way of management to limit bandwidth would be greatly appreciated. We have our broadband renewal due a year in September and will be upgrading the line at this point in time, but wanted to see if I could make it manageable in the interim.

I have been made aware of this app today and plan on drafting a letter tomorrow. So I am clear it am I right that: It allows individuals to post anonymous questions and links them up with other 'students' (I put that in quotes as there is no knowing who is signing up) to answer They promote zero negativity, but unsure how this is possibly policed. Can only imagine the amount of cyber bullying on the platform. Does it allow direct messaging of individuals within a matched school within the app, or via email. Trying to properly assess the risk -whether it is of predatory behaviour and a risk of students being contacted or predominantly cyber bullying and wellbeing. I wondered if you would be kind enough to PM the letter you sent out as it would be great to have that as a jumping off point.

Funnily enough, this is what we decided on a week or so ago. Triple monitor is going to be completely unmanageable, a frustration for staff, a headache for us. We are going down this route for sure!