KK20

this was an old XP trick. When a user logs in without a profile, it takes the local default one, copies it then creates all the little cache folders, files, APPX info, drivers, all sorts of tiny little files that are copied and created one by one. Then it drops the user at the desktop and away it goes. when you have a default network profile, this profile is copied and the computer mostly uses what is there with only the drivers for printers etc added - speeding up the logon process enormously. I always prune our mandatory profile - both folders and registry hive. We *still* have some ancient 2nd gen i5s (50% are only 4th gen i5s, the 9th gen i3s make up the rest) on our network and they get from BIOS to desktop in under 2 minutes - hard to say as there is usually software or update to install before CTRL-ALT-DEL. Certainly under a minute from logon to desktop (even with some async desktop scripts to run). Incidentally I also have a quad of core2duos which still work too, in office they are actually no slower than the i5's...)

11th gen should be ok, 12th gen not so much. Big changes in alder lake, you might get away with disabling e cores and it works. Try one.

plus it might be easier for you to look at getting WUFB to do all the hard work for you - easier than generating a brand new image, testing, rolling out etc. 1709 is so old that I doubt an extra month will make much of a difference in the scheme of things, plus its not your fault if the entire thing falls over tomorrow. As for imaging, we are still OLD SKOOL for our windows 10, we have a lightweight audit mode "golden sample" that is created with the very base software we need (stuff that we have issues installing via GPO reliably - not much). This is then captured in a generalised state into FOG. FOG reboots the PCs if we trigger them (or trigger the PC rooms etc) and PXE boot and images them appropriately. 15 minutes later there is a domain logon ready on the PC with its correct name, OU, GPO software and all from the comfort of my desk. It has worked for me since W7 days. WUFB then triggers updates for the delta updates since the image was created. This is not the modern way of doing things but it works for us. I would certainly look at scrapping WSUS if you are starting fresh, WUFB means no WSUS maintenance and it works.

I cant say, we had onedrive SSO before we had MFA and hybrid join enabled, I hybrid joined, removed ADFS, added MFA all around the same time as it was part of the final migration from "onsite" to "offsite". I dont remember SSO onedrive ever prompting though. I just checked by MFA CA policy, it has the usergroups assigned, "all cloud apps", one condition being "any location, trusted locations excluded". Access controls "grant access require MFA" - all simple. I have a restrict MFA signup to my trusted location too (for obvious reasons). I then have a named location for the school IP egress ranges and that is marked as "trusted location". Sounds daft, did you put a check mark next to "mark this as trusted location" for your school IP named location? That's the only thing I can think of. Do you have a CA policy for restrict MFA signup to trusted location? I assume that works. hybrid join takes seconds to setup and I dont think there are any downsides. The only thing that will annoy you is the lack of AD azure knowledge of OU infrastructures so your dynamic groups are hard to set up if you have an OU mentality infrastructure!

this was fun for our users. In the end I set up cloud drive mapper and gave them one drive letter with all the sharepoint libraries. Most of the teachers who struggle moved over to our sharepoint drive letter happily. the more savvy use sync on the libraries they want.

It works for us. We have a hybrid AD set up (with writeback and password sync). Currently no "pure azure joined" PCs but they are all hybrid join. Usual onedrive GPOs to autosign in. We too have a conditional for our IP4 addresses, we dont have any IP6 addresses. I didnt do anything out of the ordinary from what I remember.

I think I ignored this for months (we dont use K-12 express-used-to-be-spark offering). I did provision it all because we already had an azure federation link set up for our shared device CC licenses. Turns out a few people are using the free offering and storing in the cloud. Our shared storage now says we are using around 8Gb of 2Gb with individual users using some of their 2Gb quota. Looks like I will ignore this, I was going to raise a ticket but since everything was working, no weird charges appeared my thoughts were a glitch in the reporting and it seems it is. Not sure why they cant just dynamically update the shared storage with users multiplied by 2Gb though.

I asked for a quote for migration from onsite to them hosting. I was told that they apparently told everyone in march 2021 that they wanted all schools to be hosted by isams before april 2022 (first I heard) and that this deadline was extended to september 2022 (first I heard). I now have a choice of paying £1500 for them hosting or £2000 for me hosting in addition to our annual bill. We are still under contract mind - we pay annually but have a contract. My response is to pen an email to the Bursar asking for permission to tender for migration to someone else. I would make sure you get your quote in writing and ask about longevity of self hosting.

Ouch. So a 33% price increase. just under 2 years left on our contract so looks like we are going to a new MIS. Time to start looking....

i'll send their sales a request. thanks.

Looking for a wasabi uk reseller for annual reserved capacity of 15Tb. Most reseller are only looking to start at 50Tb (softcat said 25Tb minimum). Budget wont stretch to 25Tb. We dont have a school credit card so I cant go direct and would need to pay on invoice. Anyone any ideas?

look at dynamic membership group that has a team attached. this is a pain if you have MANY teams to set up https://docs.microsoft.com/en-us/microsoftteams/dynamic-memberships It does mean that owners cant add members manually though. I use this for our clubs teams such as DofE, that way the teams update themselves without much interaction from me.

you add the teachers to the "site collection admin" for each pupil. This is onerous and WILL get you throttled if you arent careful. My script has too much "personal to us" for me to edit out but the core is the command: $fullpath = $profileURL.OnedriveURL Set-SPOUser -Site $fullPath -LoginName $ADStaffGroupMember-IsSiteCollectionAdmin $true this is where $profileURL is built up earlier from my pupil UPNs adn the $ADStaffGroupMember are my staff UPN. I loop both but have a timer inbetween pupils so that I dont get throttled (you WILL get throttled otherwise, this is a pretty intensive loop) I have allsorts of checking so that im not re-adding the same staff members all the time. you MUST make sure that the service admin username that you use is also added as a site collection admin! It is a good idea for this script to build up the $profileURL.OnedriveURL and pupilname into a CSV, this can be put on a fileshare so staff can click on the URL for each pupil - makes getting into the pupil ondrive much easier. My script takes over tens hours to run due to the artificial timers between each pupil, it could be tidied up but I run this once per week and have a singular "run this for one pupil" script should we have a new starter that is needed now. As for onboarding teams, I did the following this year - archived old teams, uploaded one set of CSVs, left my script to carry on. No changes to any of my files or scripts. I simply use the single command: Send-CsvFiles -profileName 'PROFILE NAME' -userName 'SERVICEACCOUNT' -csvFolderPath 'CSVPATH' -validate -logPath 'LOGPATH' -useStoredCredentials CSV files are extracted from isams using a script that runs the API, parses it into a CSV.

there are plenty of licenses available. Im not sure how I could push an app that doesnt have enough licenses in either ASM or azure/intune, I wouldnt have thought it would let me? Either way I can see that there are about 80 free licenses for each microsoft app (for "free" apps I usually purchase way more than I need just in case)

OK, I got a lead from someone else who had a similar issue. They pointed me to this blog: https://wetterssource.com/ts-desktop-analytics and this script https://wetterssource.com/ts-desktop-analytics-part2 This is the cause. Previously I had a GPO that used to block telemetry - the GPO had "allow telemetry" set to 0 as a USER property. Whilst my WUFB enforced a setting of 1 for the USER property, this is not reflected in other profiles, only the logged on profile. I needed to run the PS1 script to kill the setting on those hives. this wont be an issue because if that user logs in again that setting will be recreated by the GPO. This is because the census program checks the value of allowtelemetry on all profiles, if it encounters a single 0 then it wont run at all - the enddate reg_sz is not populated and you get an error message. In short, it was cause by other profiles having a telemetry of 0 even though the current user had a telemetry of 1. If the blog goes down then the short answer is change AllowTelemetry to 0 for all users under key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\DataCollection\Users It was enough for me to run C:\WINDOWS\system32\devicecensus.exe and then I could see that registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Census now has a new REG_SZ named EndTime with a date. This was what the error message was complaining about.

I have a couple of test rooms set up for WUFB with a view to killing WSUS in september. WUFB is working fine insofar as the updating side goes, the machines are updating nicely. Even a test non 21H2 upgraded to 21H2 without being prompted. What I am having issues with is the log analytics for about three quarters of the systems. These will not appear in log analytics at all. All the machines are hybrid joined, I used the MS script to get the ball rolling for WUFB. This is the log portion with the error: 2022-08-04T10:17:02 : Info : Start: RunCensus 2022-08-04T10:17:02 : Info : Setting property: FullSync to value 1 at registry key path HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Census to turn on Census FullSync mode 2022-08-04T10:17:02 : Info : Running C:\WINDOWS\system32\devicecensus.exe 2022-08-04T10:17:02 : Error : ErrorCode 51 : RunCensus failed with unexpected exception HResult: -2146233087 ExceptionMessage: Cannot bind parameter 'Date' to the target. Exception setting "Date": "Cannot convert null to type "System.DateTime"." any ideas? My googlefu has failed on this one.

We dont bother locking C: drive down any longer, we use applocker and other GPOs. As for onedrive, I seem to remember there was a way to change the location of onedrive user files, once we had ondrive installed per device (not per user) and set the ondrive file locations to a portion that was redirected, I have a feeling that sorted it for us at the time.

interestingly I checked mine and it is on 2.0.91.0 but autoupgrade *is* on. I'll look at manually upgrading to 2.1.16.0 later...

I have moved to managing our ipads to MEM/intune now. What I am trying to get set up is 365 SSO via https://docs.microsoft.com/en-us/mem/intune/configuration/device-features-configure#single-sign-on-app-extension 1) Apple ID is federated from Azure - AppleID is the azure UPN 2) ipads are enrolled from ASM and enrolled into MEM as shared ipads. 3) Microsoft authenticator is installed. 4) users can log in just fine. First login does prompt our 365 login, then apple prompts for a PIN creation for future profile logons. 5) SSO profile is assigned to the ipads. A dynamic group supports this (profile has been successfully applied on ipad according to the "Device Configuration" page of the ipad.) 6) neither browser going to 365 portal nor installed apps SSO at all, they all prompt for an email address and then password. As a supplementary, is there a way to set an app configuration in the MDM to prepopulate 365 apps with the appleID or email of logged in user? Im guessing this will be an XML config.

Ironically with newer server you might end up with BOSS cards that have fast M2 drives, they tend to hold the OS and could well be the fastest drives in the server. RAID 5 on HDDs give me the heebie jeebies, RAID 5 on SSDs isnt too much of an issue and when they are in warranty you dont care about excessive writes. You dont even need to VEEAM replica, if you are creating a new server then have the server migrate the VMs to the new server for you, you could even keep the old server around as a last-ditch cold hyper-v replica (Im not a fan of hyper-v replica, I have had one fail), however if your disaster recovery strategy is "restore from backup to new iron" rather than "high availability with restore from backup as last resort" then you have nothing to lose. Since this server is a hypervisor then 2022. If you ensure you have free space then you can migrate your guest VMs on whatever schedule you like. As for viability, this seems perfectly normal. Effectively you are creating a new hypervisor, migrating VM locations, decommissioning old hypervisor, migrating guest VM OS.

So I have WUFB working, I have a log analytics solution that I have pinned to a shared dashboard. What I cannot figure out is how to share the log analytics workspace & solution? I can see the buttons and log analytics workspace & solution just fine (I created it) but the technician sees a "blank" button on the shared dashboard and cannot see my solution. Any ideas?

Have you thought about not putting WSUS back and migrating to a WUFB instead? Ive recently taken the plunge and have a couple of IT labs doing WUFB on a test for a few months. So far so good, I intend decommissioning the WSUS by the end of this year. We are W10 though so im not going to have a way of testing a feature update with it.

We have over 8 VMs so DC licensing would be the default for us anyway. Price for 10Tb HA volume and 2 nodes is around £5.5k initially, annual support after the first year is lower around 1.5k. For us this meant not needing the same configuration (we have a pair of R740) as we didnt need BOSS cards, didnt need HBA support (the H740P does now support proper pass through HBA that supports S2D I believe - this wasnt always the case so you needed a real HBA330 plus BOSS card for OS RAID). I also RAID5'd the SSDs on a H740P, whether this is faster than the parity of S2D I cannot say. All flash is overkill for our workload but for an equivalent 10Tb required volume it didnt make sense to have a lot of HDD and an SSD cache opposed to a smaller number of SSD. Paid vs free is down to 1) support. Starwinds will set everything up for you remotely, they will also pre-sale if you wish. The sales guys were also engineers and would technically answer questions and offer network tuning. 2) GUI vs powershell config. Thats is it really. I did set up a "free" starwind HA on a pair of old R610 just to get a feel for it. It was easy to set up with powershell, I made sure I had 3 NIC (1x network, 1x heartbeat, 1x sync), added the IP addresses to a powershell file, added the size of the HA volume I wanted, added the location of the HA volume for both nodes and executed it. That was it really. I could then add this iscsi target to each node as MPIO. Tuned my MPIO failover time (I think the default is 60 seconds) then added a VM to the HA volume before forcefully powering off a starwind node to see if the storage would failover etc. My R740 have 40gb inifibands direct linking (back to back in infiniband parlance) as sync, plus a 1gb heartbeat direct link with 10Gb presenting to the network. I did have a play with an S2D setup. I did need to hack it a bit with some unsupported commands - this was to enable non-raid drives passed from a raid controller (they still presented as raid controller drives even though they werent in a RAID), this was only for a lab setup. The gotcha was with the caching, SSD caching is not necessarily mirrored, you need to run a bit of configuration with nested resiliency, there is also a few tuning commands that will kill the caching should a node fail. This is to stop a cache failure bringing down your system. This also means that performance will fall off a cliff should you have HDD+SSD caching. If you lose a node, you lose SSD caching by design. Starwind isnt much better in some respects as the primary write back caching is RAM only, SSD or NVMe caching is write through only. RAM caching *will* cause a full resync to the affected node should you lose one. Without caching only a fast resync will happen. I believe full resync are rare in S2D but on the otherhand resyncing is not particularly quick either (from my testing). Starwind All flash arrays should be fine without caching, I have disabled caching completely to minimise full resyncs.

Have you considered a starwind 2 node array? This will enable you to have cheaper hardware as you wont need specific S2D compiant options. Balance the hardware vs starwind licensing (you can go free but their support team is very good). Which S2D are you considering? Nested mirror accelerated or just a straight 2 node array? We went with starwind in the end so that we could use RAID on the nodes (for resiliency) and HA for node failure. I wasnt keen on S2D vanilla 2 node resiliency but also wanted to be able to expand to 3 nodes in the future which kicked S2D nested options into touch. I am one of those people who have lived and recovered through storage failure with an MD3220. I have also had replication go bad on me. With a stretch cluster (2x SAN) I had no problem with "one side going down". I wouldnt entertain a non-HA solution these days. HCI is so easy to implement with various options.

Have a scheduled task that forces a reboot at the end of a day. Have the task perform at next opportunity if missed. Advise staff on inset that this is going to happen. Advise SLT that this is to install essential security updates (might as well enforce 2FA while you are at it). If you get kick back from SLT then advise this is to help combat ransomware crypto and all the horrors that will have. Make sure you have a paper trail for someone telling you not to do it. I simply showed our SLT reports of what happens to companies that have their staff account passwords guessed and ransomware on the shared resources etc. That changed their minds and 2FA, compulsory reboots on patch days was mandated.