CyBeRkId2002

Hi all, Just wondering the best way about licensing devices under EES (using Intune). I had presumed as these were Azure AD joined devices the magic would just happen but, alas, this isn't the case. What I have found so far: Windows installs with the default GVLK as standard Computer may have a BIOS embedded key - but if upgrading from W10 to W11 this wont work For our devices in school I guess we could just leave these as KMS and be done with it. We have a handful of devices at the central team that never see a traditional server - do I just push the MAK key out to these (Powershell script???) Or is there a better way to manage all of this?

Hi all, I am struggling to get the above three factors working and playing together nicely. My issue is that: Whilst the Azure Sign-In Page is excluded from TLS decryption, the response it sends to Google is at http://www.google.com/a/domainname our ISP only seems to allow exclusions to TLS based on domain name, not specific sub-pages. I am not prepared, for obvious reasons, to disable SSL inspection for Google It seems impossible to install a certificate that applies to the chromebook device before sign-in (effectively a guest user) I have been racking my brain but can't think of other options here. Wondered if anyone had been through this and found a fix? Obviously I could disable SSO and authenticate via Google but this seems like a bit of a compromise. Can anyone see any other options (other than finding a more flexible filtering platform)?

Does anyone have any experience of tenent to tenent migrations, particularly any third-party companies that support in the moving of data between tenents? In summer we are looking at centralising our 7 primaries onto a single tenency. I understand what need to be done with this but I currently looking for recommendations of third-parties who can help with the actual moving of data. The scope of this would be: Email OneDrive Sharepoint Teams (although I am slightly less concerned about this if the underlying sharepoint folders can be mapped to an equivalent teams sharepoint folder Any advice, recommendations or suggestions would be greatly received.

This was from an ISO so I guess that ignores the checks too and it is just the upgrade wizard.

nope... i3, 5th Gen

Apologies if this has been covered... but how do MS requirements (7th Gen+, TPM2.0 etc.) affect the education version of Windows 11. We have installed on a computer that meets NEITHER of these requirements and it installed fine. I was expecting it to carry out some kind of system check but no - have any early adopters rolled out on a large scale? How have you found it? Any issues with updates etc.

I think I agree that AzureAD may be the best fit ... and using this small team as a trial it may actually influence what we do in the primaries. To replicate what we join these devices to AD for right now what I would need from Azure/Intune/Endpoint is: Set Defender policies Push out a small amount of software (realistically for our central team this is mainly just Chrome and Office) Enforce bitlocker and, ideally, store the key in AD Enforce a password policy Enforce Windows Update policies and keep an eye on these (Baselines etc.) Allow sign-in when a network is not available (I presume even using cloud credentials the ability to sign-in offline is available?) Push out a CA cert for when they connect to I am guessing all of this is do-able using these three technologies, and is it covered in a typical E3 licence. How does the process work? Do we add the device to Azure AD administratively and then hand the device over? Or is there an OOBE option that is really hands-off. Any guides, pointers, walkthroughs on options that people have found particularly useful would be great!

Hi all, I am currently trying to centralise services across our trust and I think it is likely to end up with a single forest and RODC's at all sites due to them being extremely rural and having pretty terrible broadband speeds. That bit I am fairly happy with. In addition we also have a central team of 10ish people based elsewhere who it just seems over the top to install an RODC for. I wondered how other people are managing devices which very rarely check in to a network. Do you have them domain joined for compliance / to set policies? Am I missing a trick with Azure connected devices (as in, could I just get them to sign in to their cloud account. Interested in hearing any tips and tricks for people who rarely connect to a domain and what people have come up with to manage these with the minimum of fuss!

Hi all, Looking to update the free version of SQL that comes with SCCM. Been keeping SCCM itself up to date but thought it was about time I updated the backend (particularly as I am currently having trouble running WSUS cleaning scripts). Has anyone done this and, if so, how do I go about it? Particualrly keen on finding out how the included licence gets applied. Is it as simple as downloading the SQL installer from the SCCM section on VLSC and running it?

Fully 2022 here... no issues.

Hi Kenny, Not sure what you are looking for (not 100% familiar with everything a SCR contains) but under a staff report you can add all of the background bits that are stored within Bromcom. Can you not just create a report that certain people then have access to. I am sure the Excel add-in has it's uses (we have definitely found some use in manipulating info with PowerBI) but for I would think you would be able to create a report that pulls out the key information without resorting to this. Key for me on something like this is making it as simple as possible for someone to access when needed... and can't imagine the Excel add-in would be that for most.

Hi all, I am currently investigating this for our SLT (I posted about this a few days ago trying to get my head around how we can perform breakdowns excluding certain sub-codes etc.) I am still struggling through this but going to find some time today to investigate - I just wondered how this is being handled in SIMs. I am told they are ahead on this and their reporting allows you to filter based upon sub-code etc. To say I am suprised that SIMs is one step ahead is an understatement.

As title, is the a restriction preventing Dynamic Distribution Lists appearing within a GAL? I have the following query which I believe should do the job (I know there seems to be way more brackets than necessary but Exchange Online adds these in when I put in the correct query): ((((UserPrincipalName -like '*@schoolemaildomain.com') -and (Department -ne 'Governors'))) -or (((((((ObjectClass -eq 'msExchDynamicDistributionList') -or (ObjectClass -eq 'group'))) -or (ObjectClass -eq 'publicFolder'))) -and (EmailAddresses -like '*@schoolemaildomain.com')))) If I copy this exact query and use it as a filter on a Get-Recipient search then Dynamic Distribution Groups are included... but they are not appearing in the newly created GAL. Desperate to get this working as we regularly use 'All Teaching Staff' (for example) emails.

I have a script I would like to run hourly to place users in the correct OU. It works now, but is fairly slow as it goes over every user and tries to assign them to the ABP, even if it is already set. I am unsure how to improve the code so it checks if AddressBookPolicy is already set... I have used Get-User as I need to lookup Company / Department, and this does not allowpull through AddressBookPolicy as a filter item. Get-User -ResultSize unlimited -Filter "company -eq 'Trust'" | foreach {Set-Mailbox -Identity $_.MicrosoftOnlineServicesID -AddressBookPolicy "Trust"} Get-User -ResultSize unlimited -Filter {(UserPrincipalName -like "*@schooldomain.co.uk") -and (Department -ne "Governor") -and (RecipientType -eq "UserMailBox")} | foreach {Set-Mailbox -Identity $_.MicrosoftOnlineServicesID -AddressBookPolicy "SchoolABP"} Get-User -ResultSize unlimited -Filter {(UserPrincipalName -like "*@schooldomain.co.uk") -and (Department -eq "Governor") -and (RecipientType -eq "UserMailBox")} | foreach {Set-Mailbox -Identity $_.MicrosoftOnlineServicesID -AddressBookPolicy "GovernorABP"}

Ok... I thought I would update this for anyone else who stumbles across this in the future as it has taken me hours to really get my head around it! Most importantly users can be in multiple GALs at the same time, contrary to what I had read on multiple websites / blogs / pages. If they meet the requirements of the recipient filter they will appear in that GAL, regardless of which other GALs they appear in Who appears on a Global Address list is defined solely by the recipient filter assigned to that Global Address List Who can SEE the global address list is defined by the AddressBookPolicy assigned to that user. If no policy is defined they default to the default GAL which includes everyone. Out of curiosity, in the interest of safeguarding, has anyone removed the recipient filter from the default GAL so no-one appears in this list? Tempted to do this as if the script breaks, stops working at any point I would rather users get an empty GAL than one with potentially other users from other schools.

Thanks fgor taking the time to reply in so much detail! I clarifies things a little, but I am still at a loss on a couple of bits: You have a recipient filter which puts Student (for example) in an Address List. When does this run? At student account creation? Hourly? Daily? What happens if users match recipient filters for more than one Address List (guessing it would put them in all as students can be in MULTIPLE address list. How do you define your Global Address Lists? Do you use Recipient filters too, or is it as simple as which GAL a user ends up in depends on Address Book Policy? I think ultimately I am going to end up forgetting about RecipientFilters and just writing a script to run hourly that Assigns address book policy based on similar filters - I was just hoping there was a simpler way that didn't rely on scripts running (we all know scripts break from time to time)

Afternoon all, I am currently in the process of planning details on a centralised migration of Microsoft Tenencies and want to understand a little more on GAL from those who understand them. Understandably we want to seperate school to school comms (for safeguarding reasons) as well as provide email addresses to Governors / Trustees who should not have access to students emails. In short, I am struggling to understand the difference between GALs and Address Book Policies - and to find a reliable and I believe GALs can be defined with filters when they are created - either precanned or based upon user attributes. Are these allocated at the point of user account creation, or are users checked against these lists periodically? What happens if a user meets the coniditons in two GALs filters Are they a reliable way of allocating users to GALs Where do Address List Policies fit in with all of this? Ultimately I want a solid way to put these restictions in place, to allow us to setup GALs as we see fit - but most importantly be reassured that users are reliably being allocated to these groups.

Oh, don't get me wrong I agree entirely!!! Just trying to complete their reuest so we can get the call escalated. Software is Biostore (Fastrak). Issue we have having is that when ParentPay downloads occur (every 10 mins by default) the tills lock up for a short while (between seconds and a minute or so - I suspect depending on number of payments being downloaded). They say we are the only school experiencing this but I dont believe this will be the case.

I have checked and checked and checked under settings but cannot find that option anywhere! Could you guide me to it? Have expanded the processor section but absolutely nowhere to allocate cores.

Hi all, I am trying to diagnose an issue with a piece of software on one of our servers and the developer has said the server must have 1 CPU, 4 Cores. I originally set the server up with 4 virtual processors but apparently this could be causing some of the slowdown we are seeing. Is it possible to allocate cores, rather than sockets, to a Hyper-V server?

Thanks for this... As far as I am aware even the above is not always unique as you can have more than one attendance mark for a date and period (if a teacher updates the code for example during the lesson). I have added a development suggestion to Bromcom so hopefully this will be added soon. As it stands I cannot think of a way which is going to be 100% reliable with no chance of misrepresenting the data.

Hi all, Our attendance officer has been asked to crunch some numbers on what our attendance figures look like excluding I02 (presumably to see what impact COVID is having etc., where we would be under normal circumstances etc.). This has naturally come my way! I am trying to do this in Bromcom, but struggling. The Attendance (Basic) has been updated but does not include the ability to export the attendance mark unique key - so can't incorporate this with our existing PowerBI analysis. The PowerBI feed is yet to include attendance sub-code. Anyone else have any ideas on how I can easily do this (without re-writing ALL of our dashboards based around the Attendance (Basic) report)?

Hi all, On behalf of my trust I am hoping to arrange some CPD where we get an Apple Educator in to demonstrate some good use of iPads (useful apps etc.) particularly at primary level. I know this used to be something Apple were keen on (I mean, why wouldn't they be - it sells more iPads!!!). Does anyone know if this is something they still offer and, if so, the best way to get in touch with the right department? Can't find any contact details online so may just take a wander into my local Apple Store.

Just off the back of the comment above ... do people even bother backing up DCs? Just putting a new backup process in place here and not sure if and why I should back up the DCs?

Hi all, Just wondered what peoples preferred methods of backing up Hyper-V hosts are? I am thinking specifically Host/Cluster aware backups vs backups from within the guest. For info I am using DPM and so far the only real deal-breaker against Host level is it states file-level restore is only possible from disk-based media. As such we would be limited with our tape-backups to whole VM disk restores. As such I was thinking: Guest level backups of our File Servers Host backups of everything else Just wondered how others are doing it.