toffee_paul

Yeah I looked at that event IS and noticed it was which is logged when the WLAN has disconnected but I was still having the same problem, getting Airplane Mode disabled. that's why I went with removing access to the file that launches instead.

I did consider taking a simalar approach, but as we are an SEN school there were a few other factors to consider and in the end decided it best to remove access to Airplane Mode altogether.

I found that the Fn+F8 key launched a file called TpFnF5.exe in the C:\Program Files\Lenovo\HOTKEY\ folder as @ADMaster mentions. Access Connections is not installed on any of our laptops. After some rigourous testing on Friday it seemed that the only way to prevent pupils from accessing Airplane Mode was to block access to the TpFnF5.exe file itself. The reason for this being that there is no way (that I can see) of turning the Airplane Mode off without using the OSD that appears when Fn+F8 is pressed. TpFnF5.exe has command line parameters such as /WLON, /WLON, BTON, BTOFF, ALLON, /ALLOFF for individual control the WiFi and Bluetooth radios but none of the command override the Airplane Mode master switch. The file doesn't have a parameter to turn Airplane Mode on or off. I was hoping that if a pupil enabled Airplane Mode, a Windows task I created would detect it, run the TpFnF5.exe file with a /AIRPLANEMODEOFF parameter thereby undoing their actions but unfortunately there is no such parameter. I've took the heavy-handed approach and created a Group Policy object to rename the TpFnF5.exe file making in inaccessible when Fn+F8 are pressed. Thankfully, there is no "file not found/cannot launch TnFnF5.exe" prompt, it just does nothing which is ideal. As the file has only been renamed and not deleted it's pretty straightforward to revert back if needed.

I found that the Fn+F8 key launched a file called TpFnF5.exe in the C:\Program Files\Lenovo\HOTKEY\ folder as @ADMaster mentions. Access Connections is not installed on any of our laptops. After some rigourous testing on Friday it seemed that the only way to prevent pupils from accessing Airplane Mode was to block access to the TpFnF5.exe file itself. The reason for this being that there is no way (that I can see) of turning the Airplane Mode off without using the OSD that appears when Fn+F8 is pressed. TpFnF5.exe has command line parameters such as /WLON, /WLON, BTON, BTOFF, ALLON, /ALLOFF for individual control the WiFi and Bluetooth radios but none of the command override the Airplane Mode master switch. The file doesn't have a parameter to turn Airplane Mode on or off. I was hoping that if a pupil enabled Airplane Mode, a Windows task I created would detect it, run the TpFnF5.exe file with a /AIRPLANEMODEOFF parameter thereby undoing their actions but unfortunately there is no such parameter. I've took the heavy-handed approach and created a Group Policy object to rename the TpFnF5.exe file making in inaccessible when Fn+F8 are pressed. Thankfully, there is no "file not found/cannot launch TnFnF5.exe" prompt, it just does nothing which is ideal. As the file has only been renamed and not deleted it's pretty straightforward to revert back if needed.

You're right, that looks like it would work but for those occasions where the guilty party logs off THEN uses FN+F8 to disable the WLAN, it would not work. I've had a very quick look at Win Task Scheduler and creating a task which looks for events that are triggered by the WLAN being disabled. This looked promising after I simulated it by disabling the WLAN and getting the task to run a batch file to re-enable it. Problem is, the Fn+F8 combo doesn't actually disable the WiFI in the traditional sense, it enables Airplane Mode. It looks like a 'soft disable', a way to enable/disable that's quicker than the traditional Windows way of doing it, either by GUI or netsh interface set interface "Wireless Network Connection" Enable/Disable About to have a look to see if there's anything else in Event Viewer that I can work with.

It's odd, Lenovo have released a 'Hotkey Integration Package' for this model and other models but all it seems to do is change the default behaviour of the top row keys. It doesn't actually offer any way to disable the special functions of the keys themselves. I may try the log off script/PowerShell method. This site looks like a good place to start. Should be able to get this running at log off or may try and put it on a timer so say every 30 seconds it checks the state of the WiFi connection and if enabled do nothing else enable it.

Haha love it. Funny how those types of people seem to have infiltrated every place I've ever worked! How did you deploy this btw? I was going to look at PDQ Deploy but renewing that this year may not be an option

Unfortunately there's nothing in the BIOS, this was the first place I looked (sorry I should have mentioned this in original post). There's only the ability to enable/disable WiFi entirely which is obviously not what I need! I'll have another dig around and see if there's a software setting in the O/S. It must be something running before the login screen though.

Hi all, Some students are disabling WiFi on our Lenovo laptops using the Fn + F8 keys. It started as the odd laptop once every blue moon but seems like a student has passed word around how to disable it. Anyone have this problem in their school? It's causing the next student to log on to get the "no logon servers available..." message as they try and login. I know this message can also caused by other problems like I've read on other threads but this is definitely due to the pupils deliberately altering the setting. I'd love to be able to stop them from pressing this combination without altogether blocking the Fn keys for them. Any advice? Thanks Paul

would I be right in thinking that preventing access to the boot screen is common in schools? Thinking of doing this with our student laptops...we have BIOS passwords set here but obviously this is another layer of security I need to add in! Does anyone enforce this with say, admin desktops or just limit it to pupil machines?

Hi, I'm looking at getting a QNAP NAS at home and want to link the Surveillance Station app to an intruder alarm. Anyone got any advice on how to do this? Absolute newbie regarding alarms/cctv! Thanks

UPDATE: Found a HP Technical white paper and and seems pretty straightforward to add a switch to a pre-existing stack. Hi, In my workplace we have 7 switches in the server room, 4 in the core (stack1) and 3 access switches (stack 2). Switches 1-4 are connected by stacking cables in ring topology, as are switches 5-7. Switch 4 is connected to Switch 5 by a 10GB DAC cable. We've ran out of PoE ports on the core switches and I need to add another 48 port PoE switch to the network. I'm planning to connect it to stack 2 as obviously the first stack has already has the max number of switches in it. My question is, once it's been racked up how do I go about configuring it? I know the equipment I need (switch, stacking mod/cable) and know to insert the module before booting the switch so stacking is already enabled on the new switch. From there though I'm stuck as I'm very inexperienced with this kind of thing and more or less just starting to learn about routing/switches/VLANs etc. He use the HP 2920 series (5 x 48, 1 x 48 PoE, 1 x 24 PoE) and I'm ok with port tagging but just need to know what I'm going to be doing isn't going to mess things up. I've been following this guide but it's geared towards setting up a stack from scratch whereas I'm just adding a switch to an existing stack. I've got recent backups of the running config in case I make a balls of it but would oblivious rather not have to revert to it if possible! It anyone out there would be willing to share the commands I need to enter that would be great and much appreciated! Thanks in advance. Paul

Thanks Sparkeh. Was guilty of not searching!

Hi, Does anyone successfully used an MDM to download app bundles using VPP? Some of the teachers in the school are asking for Mr Thorne's Literacy Collection and although it appears in the app store for £12.99, it's doesn't look like I can purchase it though the Apple VPP, only the standalone apps. Not very economical to purchase the apps seperately as you can imagine so I was wondering if there's a way someone has found to purchase the bundle and deploy through an MDM? We're using Meraki. Thanks, Paul

Thanks tmoon. Just discovered that users can remove the Meraki Management profile from the devices without needing to enter the password I set! I get notified by Meraki of profile removal but still, when the profile is removed users can do as they wish with the iPads. None of our iPads are DEP enrolled and don't think they're eligible either so we can't block profile removal. Looks like it's back to Apple Configurator for deploying profiles .

Great, nothing worse than entering the Apple ID password for each iPad every time an iOS upgrade released! I think the redemption codes were deployed through Apple Configurator but I'm not 100% on this as it was the previous incumbent of my job set these up. 1. Upload your managed distribution token to Meraki. Yep, already done this. Logged into the VPP Account Summary, downloaded the token and imported it into Meraki. 3. Deploy all your apps in Meraki, making sure you tick use VPP device assignment and attempt to manage unmanaged. Will do, what happens if VPP device assignment isn't ticked? 4. If you are eligible you can apply to convert your redemption codes here. You can also apply for copies of iWorks here. Once converted these will be deployed exactly the same as free apps, if you use device assignment no Apple IDs will be required on any devices. Think we only have about 3 or 4 paid apps so converting shouldn't be too much hassle. No more unique Apple IDs on the iPads, best news I've had all week! So when it comes to Apple Configurator 2, shall I just use it for supervising me iPads, backup up existing iPads, and setting up Configuration Profiles and restrictions? Am I best abandoning the [email protected]) Apple ID altogether? Thank you!

Hi,Hopefully someone can help me out with some questions I have about managed iPads?When I first started at the school I was left some documentation regards to how apps were purchased/deployed. There was, and still is, an Apple ID ([email protected]) for an iTunes account for downloading purchased apps and free apps, and a separate Apple ID ([email protected]) for VPP for purchasing apps that aren't free. iPads are not enrolled in DEP.Individual Apple IDs were set up for each of the 20 iPads in the format [email protected]'m aware that since iOS 9.3 there have been changes to how apps are distributed (Managed distribution). Can anyone advice on the following:What to do with the Apple IDs - should I abandon the individual Apple IDs for each iPad and sign them out on each device? What will happen to the apps in each device, can they still be used, will they still appear?Apple IDs for iTunes and VPP - Should I just use one ID from now on. Both Apple IDs have payment information enteredfor them. Should I abandon the iTunes Apple ID and use the VPP one exclusively, for both paid and free apps? Using Meraki MDM in combination with Apple Configurator - I've linked my VPP account ([email protected]) with Meraki by downloading and important the Managed Distribution token from the VPP Account Summary page. I can see the benefits to using the MDM for distributing apps over-the-air and ideally that's what way I want to distribute apps. Device-based distribution is that direction I want to take but knowing what existing Apple ID for deploying apps is confusing me.We don't have many paid-for apps, 95%+ are free apps. All the free apps were obtained using the iTunes Apple ID ([email protected]), if I'm now start downloading free apps from Meraki from Meraki will I need to download all the previous apps again? I'm not against this if it's the cleaner option. The previously paid-for apps (redeemable codes) that were downloaded using the VPP account are not really used anymore so can be ditched if it's cleaner to do this. Any help is very much appreciated.

Hi all, Looking for specialist advice on trying to setup a global proxy on Smoothwall to allow iPads to have the same filtered traffic as what is already in effect on the school laptops and computers.We have a Smoothwall S4 and it handles NAT. We sync with AD and and it's this which acts as authentication for users and to determine if a user is a member of the 'Student', 'Staff', or 'IT Admin' group.In Group Policy, the Smoothwall Certificate is pushed to our PCs and Laptops. That's the current setup. What I need is for iPads which will be taken off-site for use by staff and students to be filtered in the same way but I'm really struggling with how to set this up. I've already contacted Smoothwall who got as far as configuring some stuff via the web interface but they said I needed an IP address and couldn't help any further. I then contacted our ISP, VirginMedia, who confirmed that we have two spare IP addresses in our range. We are only using one at the moment. At some point I may be asked to set up RDS in which case the other spare IP will come in handy for that. For now though I need to know what to do with this spare IP address. I've logged into our domain/hosting provider's website and can see the DNS settings. I created a new 'A (Name)' record' entered filter.ourschoolname.net and put the spare IP address in. I checked on WhatsMyDNS.Net and the DNS record has propagated successfully and resolves to the correct IP as expected. I'm stuck on what to do next. Do I need to go into DNS on our domain controller and do something here? Any advice would be great!When it finally comes to setting up a configuration profile on Apple Configurator or Meraki, I know I can do this without much hassle, but it's the DNS stuff I'm needing some advice on! Many thanks,Paul

Hi Cazale, I've actually re-enaled IPv6 and the AirPrint still worked. What I did at the same time as disabling IPv6 was set a ENABLE/ALLOW IPv4 IP Filtering range covering the internal network. Previously this wasn't set as it's never been needed. So it looks like setting a range in the IPv4 IP Filtering fixed the issue, combined with the Print without Authentication setting. When I assigned a static IP to the iPad that fell outside the Print without Auth IP range, it failed to print, when I moved it back, it worked again. So a combination of both settings worked. Still strange how it needs to have IPv4 IP Filtering range set up... would have thought the printer would be able to automatically tell what the range is without explicitly needing to define it. Thanks again!

Hallelujah! Disabled IPv6 not really expecting it to work but it has! Thank you Cazale! Now I must ask the question... why does printing from an iPad using AirPrint to a Konica Minolta printer only seem to work for us when IPv6 is switched off? Guessing only Konica themselves can answer that I'm just glad it's up and running. Can you see any downsides to not having IPv6 enabled? Thanks !

IPv6 is enabled, worth trying with it disabled ? Filtering is not set for IPv4, Restrict and Permit are both disabled. The printers are leased but I'll get in touch with Konica and see if they can shed any light. Many thanks for your help, Cazale. - - - Updated - - - IPv6 is enabled, worth trying with it disabled ? Filtering is not set for IPv4, Restrict and Permit are both disabled. The printers are leased but I'll get in touch with Konica and see if they can shed any light. Many thanks for your help, Cazale.

Sorry yes, AirPrint is on. I can see the iPad on netscan using an IP within the range I've set.

Print without Authentication is set to "Full Color/Black" and IP filtering is "Enabled". Account Tracking is disabled, only User Authentication is enabled and we authenticate using little round blue plastic fobs.

Hi Cazele, thanks for the reply... I'd forgot to mention that I'd already tried the Print without Authentication option on the printer... I set the iPad with a static IP and then set a range on the printer that meant the iPad should bypass the authentication. Unfortunately this didn't work either. At a loss as to why this is happening.

Hi, I've been pulling my hair out trying to set up wireless printing from iPads using AirPrint but just cannot seem to get past the user authentication set up on the printers we use. * Here's our setup ... Konica Minolta c364e with User Authentication enabled (Account Track not used therefore disabled) iPad Air with a configuration profile installed enabling AirPrint and pointing to the above printer I get as far as the printer showing the job so I know the connection between the iPad and printer is working fine. On the job history I get a "Deleted Due To Error" message. More specifically, "Logon error" is the message that appears when I'm standing at the printer looking at the job list. We also have Konica Minolta printer that doesn't have any kind of user authentication as it's used only by two office staff, AirPrint printing works fine with this printer so it's something to do with the user authentication on the c364e. On the screenshot I've included the "type" field lists the username of whoever has printed. When using AirPrint, the username seems to be automatically set as "mobile". Specifying a different username or even setting a password for this username on the actual iPad is not an option as theres's nowhere to configure this, it just seems hardwired into the iPad. My next step was to create a user on the printer called "mobile". It was pointless giving this user a password as it can't be entered onto the iPad when sending anything to print. With a Windows print driver, all users are prompted for their username/password but, like previously mentioned, that doesn't appear to be an option with the iPads/AirPrint. So the user "mobile" with blank/not entered password gives the same error on the job history screen. Any advice would be very welcome! Many thanks. * tried using different model printers and iPads and all have the same issue.