KK20

yes, a domain CA is quite useful. Do you run powershell scripts at startup? Then think about "signing them" from your a Domain CA issued "code signing" certificate too, then you can harden script execution policies on your domain. Do you use WIFI for your domain devices with a "known to you password"? Move to radius and 802.1x with a domain CA machine certificate so no more WIFI passwords. Want to run a guest network portal with something like OPNsense (good for linking devices to school email and voucher codes for real guests)? letsencrypt and acme can do this so your guests dont need to install your domain CA cert. If you use papercut mobile printing for guests, it is best to look at a letsencrypt for this, i recommend "win-acme" for windows servers and letsencrypt certs. You will need a public IP pointing back to the win-acme running server. Dont worry, you can use your internal DNS to do some directing inside your network for internal clients.

gpresult will give you the same answers as the GPO management -> Group Policy Results page. AFAIK (cannot find the source) both read the registry for policies that applied or had an error. Neither actually check the resultant registry settings themselves. So if a policy is applied then both reports will say "yes, I have applied this policy" whatever the policy is. The same as GPO modelling, this will show what policies should apply but as Psydii says, having a GPO with "Not configured" will not necessarily reverse a previous enabled/disabled/setting. One example that springs to mind for me is application control policies and the older software restriction policies - these can easily leave stale/unintended settings. Modelling is nice as it should show what will take priority - if at all. Results should show you which policies did apply (or not), but then If you must know an actual value "now" then the only way I know is a script running to export the values from the registry.

I'm not 100% sure I have read what you are doing correctly. Are you creating a brand new domain, or are you promoting a new DC then changing the IP later? You can just add an additional IP if you like, even add a dns entry for the old server too (make sure you have demoted the old DC and shut it down first of course!)

You have a the option of redirecting appdata. Before you get excited, this will only redirect "%appdata%\roaming" so not the big hitter \local dont try to use the registry bodges to redirect \local it will end in pain. Plus you cant redirect the onedrive cache folder either so dont try that (even with custom locations) it simply isnt supported and wont work (no you cant use tricks such as symbolic links either, they arent supported by onedrive either). You can also redirect downloads too. Note that both of these will still work with known folder redirection enabled for onedrive. Failing that, look at FSlogix, in a nutshell that redirects all the profile to a network share (this is a very simplified explanation of what it does). You might be licensed to use it and will solve "large profile" issues since they will be stored on a network server.

we migrated staff and student to onedrive using purely MS tools. It was a little slow but fairly painless. We started with redirected desktop and documents set via GPO. paths were of the variety \\fileserver\students\desktops\%username%\ and \\fileserver\students\documents\%username%\ staff were migrated with the OLD "executable" migration tool. This is no longer relevant. Students were migrated with the new online migration manager + agents. Migration manager in sharepoint admin had two agents installed. The template CSV was fairly simple but has a few purposeful blank columns, keep these. Created a small powershell script to create the CSV with source and destination columns for OUs of my choosing. I did not migrate everyone at once, by sub year groups approx 50 a time. Ended up with a CSV of 6 columns, ServerShare-> "true local path for each user" Blank1 Blank2 OnedriveURL-> "https:<tenant>-my.sharepoint.com/personal/user_with_tenant" ShareType->"Documents" Blank3 Created a migration job for the CSV and left it running. Repeated CSV for the other sub year groups till I had done a full "first" migration. Ran a delta update for my sub year groups at the same time (this was much quicker) Switched my GPOs to KFM from redirect. Users were happy remedial work: Enabled a remedial "home drive" to a new network share. This was for particular students who create very large media presentations and video editing. The onedrive sync was too onerous. Done on a case by case basis as not many pupils do the media course Onedrive script runs to add a staff group as sitecollectionadmin to student onedrives, this also pre sets up onedrive (if not already used) thus stopping any other issues with new students who have yet to logon and use onedrive. We had certain staff able to edit pupil documents. Onedrive needs a different permission to do this. The same script also uploads a CSV with "https:<tenant>-my.sharepoint.com/personal/user_with_tenant" to a sharepoint document library folder so that the relevant staff can open the csv and access the pupil onedrive URL easily. I use azure application with certificate permissions to execute the scripts on a server. other notes: I have exam logons that have redirected desktops. KFM still works with a redirected desktop if your GPO doesnt select desktop in the KFM. Sync happens just fine. The first migration sync took a long time but the deltas were quick. KFM just worked. We already had onedrive access working. Our machines are hybrid joined AD.

You can create additional domain CA templates for longer duration code signing certificates. That's what I do. You may need to extend the domain CA default validity period in order for the longer certificates to take effect. Obviously make sure you have a way of revoking them if you plan to create 10 year certificates! for intune, I have looked into cloud PKI in the past, microsoft cloud PKI is now a thing but it is an expensive intune addon, not sure if there is an education cheap intune addon license though.

my "guess" and its only a guess is that the reason I lost access was because the transfer didnt have my credentials on it. Plus you would also need the encryption key too. I have gained fresh access to the account and testing recovery key now (there are backups from the last few days when it has been recovered without data - servers and 365 have started backing up without my intervention).

Without a doubt. The inference on this is that potentially someone else has lost an account too - a transfer has happened.

Update. After a teams call with Redstor and the MSP it seems that the wrong account was migrated to us as part of the MSP->MSP transfer with Redstor, my credentials were removed so I couldn't log into the migrated account. Crucially my real account, will all its data and archives, has been hard deleted. Take what you will of this. I will no longer be using that MSP nor Redstor. Back to VEEAM and Wasabi et al next year.

Ive been using FOG for years. It works really well if you need to do things in scale, can be cumbersome for one or two devices. If you have switches and infrastructure that supports multicast then you can have an entire room from wake on LAN to CTRL-ALT-DEL in under 30 mins all from the comfort of your office. You still need to create those mystical "golden images" but if you have a new creative cloud 20gig package, it is much quicker for me to build a new image and multicast it to machines. What surprised me most is that Intune doesnt barf and create multiple entries for machines after imaging, it does take a while for LAPS to update though, a good hour usually. Intune software installs are quite slow to pick up too (24 hours sometimes) If you need to image laptops or desktops with no LAN card than you can build a USB boot stick to liaise with FOG (there is a WIKI article on how to do this), yes you can build a lightweight linux stick with WIFI drivers, but this more of a pain than it is worth, it is easier to just plug in a USB NIC and use that instead (faster too, most of the WIFI drivers I added to the lightweight linux ended up with much lower throughput). The USB method is not as turnkey though. I would certainly think more along the lines of OSDcloud though, if only because more and more machines are eschewing LAN. (we are taking a different approach and using more and more chromebooks)

This should have been a simple exercise. Redstor renewal, incumbent more expensive, switch MSP. MSP knows the existing redstor account details all should switch over. Then we lose access to redstor when old contract date ends. Redstor support say all our admin accounts have been removed from the account (the account still exists and has data) but they cannot add users - only the new MSP can. New MSP says Redstor needs to add access as they cannot. Im now stuck in support limbo, both sides pointing the finger to the other. Im getting twitchy that I have no access (luckily I have other backups for recent disaster recovery but Redstor is my longer archive). Any Redstor MSPs here that can prod me into "what to say to who" in order to get one side fixing my issue?

just a note that I do this with lenovo docks on lenovo laptops. The laptops have small screens and mirror to larger desktop screens, plus a larger pupil display panel. It either works well or gets really confused and screws up. This is single USB-C and was supposed to be an easy fix. For some people we have a long USB-c going into the panels (extend) and a HDMI for the mirror display. This then screws up the sound output sometimes. Cant win 'em all.

yes is does. click the APPS on the bottom left (just above your name) then ALL APPS and you get all the apps up, the same as the old screen. If you are an admin, you get "Admin" under "all apps". If you want to pin from a staff or pupil homepage (we have it on our sharepoint pages) then Apps | M365 Copilot

If you have a licensed 365 logon, you can go to portal.office.com, log on, click APPS then "all apps" and there in an "install apps" button in the top right anyway, you dont need to supply anyone with an ISO or executable, they can service this themselves. Plus a user can go the same website and access anything else they normally can with their logon. Unless you use conditional access or similar.

I posted something similar in another thread, I use gMSA instead of traditional scheduled task privileged users. Takes the headache out of password rotation.

look at your use case. We use .NET2 as a simple entry system and as a control to the lifts. It is NOT used as a primary security feature in our school. The classrooms and doors are closed at certain times, lifts are only used by those with passes, year groups can open certain doors and other year groups cannot. This is purely as an operational setup (obviously person with card A can open and wedge a door etc). The fire alarm is built in to the system too. We use MIFARE cheap cards, these double up with papercut and inventry. All syncd from 365. Issues? None really, other than the cost of the .NET2 hardware it pretty much works. Reboot the controller occasionally, but im talking once or twice a year - we only figure this out when a new issue card hasnt propagated fully. We find the lanyards and card holders to be the weak link in the system rather than the cards themselves.

old post, but consider using gMSA instead of traditional scheduled task privileged users. Takes the headache out of password rotation.

Yep I get "The DNS server at this IP address does not provide domain name service answering client queries. It should not be used for normal client-based resolution" which is odd because I have the local DNS servers set on this machine at the moment and it is quite obviously working.... I removed all the default leaving on the local system servers.

lets say you have v10 10.10.0.0/16 v20 10.20.0.0/16 v30 10.30.0.0/16 with a DHCP server on 10.10.1.1 if you tell your router to add a DHCP HELPER on v20 and v30 (wont need one on v10 as the client will never ask the router to route since it is on the same subnet) of address 10.10.1.1 then a client connecting on 10.30.0.0 sending a DHCPDISCOVER will hit the router, the router will send this to the helper address alongwith the subnet information that it has come from. As long as the DHCP server has a valid pool for that subnet then it will send a DHCPOFFER response back to the routerwhich passes this back to the client on the other vlan 30,. The router will handle all the routing - your 10.10.1.1 does not need to be tagged on the v20 nor v30.

I have a Unifi EFG and yes I use PXE with DHCP option 66/67 I use a windows failover DHCP server though, no DHCP in the unifi or switches. top of rack switch is the vlan router with ACLs, last hop is the EFG so probably not what you are looking for. However, I just set DHCP helpers on my relevant VLANS and it all works as expected. You havent set up DHCP guarding in the unifi have you? Or dhcp snooping somewhere with a different IP to your new gateway (if any IPs have changed)? If the unifi isnt DHCPing for you then I would just have set up the DHCP relay on the relevant vlans.

With DC (or STD) you are licensing the virtual operating systems with DC not the hypervisor software, crack on! It just so happens that with the DC you can also run server 20xx on your host too if you so wish. There is also the "newer license per vOSE" now , this has different rules based on the cores allocated to the vOSE and ignores the total host cores completely (and doesnt license the host). Ive not priced this up so have no idea how competitive it is vs DC. I imagine for the price DC is for schools, not so much, unless you have hosts with mega core count!

this is what I did. I had a user that was "known" to the radius server. this user has zero privs and is used purely to authenticate between google and radius. Export the trusted CA that gave the radius server its certificate. Then in google admin make sure you add the certificate exported above, then I set up a device WIFI profile that connected automatically, gave the WPA enterprise PEAP with the username and password known to the radius server, used the trusted CA cert. This means that the device will authenticated to the radius server with the known user and give you WIFI before you log on. Yoou can remove the old WPA2 personal wifi profile once you are happy. If you need radius accounting with actual users (we dont care) you can create another user WIFI profile and I believe this will override the device profile once you have logged in. Obviously chicken and egg means you still need a device profile for the pre-logon page.

For our chromebooks. AD Have a low level account with minimal/zero privs. Add this user to a specific group. Radius Have a connection policy that accepts member of the group created above as authorised. Google Admin side: Device managed WIFI as a WPA2 802.1x enterprise, PEAP, add the inner user as the low level account. Make sure the domain CA certificate is selected (and installed on the chromebook, we do this alongside our securly certificate - also clears using our internal web pages that get certs from the domain CA too) Thats it. Radius accounting will show the connecting user as the low level account but will at least show the mac address of the chromebook. I know of other schools have a separate USER managed wifi that used the logged on user to essentially reconnect after the user logs onto the chromebook. so the device profile will authenticate 802.1x via the low level account as a device, then reconnect as a user when logged in using those credentials. I didnt see the point personally so didnt implement.

September started process, January go-live, coinciding with inset training (for the masses, key people were already onboard beforehand). Then we decommissioned SIMS in time for April renewal.

[email protected] has 365 licensing which allow up to five devices licenses. So when [email protected] logs on, it will check the computer hash with MS to see if that device with user [email protected] is licensed and decrement from the original 5 when it creates and stores a new hash. You can see which devices are currently in use by clicking on "view account" and devices for [email protected]) it should also give you the licensing. If [email protected] logs onto the very same pc then word will check if [email protected] has a license and if so how many PCs [email protected] is allowed to use. [email protected] is not the same as [email protected] In your case, [email protected] will not be licensed at all, however [email protected] will be. There are licenses that cover the "Device-based licensing for Microsoft 365 Apps for enterprise" regardless of who logs on, but these are big enterprise licenses for lots of users. Office 365 needs to be installed slightly differently to take this into account. Domestic 365 licenses are for single email addresses (or family licenses with I think 5 users) Now it you log onto a PC using a non-microsoft account then word will ask which microsoft account to use and technically speaking [email protected] can be used to log into word and technically speaking the PC should be the same. However, "you" purchased the license and "you" are not "them" who is logged in, so also technically speaking "they" should purchase a license.