KK20

This is not a small undertaking. I assume you have no presence in 365 at the moment. I also assume that by "free" the management will be expecting you and your team to perform the migration. The first thing I would do is compare teams to google education, the two are not the same and this might be enough to torpedo the idea. The second is decide what devices you are running on, remembering that mobile apps are not as feature rich as desktop apps (we use a mix of ipads and surface go's and there is a marked difference between the two). Free A1 licensing will have enough for your browser based online functionality but no app based installations. If you have a fleet of chromebooks then you can continue to coexist and still use google admin to "MDM" your chromebooks.

The evict and in place is quite easy, and it does work. The only gotcha is to look for updated drivers. I havent found any changes for our dell stuff on 2019 to 2022 but there was when we moved to 2019.

Entra only device in a hybrid environment, install entra connect. If you use FIDO2 keys you need to add some additional parts (I had already done this as we use FIDO2 keys for our 4 and 5 year olds - much easier than getting them to type their names! They are handed out and handed back after their IT lessons, well worth the hour the teaching assistants do at the start of the year registering each FIDO for new intake.): https://learn.microsoft.com/en-us/entra/identity/devices/device-sso-to-on-premises-resources Not all are 1:1 (some are, some arent), people log out and log in as necessary "primary user" is the first logon, we use a "deploymentuser" account - a regular account for shared machines to register and get out of the OOBE, after that you can log in as "other user" or log out as necessary the same as any normal PC of old. Im not sure what you mean by filtering. 365 SSO works as expected, we use securly suite and that picks up whatever user has logged on, as does our watchguard. I have kept our "new" devices as pure cloud entra registered only. DSREGCMD /STATUS shows only AzureAdJoined as YES bu OnPremTgt is also YES %username% is populated correctly and there are no popups or credential issues with \\profileserver\documents_share\%username%\documents for example. I note you say sibelius, yes we also have a license server and that worked without tweaking but only onsite (for obvious reasons). I am trying to get an always on VPN running but that has proved elusive for the time being. I can certainly add a manual VPN without issue. this is very common with MS products, if you initially install something without EN-US then you hit problems later, this used to be a massive problem with SQL server. You always installed EN-US and worried about the proper language later. It seems that OOBE can do this too, once you get past the OOBE then an EN-GB keyboard configuration profile fixes everything. Of course the user gets an @ on the 2 key for their OOBE...

Only a couple of sources. Microsoft mainly, they have an excellent set of how to guides - I didnt watch a single video. I did google originally but there was a lot of Windows 10 guides plus out of date material. Microsoft also have huge grids of CSP and their licensing. Luckily some of these also have registry entries so you can ignore the CSP. For registry hacks I used my own knowledge, most of this hasnt changed since windows 10 (setting background colours is still HKEY_CURRENT_USER\Control Panel\Colors wallpaper is still HKEY_CURRENT_USER\Control Panel\Desktop etc). It is very easy to set up, this is because there are not a lot of ways of doing things so there are only a few places you add configurations. Even so, Intune doesnt make it easy. For example, if you want to do the following: Set the start button to the left :-) Change search bar to an icon only Remove copilot button Pin office apps to the quick start menu Pin chrome to the taskbar Change lockscreen and logon screen to a corporate background remove adverts and "search insights" on lockscreen in the old days all the above could be done in a single GPO except you needed an XML for the taskbar and start menu layout. Roll onto intune: 1) You can create a single frankenregistry batch file to do the lot. Encompass this into a WIN32 app using your intimate friend intunewinapputil.exe and assign to groups. This is actually the neater option! Plus the largest pain to keep up to date. Reports on "app installations" is very good so you can also track which machines have them and status of "installation". 2) Create TWO configuration profiles and one WIN32 app - this is because not all the settings are exposed to CSP, plus desktop wallpaper and lockscreen CSP will not work with pro version whereas registry will. Why two configuration profiles? Because one is a "settings catalog" and one is a custom URI. You cannot mix the two in one profile so two profiles it is. Configuration profiles do not have quite the same reporting granularity of installations but you can still see where the system is up to. Other oddities abound so far. If I set the keyboard to be UK on the OOBE then the pens will not activate handwriting in word. I need to set as US and then have a policy to set as UK. This is the only way I can get a UK keyboard with "@ in the correct place AND have ink to handwriting "draw pen" available. Whether that is an OOBE, intune or general MS problem (or even a surface problem) I do not know. Yeah, we have literally hundreds. I logged on as one of each "user class" we have (primary, secondary, VI, staff, admin) and ran a results wizard, started at the top setting, copied to a spreadsheet, made common profiles and settings first, then tweaked individuals. Soul destroying but at least I only have to do this once. The REAL test was getting those settings to work onsite in place of GPOS! One thing I did forget, we still have onsite documents with GPO redirection. Despite having quotas screwed down and onedrive being the default, the machines do have a script that creates a shortcut on the desktop to their own documents folders. Users grumble but im not even contemplating mapping something to this ancient resource that I want to get rid of.

So. I have finally started dragging my network into the new age. Gone our our last Optiplex 760 (!!), 7010 and 7020. We now have 75% capable of running Windows 11. Thats a good enough tipping point. Out with full fat images deployed with FOG and in with autopilot and intune. We already utilised intune for our ipads and we had a few policies for desktops as a proof of concept, but even though we are hybrid everything relied on GPO. Let the pain begin! Take stock. We already use onedrive, filtering/monitoring is cloud based, papercut has mobility print and print deploy working already. AV is cloud based too. Hybrid works and we have a parity of 365 groups and OUs. 365 SSO works throughout and windows hello also works. A few test W32 packages install software for onsite machines and there are a few device policies too (with MDM win over GPO set). Autopilot is fairly easy to set up. I will be manually importing HWID and have a script already reporting these back for our onsite devices that are W11 capable. dynamic groups have been set up to leverage our Autopilot devices, I will initially roll things out slowly to avoid collapsing our internet. Microsoft connected cache will be empty at the moment. start the painful process of migrating our GPOs to comparable policies. ADMX import is a nice feature for chrome and adobe etc. GPO import is useless. For lightweight simply GPO it might be fine, dont even think about trying to import Chrome settings (Intune will helpfully migrate these to edge settings) Registry editing is a lesson in pain and suffering. Sweet jesus they couldnt have made it harder. I use WIN32 packages and good old batch files (quicker deployment and execution than PS1 files with my testing over the hundreds of machines). LoB and WIN32 will cause whiteglove pre provision errors. LoB and WIN32 will operate async so you can get msiexec trying to run simultaneously with errors. I have removed all the LoB installers and repackaged everything as WIN32 and msiexec command. WIN32 is that, x86. Dont forget to /reg:64 or sysnative as appropriate. You will get registry ooopsies otherwise. Intune is a lesson in patience, make a change - wait. change a file - wait. Deployments are not instantaneous dependency chains are the only way to get a semblance of execution order. The longer the chain the greater chance of failure. I only have a couple such as "install registry WIN32 as a dependency for the WIN32 application". There is no ordering. Runic divination appears to be the deciding order of installation from intune. I have yet to figure out how it sorts out what to install first. Be wary of app installation failures, intune will only retry a few times. Registry hacking can change this first logon will not have all your settings in place. Pupils will be able to mess about, change things, screw with start menus until intune has sorted its policies out. This is very different from GPOs Feedback on failure is nowhere near as good as GPO results wizards. There are scripts out there and they can even be run remotely but expect the results (remotely) in hours. Intune almost does away with loopback processing, this is inherently set to merge (effectively), this can make it a little easier to manage If you have teams then you can deploy to teams. Useful for software installations for students who have certain subjects such as tech or art. print deploy works fine. we are hybrid but I am only deploying new machines to azure only. This does not stop the devices being able to get an onsite hybrid token and access onsite resources but you wont have visibility in AD (you can set this up but I am looking to eventually phase AD out) GPO to WIN32 (registry) and device profiles took the longest time. Lots of searching. Many CSP policies are locked behind host OS version, lots are locked out of Pro. However in EVERY case I have been able to set the registry setting manually with a WIN32 batch file. Very very annoying. Obviously your licensing will determine this course of action - im setting up for the lowest common denominator even though at the moment I can upgrade to education version I intend changing our licensing for cheaper in the future, this will probably gave host pro licensing. Prototype device was surprisingly easy to set up and took a surprisingly long time to white glove pre provision - 31 mins per device. I would estimate 4gb of apps on normal machines. Our adobe CC machines took close to 2 hours to provision with their 10gb packages. logon times are now measured in "instants" rather than seconds. remediation scripts will fix some issues around WIN32 packages buuuuuuut you need this licensed. We dont. Get-AutopilotDiagnosticsCommunity is an excellent script to get status on profiles, apps or configurations that cause error either preprovisioning or OOBE first logon. 5x WIN KEY will get you the technician pre-provision secret screen when you have the OOBE branded logon page shift +F10 will get you a CMD prompt at the same OOBE branded logon screen, you can then POWERSHELL and install the Get-AutopilotDiagnosticsCommunity script, copying the results to a USB pen. This saves OOBE if you only want to fault find preprovisioning. In short, registry manipulation is *awful* in intune. GPO -> policy and registry will take a long time. I have Winget working as a system context, this will be a game changer when I can get a cache server running (without a cache, having all machines updating apps simultaneously will be hell) however this is prototyped ona small number of machines. Two months start to finish from test machines, test rooms, full roll out. The rollout was a fortnight, the majority of time was GPO migration. Overall it was very smooth and had fewer issues than I thought it would have.

For 365 using your favourite MDM or GPO, have the exam user group denied access to the following folder: Microsoft Office\root\Office16\PROOF It may or may not affect you but dictate will also correct spellings for you. This would be a little harder to get away with in an exam though. You can block command ID 27914. Yes I know many people use examwritepad but we need to offer "normal way of working" as dictated by our exams officer. They say, I do

it was what MS recommended. Since this was my hypervisor I followed the instructions without cutting corners. The hypervisor wasnt hard to install, it only has storage and network drivers really.

Alias will work, I did this for years. Moving the shares to a DFS isnt a bad one either, you can chop and change backend storage till your hearts content. Inplace upgrade works just fine, ive even backup restored (using WSB) to new hardware THEN inplace upgraded before now. WSB works fine for backup restore to VM too - I did that with almost all of my CURRENT VMs back when 2008R2 was a thing. Dont forget to demote your DC (after promoting another alternative backup) as DC do not play nicely being inplace upgraded (if it will even let you).

I think that is the iDRAC loopback adapter, or at least something to do with iDRAC.

One tip, if you need to migrate VM to new storage but are a bit paranoid, you can use VEEAM to backup, (shut down original VM) and live restore to new storage. That way you still have your original storage/VM untouched (cold shutdown) whilst VEEAM runs and restores to your new hardware. VEEAM community is free for 10 workloads.

Ive since gone to 2022 now. With the 2016 -> 2019 I evicted a node, upgraded (note, this was a fresh install, not an inplace upgrade), rejoined. Did this for all of them. It is a supported scenario https://learn.microsoft.com/en-us/windows-server/failover-clustering/upgrade-option-same-hardware

we moved our thermostat to the living room and away from the door., it DID used to be on the landing (which was not a good idea). Depending on the layout of your house just keep the doors closed around the vent. we didnt notice a temperature difference in the other rooms only on the landing where the vent was.

oh shared ipads. I had no end of pain and suffering with this. In the end we managed to get more funds so I could 1-1 but when we had shared trolley they would fill up without warning (blocking access), unconfigurable screen timeouts, spotty SSO to 365 with authenticator (it was preview back then to be fair), app installation when each shared user logged in (this was fun at the start of a class and hogged out the bandwidth from a couple of APs). IOS updates would fail and also download to user areas before failing, filling up the unknown size user profile. Wait until your user forgets their PIN and you have to reset it, hint this is not the same as resetting the lock PIN in the MDM. It may well be better now but it was awful when I tried.

we are still hybrid, the intune policies do take longer to apply. I still havent migrated the core "lock this down" GPO to intune yet.

what unifi firmware? temporarily downgrade to 6.2.49 if you are on the latest. See if that fixes, then incrementally upgrade. We had similar issues on latest firmware, on our nanoHD we were getting 5 to 10 Mb throughput on clients even though sync was around 833. We settled on a 6.5.28 (I think) with throughputs around 60Mb, still not happy but that will have to do (6.2.49 was much quicker but quite old for CVE fixes)

unifi is cheap. With cheap comes the same level of fault finding you would expect from cheap, especially when you have to upgrade firmware (its a roulette if it works properly again). The 24v POE are a little weak, make sure you have spares. Unifi used to be monsters for pulling lines with short notice. We run unifi but I wouldnt if I had more money, i'd run ruckus. We run ours on a gen1 cloudkey, yes I know how to rebuild the database when it barfs following a power outage. Yes they run a mongodb without journalling. I think you are only supposed to use about 30 devices on a cloudkey gen1, we run around 50 without issue but we dont use unifi guest network so that will explain it. If you plan on using unifi guest network and want to use a letsencrypt SSL then you will be in a world of hurt as unifi are still stuck in the 90s regarding updating SSL certs - there is NO gui for updating (let along an automated letsencrypt support) so you will need to script this. At least you can SSH to the cloudkey.

we have three domains, on primary, one historical and one is the .sch.uk we can email on all three via our 365. We use a 3rd party DNS (dnsmadeeasy) as that is compatible with my ACME letsencrypt scripts. Lots of CNAME pointing to whatever we need on any of the domains - MIS, sharepoint, papercut mobility, VPN, website. I recommend getting letsencrypt sorted, it does two things, one saves money and two makes you get a hold on your domains and DNS.

credsccp on 2016 was fixed by running latest updates I think. I seem to remember RDP not working immediately afterwards but fine after a few updates.

shared ipad mode is the work of satan just in case you are considering reprofiling your ipads in shared mode. But one thing it will do is lock the profile to a username for filtering.

I can only dream of FTTP, FTTC would be nice too. As it is we have Wireless point to point. Oh look, its raining outside, so that tree 2 miles away will be playing havoc with SNR

which part of KCSIE 23 would the above not comply with?

another TSO host here

This never worked properly for us. The best we could do was get people to sign into the authenticator, this seemed to satisfy SSO for a few days at a time. We also hit another massive block with shared ipads, the ipad will carve up the storage for potential profiles. There did not seem to be a way to find out how much space was remaining in the storage for each logged on user. This meant that users suddenly ran out of space. We have binned shared ipads now, pupils are getting full devices each and the ipads have all gone to single user teachers. In short, shared ipads was awful, didnt work with SSO properly, syncing classroom with azure AD was poor, PIN resets apple side was a pain in the backside for smaller kids, storage limitations was unworkable on 32gb ipads. I have no idea how schools with pure ipads and shared user actually work with them, we found it a nightmare.

locked down for us. Poor "everyone knows bobs password" would have phallus on a daily basis.

Sorry, I was posting to OP.