KK20

Ok, so our music department needs to run ABRSM proctored exams. https://www.abrsm.org/en-gb/music-theory/guidance with requirements https://helpdesk.psionline.com/hc/en-gb/articles/4409608794260-PSI-secure-browser-System-Requirements Looking at their "unsupported" column we are a no-go on both the firewall and the education windows. I am sure it works but if there is a problem with the exam then guess who will get blamed. From the requirements, I am effectively being asked to give students a plain, vanilla, unmonitored (at least by the school) home/professional laptop with unfiltered internet access via a WIFI dongle. We cant use our chromebooks either. For the time being I have bounced this up the line for authorisation but what I can see me needing to do is blank some laptops and drive them through the filtered/firewalled guest WIFI anyway and hope the filters/firewall is happy - this and write a big disclaimer saying that this is unsupported so SLT can authorise it. Any experience with ABRSM? I used PSI plugin years ago with ECDL and it had no issues for us back then.

My opinion. I have been in this situation. 1) Risk assessment. Cover your backside. 2) LTSC 2019 buys you another 4 years. Gotchas? Teams app, make sure that future Office 365 desktop apps are covered in your risk assessment. 3) 8th gen i3 refurbs. Stopgap if necessary. Alternatively, chat with other local schools regarding them getting rid of kit. I knew a local school throwing out 100 stone 8th gen all in ones. They were installing chrome os flex on them and giving them to whoever wanted them. chat with local banks, solicitors firms. You will be amazed that companies PAY to have perfectly decent kit removed, you can even chat with their IT about removing the SSDs and putting cheap ones in yourself, offer to pay for the secure drive disposal. Chat with local hospitals about shredding hard drives, they often have hard drive shredders. welcome to modern IT network management on a budget. 4) Look for another job. Make sure you have a working immutable backup, unfortunately you cannot do this easily in VEEAM community edition but at least wasabi is cheap. At least you can kick all desktops off the network and spool up a full domain restore in VEEAM very quickly if you get breached.

I think the worry came about due to Admins looking at "supported" meaning "can use my EES licensing to put Windows 11 on this i5-9600" but being met with "this is not supported, upgrade your CPU". Rather than "sorry Dell, you can no longer sell Windows 11 on that i5-10400 as we don't support that"

A new year, a new set of pupils not following the instructions for the ipads. Following a pupil forgetting their PIN, usually I reset the ipad using diagnostic mode and a mac. Sending a passcode removal from MDM wont work because WIFI isnt enabled before PIN. I havent been able to share internet from a Mac due to the Mac not being "trusted" (even though I dont have USB restriction in place and the Mac is sharing internet connection). Is there a way to configure a profile with device trust? Or a certificate pairing that would have an ipad trust a particular Mac (so that I can cable internet share which should "listen" to the PIN removal request from MDM?). Anything to save time on entire ipad reset. another thought, even though we have MDM via ASM, can you export an apple configurator 2 "certificate/trust/link" so that I could use a mac with AC2 and its "advanced/remove passcode" facility?

im not missing your point at all. I cannot remember when I last went to ALL my PCs whether supported or not and installed the latest BIOS. UEFI get updated automatically, but BIOS ones do not. I do not have a central BIOS update facility. If I was to learn of an issue and there was no fix then it would be retired.

Same as any other BIOS machine onsite. It will be a risk if there is a known exploit. UEFI get updated via MS updates of course (this has happened on our Dells). I cannot remember a time that I visited 300 machines to update the BIOS to their latest version. I applaud you if that is common practice in your environment.

dkim and its corresponding dmarc policy (assuming you reject) will fix the spoofing. https://learn.microsoft.com/en-us/defender-office-365/email-authentication-dkim-configure make sure the spam intelligence side is also configured https://easydmarc.com/blog/dmarc-and-microsoft/

we have transitioned about 80% of our GPO to intune policies. We are lurching towards serverless onsite. We are currently hybrid. There are a number of ways you can speed things up, ironically this can be scripted in GPO (!!) to get intune to work faster. When I have fully transitioned to autopilot then things get easier since autopilot pulls all the configuration policies before first logon. Anyhoo, a new user policy will take XX amount of time to apply, to see what your machine is doing you need to look at the management log C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log It is big, evil, unreadable but full of information. It generally works with intune IDs (we keep a spreadsheet of the common policies we look for) but also has a lot of test names in there. Use CMTRACE to view them, the search is good and CMTRACE breaks up the log nicely. I dont have the space here to empty my head on how to find things but searching for your policy will yield if it is queued for application, downloading, stalled, ignored, aborted. That gives you some idea of the status for your policy. I have found it is easier to SCRIPT the lot, I no longer use intune policies to affect a change if I can help it. I have a set of master scripts that "do things" either in client logon registry or computer. This is exactly what I used to do back in 1996 with Novell Netware - how the wheel turns. Why script? These seem to reliably work. I have a single policy that affects user logon preferences and another that copies scripts to this "master". Utterly backwards, totally ancient but it works for us. We have start menu, task bar, user software, user settings, lock screen, desktops all sorted through intune. Software is installed from intune apps too with the preferences (mostly computer registry scripts or licence files to be copied) set as a prerequisite. I have toyed with winget scripting but only as a test, it is not suitable for production. Once an intune policy is pulled down, it seems to cache them all locally (similar to GPOs) and they run fine for subsequent alternative logons. Make a change to a policy and it could take a while. Sure fire ways of getting Intune to phone home and apply: 1) manually, hit sync from either company portal or from "settings" (settings->accounts->"access work or school"->"select account"->Info->device actions->sync 2) start the deviceenroller with clientID manually. This is usually a scheduled task but you can manually trigger it. It is in Microsoft->EnterpriseMgmt->-> 3) creating a NEW policy seems to take effect faster than editing an old policy. This is a REAL pain in the backside but it could trigger "please change this setting NOW" policies faster for you. You can go into intune (or powershell script) and "ask" intune to update intune (yes, it is as mad as it sounds, a different application monitors intune requests to the one that goes out to get intune policies). This is a little sporadic. If you arent getting any intune policies, run dsregcmd /status to see if the client is truly registered (hybrid or not, it doesnt matter). In short, Intune takes its merry old time to update but you can prod it along.

right click taskbar I have had no issue with. We dont copy anything to local machine and we have updated our central ADMX. we are migrating our GPO to intune (about 80% there) so our taskbar and start menu modifications are intune policy now. This means scripts, im not sure which one of these gets rid of the icons but its one of them, it also removes it from the lockscreen too. @echo off reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v RotatingLockScreenOverlayEnabled /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v TaskbarAl /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v RotatingLockScreenOverlayEnabled /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v RotatingLockScreenOverlayEnabled /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SystemPaneSuggestionsEnabled /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SoftLandingEnabled /t REG_DWORD /d 0 /f /reg:64 ::taskbar reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowCopilotButton /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarAl /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarAutoHideInTabletMode /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowTaskViewButton /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v ShowTaskViewButtonBingSearchEnabled /t REG_DWORD /d 0 /f /reg:64

yep. Performance is on par with everything else. Its a running joke in our department that it runs just as fast as the W11 machines, it runs word and chrome all day and prints labels for food products. It will be replaced in minutes once it dies but as an experiment it is quite hilarious to see it keep going. It is a tool, it does its job connected to a zebra printer, it has all the up to date patching in LTSC2019 and it logs in quickly. It reboots after patch day and hibernates most of the day. The machine is older than many of the students.

LTSC 2019 works fine on optiplex 760 core 2 duo. Ask me how I know... I can also tell you that according to intune these arent doing too bad with logon and boot up times. IT is a tool, if the tool is still doing its job and you are short on budget then crack on. Older netgear and HP procurve are fairly bulletproof, second hand models tend to have noisy fans though.

We also use applocker as a packaged app on deny without issue. I have the version as * though - the packagename isnt ambiguous so version is irrelevant to me. As per a previous poster, ensure that you havent set applocker to "audit" mode too, you might have been testing.

We have it disabled and we can translate. I looked up the GPO registry location to confirm it was set to disabled on this machine: https://admx.help/?Category=Office2016&Policy=office16.Office.Microsoft.Policies.Windows::L_Sendcustomerdata We have international students who use this so I know it has worked for a long time. This GPO has been set since at least office 2016 for us (365 now). I think "Allow the use of additional optional connected experiences in Office" needs to be enabled though plus "required" diagnostics at least.

I have now. Lets see if that yields a response.

we use cloud drive mapper. It is OK, it does its job but has issues. If you have a lot of libraries and teams then take care with the multi share, this can throw up loads of overwhelming shares for users, CDM also shares the meta folders - some of which users will have access to. If you share individual libraries you will soon run out of drive letters. CDM does not have the capability to blacklist or whitelist libraries that you want to multishare. Users will also build up a fair cache size if you use it a lot, this can cause blocking issues for clients after a time (we have a small script to prune the cache directory making it a little more reliable). Usage wise it works though apart from media files, the media files are not streamed they are downloaded upon use. It is better to use the browser if you plan to use it for lots of media. File locking when renaming can be a little problematic sometimes, renamed files can sometimes be locked necessitating a "copy the file and wait for the original to unlock" as we all know how sharepoint has zero admin ability to force unlock a file. We do use it and (personally) I find it better than onedrive client sync for the majority of time. Apart from the odd renaming issue the changes are live with no need for a sync, collaborative work seems to be more reliable (although technically it shouldnt matter as desktop apps should sort this out independently of how you opened the file). I worry for the future support of CDM, a few years ago there were multiple updates per year, I dont think it has been updated in the last year.

look in the header, where did it originate? Do you have SPF and DKIM set up? DKIM should stop the spoofing mail being seen as legitimate as the sender.

Does anyone have any idea on how you can close and delete Mosyle? I signed up to a free Mosyle account years ago to manage a handful of ipads we had at the time, we stopped using Mosyle some time ago and removed all the Apple tokens. I get quite a bit of junk mail from them nowadays but seemingly no way to edit my preferences (it just comes back and no links in the mails). I cant raise a support ticket because this is a premium feature. There is no support email address and just a "contact us form". Ive filled in a few of these contact forms in the past few weeks and no response from them. I know I can blacklist mosyle from Exchange to get rid of the spam but I have no idea how I can actually shut down my account with them and get them to delete my data. Does anyone know of a contact email address that might yield better results?

if you have VMs, spool up a quick server, promote it, demote the other DC, upgrade the other DC, promote other DC, demote new VM and remove new VM. I would say pointless having two VM DCs, there is some worth to a physical and VM DC. Make sure you have very good backups before you start anything. 4xVMs and 1xtower means you can buy a cheap refurb server from the likes of ETB and run community VEEAM on it for 10 workloads. Then if you screw up you can be up and running again quickly. Anyway, if you already have VMs then you can also backup your existing setup, shut it down and leave it as cold store, bare metal restore to new server (this tests your restores nicely!), then look at inplace upgrading.

This has rolled out to us although I already had a 100Gb limit on onedrive (mainly so people don't decide to sync their phones so I have to pay to back up their stuff unnecessarily). We dont have A3 but we do have apps for faculty and pupils. What I *did*notice is that in the storage report I have reports for accounts I deleted years ago, our retention is 30 days (plus the hidden 93 days) so I have zero idea why these accounts are still hanging around. The users are long gone, no hint of any of them in active users, sharepoint user profiles, deleted users etc. Our measly 5Tb tenant isnt even scratching the surface of the storage so it isnt a problem but still, i'd love to find out how this set of deleted user Onedrive data is still here (with seemingly no user accounts)

not as good. The *ONLY* reason is cost, pure and simple, it will never be faster due to MS throttling, it will never be as robust as a cloud provider, it will never be as secure as a true immutable backup. If I had the budget and money then yes I would jump on a cloud solution. I would use VEEAM and backup to a cloud provider with immutable buckets. Unfortunately I dont and cant.

using same screen as before, I select onedrive from service, I can select top level "all" or individual files then restore. same choices as before - to a new folder, overwrite existing or skip existing. This was through activebackup. Not sure why you would ever use filestation as the destination is 365land It should note that there is a timeline screen at the bottom where you can select different backups for older file versions should you so wish. The screen can get fiddly because you need to juggle 1) what do you want to restore? Mail, onedrive, sharepoint, teams. 2) who do you want to restore or what context (i.e. not everyone can access every sharepoint library or team for example) 3) when. Generally ensure you select a user with more rights if you want to restore a full library (!why you would do this is beyond me though!) or a specific team (a restore for a pupil may not be the same as a restore from the owner etc. Use an admin context if you want a verbatim restore etc).

Ive just gone into activebackup restore, selected a test account, gone to onedrive and mail, selected service mail, under restore I have the option to restore files or "entire mailbox". If I click entire mailbox I get the option to restore entire mailbox to a new folder, original folders but overwrite existing or original folder skip existing. It took 1:40 seconds to restore 822 emails totalling 307.7Mb, I restore to a new folder and the email plus structure was in the folder. Downside, I couldnt rename the folder before restoring, it was named "restore_20240510_162623"

They are so cheap you could buy TWO boxes cheaper than licensing for one year of alternatives. Put them in different buildings. Ours lives in the exam office room, this room is safer than the server room.

homebrew PS scripts. MIS creation then a couple of scheduled scripts to create account based on MIS data, random password is emailed to form tutor and me, link 365 email (we are hybrid although offsite 365 email), update pupil ondrive collection admin, update sharepoint CSV with pupil onedrive links for staff. Overnight the secondary WONDE stuff happens to our 3rd party, VLE and papercut emails a printer code. Staff and "unknowns" password is emailed to me alone. All hands off.

MP3 capable dictaphones. Files get renamed after the exams. The microphones are good quality and they just work. It could be argued that teachers are not responsible for setting up equipment for external exams. That buck stops with the IT department in our school, we get given the specs and timetables for exams, special requirements of equipment etc. We set up the dictaphones, laptops, enable exam logons etc.