KK20

downgrade: settings -> Wonde licensing. It seems to be pretty shady having an "opt out" sudden charge. We only use WONDE because Century do the onboarding with them.

I have run two host clusters (with quorum) for years, hosts (and quorum) are even in different buildings. You can set "sites" for each and configure that if one is isolated (from host and quorum) it will gracefully shutdown leaving the other site as master. Powershell will let you bring this site up and set as master if the primary site fails AND the interlink AND the quorum fails - thus avoiding split brain. It works too. We had a power failure in primary site once, I set the second site to master so that PCs in the second site could continue working, primary site came back on this was set to secondary, sync completed and I returned primary back. Downtime on secondary was about 15 minutes, primary downtime was zero once the power came back (sync'd back in an hour or so in the background). I have added hosts to our cluster, I was upgrading our physical boxes and storage. This was a two step procedure as I was also moving storage. I set up new storage and nodes, joined the new nodes to the cluster, added the new CSVs (lots of redirected mode), moved the VM storage locations as appropriate, removed the old nodes.

We migrated everyone to using OpenShot in the end. This worked well on Windows 11 machines and a few legacy 10 that we have.

We have inherited a number of IFE boards. These came to us "as is" and work well enough as interactive panels plugged into laptops. However, these boards apparently support account management software. The vestel website seems to be hell bent on giving me the least possible information on anything . Have anyone used the vestel AMS? Im guessing it is as useless as the optoma OMS system (given the lack of information) but i'm a curious person and would like to see what it does. how can you get to this Vestel cloud management system?

Our autopilot AAD (I should really get round to calling it Entra) only devices connect just fine to our onsite services. Yes Intune can do this without issue, you need to have a hybrid system with writeback in place but the AD resources are happy to accept AAD azure tokens for onsite services. Here is the MS document on how to ensure it works. https://learn.microsoft.com/en-us/entra/identity/devices/device-sso-to-on-premises-resources Our teachers still have a couple of onsite fileservers (as well as onedrive and sharepoint). So I have a shortcut to the onsite fileserver for when they either VPN in or are onsite. SSO works throughout even though the devices do not appear in the onsite AD. You can see the ticket using the usual dsregcmd /status command

I cannot say. This is a screenshot of my GPO and a copy/paste of the data. plus a copy of the XML for the taskbar (if you wanted pre pinned on the taskbar as well as the start menu), I copy the XML locally and do not use network files, this prevents file locking. JSON: {"pinnedList":[{"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Microsoft Edge.lnk"}, {"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Word.lnk"}, {"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Excel.lnk"}, {"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\PowerPoint.lnk"}, {"packagedAppId":"windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel"}, {"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\OneNote.lnk"}, {"desktopAppLink":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\File Explorer.lnk"}, {"desktopAppLink":"%ALLUSERSPROFILE%\\Microsoft\\Windows\\Start Menu\\Programs\\Outlook.lnk"}]} XML for taskbar xmlns="http://schemas.microsoft.com/Start/2014/LayoutModification" xmlns:defaultlayout="http://schemas.microsoft.com/Start/2014/FullDefaultLayout" xmlns:start="http://schemas.microsoft.com/Start/2014/StartLayout" xmlns:taskbar="http://schemas.microsoft.com/Start/2014/TaskbarLayout" Version="1"> note. The XML must be saved as UTF-8, take care if you use notepad++. Dont forget you update your WMI filters if you have them, we use a W11 and W10 for different start policies. Incidentally I have moved the above registry change to intune now. I create GPO first as intune is shockingly slow at applying so whilst I am testing I create a GPO (then move to intune once I know it works!).

I wonder if they get the disable autolaunch setting sorted properly this time.

We have a simple sstart menu GPO for W11. On a W11 where you are happy with the pins, Export-StartLayout to get the JSON file. Then create a GPO that adds reg key: HKLM\SOFTWARE\Microsoft\PolicyManager\current\device\Start\ConfigureStartPins and have the reg_sz be the contents of the JSON. I dont copy any files, just this single reg entry. I also have a user GPO do a few more things in HKCU such as get rid of lock screen adverts, align the task bar to the left, change the search bar to an icon, remove copilot button etc.

If you use WUFB but have PCs booting legacy that are otherwise hardware compatible (pretty much all of our 8th gen) then these will list as not compatible, yet they are hardware compatible (once you switch to UEFI)

do whatever the policy says. If you do not have a policy then get your senior leadership to create one. Otherwise if it is a free for all and you are unhappy then bring it up with your school data controller. We restrict, only the SLT, site manager, me (since I have admin access), safeguarding DSL have access. There is a manual activity log for data extraction that is filled in, there isnt one for viewing.

a couple of gotchas on LTSC, if you use intune and roll out MS store apps then this wont work on LTSC. You can easily get the store back (its a simple as wsreset -i and waiting) and you can also easily install winget via a single command but neither will trigger the ability to install store apps via intune. You can still use winget to manually install or you can repackage the appx bundle and install via a win32 package. Edge will need to be installed manually on 2019 as it will come with IE out of the box. There are also TLS issues with the base LTSC that you will need to address or else you wont be able to download from a few repositories. Chocolatey works on LTSC, office 365 does, onedrive does etc. Not ideal but for machines that wont run windows 11 it is a reasonable solution until you can upgrade. Our fleet will be 75% there, we have already moved to windows 11 but do have a chunk on LTSC. we are migrating to 1:1 devices so these wont be replaced.

we use nutty about hosting. They accept school purchase orders and direct debits too. Very useful if you dont have a school credit card. I seem to remember contacting them directly for the .sch.uk as that couldnt be done online with the rest of our other domains.

Indeed, I do something similar. I was more wondering what others do. I too found that user WIN32 installations were too slow and unpredictable for items that were needed on logon. At least with system WIN32 you can white glove/pre provision.

For people who dont use this method or scheduled task etc, I am curious as to how you perform user registry settings etc that you would like to apply or reapply per logon (perhaps you dont want people messing with user acrobat settings etc). I am aware that if you have the licensing you can use remediation.

We used to use built in SSTP VPN on our regular domain laptops, it was a bit flaky but worked well enough for staff. This was a traditional redirected documents to a server share plus onsite shared drives. We then transitioned to sharepoint libraries for our onsite shared drive folders. Onsite documents transitioned to onedrive. finally, the onsite domain controlled PCs moved to autopilot plus intune (endpoint) with no GPO or onsite AD presence. The last part involved much pain and suffering to set up as it was all done with zero consultation budget (therefore just me), however it now works. This took 3 years from start to finish, each step took one year. We are now looking at moving away from onsite AD completely.

If budget is a restriction, synology 365 backup works well enough. You are thrashing your internet connection for 3 days whilst 5Tb of data is downloaded and it all seems a bit backwards in the scheme of cloud these days but you can spool a 20Tb synology box up for £1k which is much less than veeam licensing for one year. Recovery does work, even for granular individual emails. Veeam community can handle 10 workloads for free but will not support S3 buckets in the free tier - you will need to pony up for proper licensing for your offsite storage. Wasabi is cheap and works well, especially for immutable buckets.

We use surface GO, I created a new update ring and away Intune went. Seems to work for us.

you can exclude policies. Much in the same way as a GPO with loopback processing - think of intune "assignments" as always having loopback processing enabled, a group in intune can consist of users or devices. So you could have configuration profile targeting a device group but excluding "priviledge users". Then another configuration profile targeting the same device group but excluding non privilege users etc. For installations though, be careful about the context of system/user and remember that WIN32 is exactly that, a 32 bit installation process with all that entails (WOW6432 nodes as default, program files x86 etc. Not a problem but be mindful). If you arent hybrid, dont forget NTP (like I did). I originally tried to import GPO and tweak but the import is a train wreck - there are limited crossovers and a lot of deprecated and "suggested" transfers - dont take that 100% compatible GPO->Intune import as gospel, make sure you read what it has transferred and what it has SUGGESTED as a compatible option! It was a painstaking approach but in the end I recreated my configuration profiles from scratch. Expect lots of pain and suffering if you use a lot of registry edits. You can import ADMX though to mitigate registry edits somewhat. /forums/o-s-deployment/236715-dragged-kicking-screaming-into-windows-11-era-short-tale.html

We do this in intune, I find it easier to have the lockscreen JPG on the machine itself. I create a SYSTEM WIN32 package containing my lockscreen.jpg and a batch file. This is the batch file: @echo off xcopy %~dp0lockscreen.jpg "C:\windows\web\screen\" /C /Q /H /R /Y reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP" /v LockScreenImagePath /t REG_SZ /d "C:\windows\web\screen\lockscreen.jpg" /f /reg:64 reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP" /v LockScreenImageUrl /t REG_SZ /d "file:///C:\windows\web\screen\lockscreen.jpg" /f /reg:64 reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\PersonalizationCSP" /v LockScreenImageStatus /t REG_DWORD /d 0 /f /reg:64 detection rule consists of file check and reg keys. For the lockscreen settings this is a USER WIN32 - just a batch file (this has a couple of extras you dont need such as start menu button moving to the left and I set an initial lilac background): @echo off reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v NOC_GLOBAL_SETTING_ALLOW_TOASTS_ABOVE_LOCK /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v RotatingLockScreenOverlayEnabled /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Notifications\Settings" /v TaskbarAl /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v RotatingLockScreenOverlayEnabled /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v RotatingLockScreenOverlayEnabled /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338387Enabled" /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v "SubscribedContent-338389Enabled" /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SystemPaneSuggestionsEnabled /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\ContentDeliveryManager" /v SoftLandingEnabled /t REG_DWORD /d 0 /f /reg:64 ::taskbar reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowCopilotButton /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarAl /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v TaskbarAutoHideInTabletMode /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowTaskViewButton /t REG_DWORD /d 0 /f /reg:64 reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search" /v ShowTaskViewButtonBingSearchEnabled /t REG_DWORD /d 0 /f /reg:64 ::set single colour background (lilac) reg add "HKCU\Control Panel\Colors" /v "Background" /t REG_SZ /d "204 197 252" /f /reg:64 reg add "HKCU\Control Panel\Desktop" /v "Wallpaper" /t REG_SZ /d "" /f /reg:64

Set WshShell = WScript.CreateObject("WScript.Shell") strDesktop = WshShell.SpecialFolders("Desktop") Set oShellLink = WshShell.CreateShortcut(strDesktop & "\google_homepage.lnk") oShellLink.TargetPath = "https://www.google.co.uk" oShellLink.IconLocation = "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe, 0" oShellLink.Description = "Google Homepage" oShellLink.Save Good old VBS script. Package as a WIN32 and install as user with a detection based on your filename. I detest doing this backwards scripting but in the end this is where we are at. What ive actually done is create a SYSTEM WIN32 app that installs a scheduled task, the scheduled task runs a master batch file upon user logon. This batch file is updated when I need to run more hacky fixes under a user context. Since it is a system install these can be pre provisioned so everything works straight off the bat.

I did a veeam backup restore when I needed to resize. The downside is that this is an "offline" change.

I have not observed the above, we use dynamic groups for our autopilot device IDs, as an extra heap of janky mess I also script our hybrid onsite AD into device groups! So our OUs are replicated via script into AAD (which get written back in a perverse twist), this lets me replicate our GPO software deployment via intune group deployment. Once we transition fully out of hybrid I can continue with the 365 pseudo OU groups. We do preprovision though, this installs everything immediately. Error reporting is horrible, however collecting the extension logs can be fruitful (providing you are happy scrolling through CMtrace screens). With intune everything takes hours, not minutes. No gpupdate /force in a batch file, no group policy modeling or results, no gpresult. Test, test and test again with intune. It does work but I find it to be a massive backwards step compared to GPOs.

fun problem of the week, or rather a rookie mistake by me this week. I needed to push a registry change to clients, so I spooled up a simple batch file with a bunch of REG ADD and REG DELETE in there (remembering to /reg:64 - yes I know I can "sysnative" but this is equally effective and saves me typing a longer string in the intune portion). WIN32 app deployed all seemed to be good, clients were reporting success and the registry changes could be observed. All good till I needed to wipe a laptop that was going to a new person, the wipe happened, all booted up, ran preprovision and FAIL! 0x80070001 a useless autopilot error code that could mean anything but generally means something didnt install in time (i.e. tried 3 times and failed). My favourite go to script Get-AutopilotDiagnosticsCommunity -online will generally tell you what has gone wrong - it saves wading through the huge extension log. Sure enough my new registry file was failing to install. this made no sense as regedit showed me that it DID "install" as the registry changes were present. Looking through the extension log I saw [Win32App] lpExitCode 1 and realised what I had done: Batch files have %errorlevel% which is passed back to the intune installer - it expects a 0 as success. My batch file started with a few REG ADD but ended with REG DELETE - the last one did not exist so effectively the final %errorlevel% was a fail or 1. Reshuffled so that the delete are first and the add last fixed all. Moral of the story, dont forget your %errorlevel% in batch files.

anything you can post public? No harm in learning from other people (for various scenarios).

we were told that we could install on PCS that are connected to hardware and use it with the hardware (i.e. interactive panel or promethean board/projector and teach). we could also install it on other PCs to prepare only, i.e. not use a Vestel touch panel with activeinspire to teach, only to prepare the materials. We moved to openboard a long time ago.