KK20

It would be madness to deploy a hyper-v cluster in 2012R2 "today". Why would you be constrained on the hypervisor? I can foresee the guests needing a certain OS version but why the hypervisors? That being said, if you are paid by the hour then by all means put the caveats back and sit back knowing you have an inplace upgrade job in a year time.

Hah yes, I remember getting permission from the bursar to save up the bulk of my budget till the end of the financial year, then forward spending on a pro forma into the next budget. This was for a server and storage complete renewal project that went through all the necessaries. The memo didnt get to the finance admin who did a fit when a 160% budget single invoice hit them, thus getting me hauled in.

contemplate killing WSUS and using WUFB. There was quite a bit of satisfaction killing our WSUS VM.

we enforce 2FA onsite for anyone with an admin role within the school (I dont mean domain admin - all those roles are help with service accounts - I mean users that have special jobs). We also give those staff a FIDO2 key so they can use that plus set up additional options (I have a fallback to the office phone in case I forget my FIDO2 and ms auth app phone). Otherwise 2FA is enforced outside of trusted location for everyone else. Regular teachers and staff are not forced to 2FA in trusted location. dont forget that VPN + VPN gateway will technically be a trusted location as the traffic will egress from the school. We are hybrid domain so have VPN as a logon option still.

local with redirected folders including appdata.

we use a MAK key for W10 and office 2021 LTSC. Office 2021 has spellcheck etc hobbled. We then take them off the main network and join them to a local exam network that has a network printer attached. Invigilators have access to the printer, candidates do not. If you need to activate, just use a MAK key on them.

the only problem with domain CA is the BYOD, not a major issue as we simply shrug our shoulders and say install the CA trust cert (this wasn't an issue in the old days as our filters needed the domain CA cert, these days its the securly cert trust)

Having used "print to email" (sandbox) for our BYOD printing, i want to enable webprint. However, looking at the SSL aspect, will this need the central keystore explorer store being updated for a proper certificate? For papercut client access on our domain, we use a long life domain CA cert at the moment so that's a "do once in papercut and the domain clients trust the domain CA", however if im looking at BYOD then I will need to swap to a letsencrypt SSL. Im happy to script the keystore explorer side with winacme/letsencrypt (as I do with our unifi) but if I need to update the primary keystore then I need to be careful as a full MFD sync will be needed - probably not something I can script nicely. Is there a way of having a subordinate server set up for webprint with a different SSL cert? Im happy to spool up a VM for this (on top of the sandbox!). How do you guys deal with papercut MF SSL for webprint?

how fast do you want to roll out? We did this over a full academic year. Process was: 1) inform staff of timescale and process. 2) map home drive to onedrive but dont migrate automatically 3) map additional drive letter to old home drive 4) limit quota to very small amount 5) let staff move their own stuff. 6) shut off the drive letter after academic year 7) switch drive letter back on for those staff who dont listen.

if you are moving GPO to intune fully there are a few gotchas, the biggest for us was lack of link order equivalent. you need to be very specific with your intune configurations. Some of our GPOs have gone back to the stone age with intune powershell scripts, this is simply because we need to make sure X is configured before doing Y. Installation of software is also mainly done with powershell scripts - Intune deployment of software is good but very one-shot, redeploying and updating is a bit messy. Another gotcha is no concept of OU in intune, I created a script that sync's our OUs into groups instead, that way I can use these groups within intune and I know they are synced with my AD OU. Autopilot puts its registered devices into a separate AD OU, I move those manually afterwards. Time? im in the middle of it now, it took around a month to sort what GPO I wanted to move then create FRESH intune configurations - I did not attempt to migrate the GPOs as this was a time to thin the GPO herd so to speak. We have decoupled 2 labs from GPO and they are currently running from intune. Im sorting it all out myself. Intune is a lot slower at rolling changes, if you are a gpupdate /force impatient type of person then you are going to struggle.

softcat have 30x U6-PRO and 2914x U6-LR in stock if that helps.

you need to have a fairly specific 2.4 set of clients to make 2.4 ax worthwhile. Do you have a lot of 2.4 ax devices and no legacy devices? You are also aware that legacy devices connecting to an ax 2.4 will slow down as those are parked whilst the OFDMA 6 clients are serviced, it isnt a pipeline. Coupled with the fact that ax isnt any faster then it is questionable as to why anyone would invest in 2.4ax clients at all. I would be interested to see a usage case though (2.4 mesh with multi stream channels where there is too much stone to have acceptable 5ghz maybe? ). I know from personal experience here that heavily metalled eco glass and stone walls EAT signal. So much so, I can sit with a ubiquiti mesh on one side of a window and lost connectivity 1m on the other side! That job meant I needed to drill and get the 3 ladder extension out for that one. One thing I did forget to add is that most unifi saucers have a mushroom shaped radiation pattern https://help.ui.com/hc/en-us/articles/115005212927-UniFi-Network-AP-Antenna-Radiation-Patterns this helps place them if you can visualise them in a room.

unifis are odd ducks, you need to pick a firmware that works for you, we had issues with ipads not getting DHCP and needed to play with firmware. We really do fear "install this patch for a 0 day fix" as it rarely works first time, but they are cheap.... We have a mix of around 20 ACLR, 10 AC lite and 10 ac pro. The lite are ok but dont cope well with more than 30 devices (chromebooks and ipads mainly). The ACLR are ok but suffer a lot from "weak edge connection" i.e. devices that hold onto the weak signal for ages without seeking a stronger signal - we ended up lowering the power (negating the point of LR), however these cope with better density so we purchase these instead of nano's. The pro's are great, better density but again we needed to tune the power down so devices seek better signals quicker. As others have said, we tuned our 2.4 really low. Get one unifi, get it powered in each room and do a site survey around the location. Yes this will take time but it saves just plonking them randomly. Due to our school construction (mainly stone) I found mounting them VERTICALLY worked much better - my WIFI goes "up and down" through the wooden floors rather than "side to side" for some areas, then in higher density classrooms they are horizontal. As for heatmapping, we did this manually using wifianalyser and walking around the room eyeballing it - simple "red, yellow, green" marker on a map. We didnt pay for something like netspot.

So, as part of our eventual push to get rid of onsite servers, GPOs are my next target. I have identified settings I want to remake in intune (im not migrating as this is a good time to remove the cruft). However we will still have a few scripts that will run for some time - one common one is WUFB, try as I might it will not work unless I kill registry settings in user hives for some users. Remove a simple entry and all is good - go figure. There are others too such as enabling DNS registration for connection those that have it removed (still a script job). I am leaning to scheduled task with a list of tasks added or removed. This will probably be a "package install". Thoughts?

for us we used cloud drive mapper and mapped H: to onedrive. I then restricted quota on MyDocuments. Staff and pupils copied their own stuff from my documents to H: usually after saving or using. after 6 months we dropped the quota to a hundred mb each where it remains now about 18 months later. In the new year access to the old my documents are being removed completely with a view to deleting at the end of the 2022/2023 academic year tidy up. Some staff still use the old H:, most use the blue cloud. Same with sharepoint, some use the old mega library mapped drive (again, CDM) , some use the sharepoint sync. next will be removal of onsite AD and a full migration to AAD, GPOs are slowing going to intune as we speak...

I did. You cant (big *: without 3rd party software with other MDMs). This is the workflow for optimum "zero touch" sso. 1) log in with apple id and ipad pin (note this does NOT pass any sort of authentication other than userID to microsoft authenticator, there is no handshake with azureAD and apple at ipad logon whatsoever) 2) click microsoft authenticator. Log in as appriopriate 3) all other MS apps work fine now with no logon. NOTE! Outlook may ask the user to add the mailbox (if not done already) what SHOULD happen is that you open any MS app and it should spawn the microsoft authenticator for you, thus accomplishing step 2. I have found this to be unreliable. We use the intune 365 template we did not create a custom payload so all the MS authentication URLs that are called should be correct, so technically speaking all the apps should be redirecting their authentication calls through the MS authenticator. However we have found that sometimes each app will still ask you to authenticate and to make matters worse, if you were to open the MS authenticator it will let you in and say you ARE authenticated (after this the remaining apps open without issue) so there is still something not 100% That being said, the process is stupidly simple to set up so I have no idea where I have gone wrong (if anywhere). 1) purchase ipad from company who puts the ipad into ASM for you. 2) create a profile in intune that says "shared ipad", "supervised device" as a minimum. I dont care about naming, I dont care about setup screens, keep it as simply as possible for testing. 3) make the profile the default profile for all ipad devices enroled - again for testing, I do have a couple of profiles in reality but for testing purposes this will ensure im not assigning an incorrect profile! 4) have an AAD group for devices enrolled with the profile. This makes your dynamic group much simpler to manage for "do this to all ipads" configuration or software profiles in intune 5) create the necessary configuration profiles in intune plus assign to the dynamic group. To keep it simple I install the office apps plus ms auth app, set up sso, add our enterprise CA cert and thats about it for testing. Im going to use a guest WIFI logon so there is little other config to interfere. I set up the 365 SSO as per ms doc. It is literally a couple of clicks plus two extra copy/paste settings. 6) assign ipad in ASM to intune. 7) switch on ipad for first time. Add to wifi. accept the remote management, let it reboot 8) log onto ipad with school email and school password when the MS prompt appears (for first time user they will need to create an apple pin) or apple pin as appropriate 9) open ms auth app and authenticate. 10) thats it really. in short, you cannot have a native zero touch SSO between apple and ms with intune. I believe other MDM have their own apps that will do this (Manage engine doesnt, I know that) but I have seen anecdotal evidence of jamf working with MacOS but nothing about ipads. There is notes about conditional access but this wont work with shared ipads of course. We have now educated users to click microsoft authenticator before other apps.

we have used cached desktop outlook for a number of years, outlook cache is redirected so they arent recreated each logon. We have a pitiful WAN connection compared to most people and we cope fine with 365 mail, sharepoint, teams and onedrive. We use microsoft connected cache too which also helps (yes peering exists but caching means almost no peer web traffic), good for all your other online data hogs (WUFB, intune packages etc).

Training. Dont forget training. Teachers moving from a shared drive mentality (assuming this is what you do) to an online only infrastructure is a big change for some. Onedrive and sharepoint sync too, again not all teachers are used to this.

I couldnt find a "space" in the synchronised metaverse for devices that would also appear in the dynamic group available properties. Only devicephysicalids . Even more worrying is that onside AD extensionattributes DO NOT automatically sync up! I would have been happy to have an onsite scheduled task update local extensionattributes and have them naturally sync up, even changing in attribute editor, force a sync and wait will show nothing. Only graph APIs seem to update AAD extensionattributes for devices. For Users you can happily syncrhonise the DN to extensionattributes of course as the AAD user metaverse exposes that to the sync tool. Sadly an onsite scripted group seems to be the only way to go albeit simple to do: dsquery computer "ou=computers,dc=MyDomain,dc=com" | dsmod group "cn=Test Group,ou=test computers,dc=MyDomain,dc=com" -chmbr

hah, we post the same thing at the same time. FYI if you have appcache share then this stops the roaming time issue and only makes it a problem for first run.

the only negative for CDM is single converged drive letter if you have a lot of teams on offer, I wish they had a "variable" converged letter - i.e. I add 4 libraries that I want converged to a single drive letter. The first run for a user can take a minute to pull down all the teams. I ended up using single drive letters for the libraries I needed as they take seconds to map. Apparently that feature is coming soon ™ They are also adding wasabi bucket support soon I believe.

a dynamic group populated with pcs that reside in an ou. so if I have a dn of OU=COMPUTER_ROOM_3,OU=TRAFFORD_BUILDING,OU=PCS,DC=ETC,DC=COM and I have a 365 dynamic security group computerroom3_trafford_pcs then I want the group to be kept up to date depending on the OU. Therefore a dynamic 365 group being kept up to date with an on prem OU. currently I have a static group that I add pcs manually. This is not ideal. The groups are going to be used in intune for software installations. Since we are hybrid I am still managing OU onsite. I intend migrating GPOs to intune starting with software installs.

correct. We have on prem AD with hybrid Azure join for all our devices. It is one thought to edit the synchronization of devicename to prefix the OU, this would be dynamic per sync too. I will look up the ramifications of having a different devicename in AD vs AAD for the same device.

I know that azure devices and OUs are tricky but I am trying to get some out of the box thinking so that I can create dynamic device groups that have logic based on their OUs. I already have a dynamic user group based on OUs as you can use "contains" with the distinguishedname (even use the AADconnect synchronization to put portions of distinguished name in an extended attribute if you so wish) I have not had as much luck with devices. distinguishedname is not exposed as a dynamic device property. It seems that extendedattributes is not exposed as a device metaverse for synchronization so that puts that one out. I cannot see an "unused" variable in the device properties that I could hijack either. The closest I have found is devicephysicalids which is a string list. I suppose I COULD form an expression that gets the proper devicephysicalids and appends my own distinguished name so I can use that in the dynamic group - my googlefu on getting the proper devicephsyicalids has failed me (and appending would not be a good idea as it would append each sync iteration!). I have a thought about a graph API updating an extendedattributes with the distinguised name but im not sure how to automatically trigger this. My final idea is to have a scheduled task script that will sync an OU to a security group but this is a bit janky. Any out of the box thinking? Currently we have a static security group for PCs in our OUs that we add devices too, this gets forgotten of course. we dont have SCCM either (which will do this for you with co-management I believe).

we use panda/watchguard, not the most lightweight but it works and has stopped a few nasties brought in by the kids for us. We run it in whitelist mode which can be a bit awkward if you run a lot of odd software but after the initial learning period it works ok. We develop our own software so getting a whitelist cert is a must unless you want to hash each of your programs!