KK20

I can give you our thought and planning process. *) we decided that we wanted easier access to files from outside the school. At the time we were using home access plus for pupils to access their documents. A few shared files and homework were submitted via our VLE. Most shared files were onsite file shares *) A1 365 gave free storage *) looked into hybrid with azure ad, onedrive, sharepoint file libraries *) trialled users using onedrive, trialled moving a small fileshare to sharepoint library. *) Reviewed findings and shortcomings. Moved desktop office from 2016 to 365 with relevant licensing. Also purchased P1 premium azure for 2FA and password writeback. *) moved larger file share to sharepoint libarary *) covid hit. Moved everything that was left to sharepoint library. People encouraged to use onedrive more. Teams was established at the same time (this was a very fun April for me) *) school return, reviewed findings. Installed "cloud drive mapper" to map sharepoint libraries to a drive letter - mimicking the previous share notations. This is to be phased out (from Sept this year) *) reduce "my documents" quota so that all new changes are to be saved to onedrive. users encouraged to use onedrive *) small file share onsite retained for media and movie files - not practical to work with gb+ file sizes for editing on sharepoint. Not practical to use CDM with media. *) my documents phased out. *) future planning - currently trialling 365 only devices, i.e. no onsite AD replication for 365 devices. Looking to move to user devices enrolled and controlled with autopilot/intune/Microsoft MDM only. Expected to start rolling out 2024 we already had cloud filtering in place. I do not yet have a reliable printing solution in place, we are in early stages of "offsite" 365 only devices - we use papercut at the moment. For us it was use case: better external access of data was the driving factor. Dont forget your backup solution, this needs to adapt with your data location. Now we are looking at replacing our aging gen4 i5's fleet of desktop PCs to a device-per-person (and potentially BYOD) solution. This would mesh better with a 365 only presence. Some shared devices to remain for our art and design studios (with higher powered devices).

I might be being thick here and have grabbed the wrong end of the stick. Are your PCs on a traditional onsite active directory and you are wanting to roll out software via intune (but do not have a presence with intune at the moment)? If so, hybrid join, then roll out software to your PCs. Make a dynamic group based on something relevant on your AD OUs so that you have parity OU->Group and away you go. thats where we are at (im basically migrating GPOs to intune policies as I go, software installs included). I didnt need to mess around with shared PC settings, we use onedrive client extensively as we are cloud based for user storage now.

you purchase "paid" faculty licenses, then ask the reseller to give you X student. These appear as a zero cost line, so in your case you will get 6 faculty with a cost and 240 student with no cost. These licenses appear in your admin portal and you assign the rules accordingly so that "staff" OU/Group get the faculty licenses and "pupil" OU/Group get the student ones. This will happen automatically ( the same are you are probably doing with your A1 free - it is no different)

We still use the old "desktop core" with software assurance. this is for many reasons, mainly due to it not being practical for a full M365 license for us at this time. This means that as well as the "free" A1 license, we also get the "free" M365 Apps Ent Open Fac ALng Sub OLV F 1Yr Acad AP Add-on OPP and M365 Aps Ent Open Stu Sub OLV NL 1Yr Acad AO Office Pro Plus so we can use full desktop 365 licensing. The codes are S3Y-00005 and S2Y-00003 In short, the A1 is the free online only (no desktop apps) and the M365 Apps is for desktop apps licensing.

I was away so didnt patch immediately. It seems that whatever was causing you guys issues didnt for me. I patched our cluster last week and all is good my end so far.

ref onedrive, no you cannot change that in a gpo/intune policy. However, you can configure "storage sense" GPO/Intune policy and storage sense has a setting for Content Dehydration Threshold; set it to a low number. I seem to remember having issues with permissions for this when I set it up, whilst a computer setting is made I believe that system has issues with onedrive folders when logged in as other people, this meant that even though I specified run times for storage sense, it was only really accurately run when users were logged in.

From personal experience, things got laggy for us with 33 in a session. This was a distance learning exercise though so could have had all sorts of user internet errors. It can get messy when a lot of people are editing simultaneously but it did work!

oh boy

I have only used log analytics as part of WUFB, I have a workspace for WUFB and it does its job. I know this is free. I am now looking at azure monitoring as part of Windows Admin Center for my cluster. Knowing that this will produce ingestible data I have enabled and set up a second workspace and ran it for a week to see how much data it will consume for my primary servers. I am getting less than 100mb per day so this will be well under the 5gb "free" monthly. No alerts have been enabled yet as I believe these to be chargeable. Are there any types of email alerts that are "free" or are all alerts charged? I was looking only at the cluster alterts for "system critical error" and "health service alert". I was wondering if anyone else had set alerts up?

we leave link sharing enabled, this is a core part of how we work. Students are encouraged to share links for their homework, collaboration etc. Pupil external link sharing is disabled though.

manual block of their school account (whilst exam is on) is the method I employed in the mocks. It was on my "todo list" to look at a nicer method :-) Oh well. for the single exam that it is, I think manual block, stick with the website PAC whitelist and mark it up to damn you 365 for not letting us small people use device licensing.

yeah, but they are both part of the same organization - the pupil own accounts and the exam accounts are in the same tenant. I have this set already to stop "home" accounts being used.

We have two methods onsite. One ancient, one modern. For our new pupil laptops, we use autopilot to do the majority of the heavy lifting, then intune policies and app installers to get things set up. Pro, it does work and is fairly universal. Con, you must remember to delete the devices if you wish to reinstall everything from scratch, it also takes a looooong time (comparatively) to set everything up again. I have not yet created a bare metal ADK/install.wim/AutopilotConfigurationFile.json USB pen drive for true bare metal -> autopilot -> intune "hands free" although I know it IS possible. The ancient method? Yeah, that will be audit mode, set up, generalise, capture and deploy. This uses the same intune policies to configure and roll out the apps but lets you go from bare metal to domain capable in around 6 minutes. You can get from bare VM to captured image in around an hour and a half if you have a decent list (and UEFI V2 VM - legacy adapters are capped at 100mb so that will slow your capture down). You need some ancient knowledge to get this going though and you will live and die by your answer file (and post deployment scripts), ours will install snappy drivers for odd machines, automatically expand the C: for various drive sizes (and create a scratch drive with a few Gb on it) plus join appropriate WIFI for devices with no network (USB boot ones). I dont recommend this as a way forward though - it works for us only because ive been doing this since windows XP so have it down to a tee.... We are hybrid for our onsite, pupil laptops are 365 sharepoint/onedrive only - this is the migration path as all devices will be moved off hybrid eventually.

I cant block the browser as they need it for their exam. They create web pages in ICT practical unfortunately. The PAC blackholes the non whitelisted websites so external access isnt a problem. What I found is that you can add other accounts into word directly and access the files from there. You can also authorise other accounts from within word and access sharepoint too (the dropbox etc is blocked). What I cant find is a GPO or intune profile to block this adding of services and other accounts. Ironically enough, the previous ICT exams we ran, you could access the internet and even send/receive email (in fact you had to as part of the questions). For some reason they had to stop this because people were apparently communicating with people in the outside world....

This was a head scratcher. We use 365, we also save to onedrive (mydocuments have gone now). Shared drives are actually sharepoint drives. Roll onto the ICT practical exams, these use 365, need to access common files, need to save to a personal area. Aren't allowed internet access. So in order to activate 365 I do need internet access, but only enough to get the user going. So I looked at whitelisting necessary microsoft websites, except there are a few gotchas. First, have you seen the whitelist of URLs for 365 activation? Second, that doesnt stop someone opening an inprivate browser, navigating to portal.office.com and logging in using their normal credentials. In short, I created a PAC, whitelisted the necessary locations for logging in, created an old skool network share for the common files, reactivated server share documents for these exam logons. What I havent been able to do is stop someone logging into a browser as their "own" onedrive, I cannot seem to lock down the ability to only log into 365 as the user they have logged onto the machine as (if that makes sense). Is there a way to GPO or intune policy machine logged on credentials for 365 only? At the moment I am just blocking DOMAIN-my.sharepoint.com as I dont think this is necessary for the exam. But im not sure this works in word as you can access onedrive via the backdoor in word "open documents).

In their wisdom , Pearson sent an email yesterday to say they are enabling 2FA on their exam submissions website. They were enabling them from yesterday. Smart move as there are drama, language and music exams that are needing submissions (and you get 48 hours), these are multi MB files that do take some time to upload (the drama ones are a bit hefty). Oh and its a bank holiday weekend too. This morning our exams officer logs on, 2FA sent, code typed. Nope. Our exams officer is quite savvy, they also write SQL reports and know about 2FA - the fact we use it for our MIS and 365 means all our staff understand 2FA. They can certainly type a code into a web page. Second email sent with 2FA code, copied and pasted - nope. Exams officer panics a bit as there are a lot of submissions today, im called, I walk down. I suggest clearing cookies, using another browser for the final attempt. This is what we do, fresh email comes in, I see the code, I type the code under the watchful eye aaaaaaand - nope, your account is locked. Phone them up, there is a wait time of approximately 50 mins at the moment. Im guessing there might be an issue with Pearson and their hastily rolled out 2FA midway through exams on a bank holiday weekend. Anyone else having pearson issues today?

one disadvantage is if you work with large media files (gigabyte videos). We do for our PE, Art, Drama and DT departments. We needed to retain a local NAS drive (+ backup) for this. Other than that, as others said, just create document libraries - one for staff and one for pupils. We use cloud drive mapper to map traditional drive letters to document libraries. This can help die hards who need a drive letter to function, sure it isnt perfect but it has worked for us. Plus if there are any issues we simply show them the "proper" way of using sharepoint, gradually weaning people off things....

Have your firewall take care of things such as DHCP if you need it. We use HA pfsense as our firewall and even if we went "serverless" I would still retain the HA pfsense as a firewall is still necessary. Pfsense can do DHCP, guest wifi portals, access logging, WPAD for guest access etc if necessary.

This is how we did ours: Old school structure: Personal documents -> redirected to server share Personal desktop -> redirected to server share Staff shared area -> redirected to staff server share pupil shared area -> redirected to pupil server share New structure Sharepoint staff library Sharepoint pupil library Onedrive per user migration: sharepoint file migration, lifted the entirety of staff share to staff library and disabled staff share sharepoint file migration, lifted the entirety of pupil share to pupil library and disabled pupil share onedrive -> Advised that quota would be removed on desktop and documents in 1 year. Onus on people to move own stuff. 1 year time, quota moved to 0. It worked for us. Some caveats. We did spool up a shared drive for media as sharepoint is a pig for working with large videos (art, PE, DT, Drama departments). This uses a QNAP NAS drive as its backend and is designed for "working" directories. It is backed up to another QNAP NAS drive. A third media sharepoint library was added for media destination. Over time the libraries have had various administrators appointed to areas for access and control purposes. We havent had the need to have individual sites - we dont use sharepoint as an intranet, purely as a file repository.

drying? A little I suppose, it isnt so much the drying but the vapour left behind. There isnt a massive airflow coming from the vent, the system is supposed to build up a little pressure so that the vapour will keep moving and be expelled rather than settle and condense. It doesnt really extract warm or cold air such as an expelair in the bathroom and it doesnt work as a circulating heat exchange vent. We have a dehumidifier in the utility/drying room and that works well when we are drying clothes, we use that alongside a heated clothes horse - those cost little to run compared to a tumble dryer.

it seems to work. I have no idea what the temperatures are set to, there are a couple of variable resistors. I live in the lakes, it gets cold up here but over the years this thing has worked for us.

No, the heater is on the output not the input. Input is via two large fabric filters, the heater goes via a collar on the output before the ducting.

We have had one for years. They are awesome. Dont bother with the heater element, its not worth it. Keep the doors closed in the house, it works better in our house with the doors closed. Our house is a 5 bedroom old house, ventilation is not great, we have a pair of dehumidifiers in the house, one in the utilty room where we dry washing and one in the corner of the kitchen/dining room. One central staircase with pair of landings, the nuaire vent is at the top of the stair ceiling, you can notice a temperature difference going onto the landing but since the doors are closed it doesnt affect us. Ours cuts out if the air that is drawn in is too cold - we notice the condensation build up when this happens. It also cuts out if the air is too warm - we also notice the temperature in the stairs increase when this happens! We used to have a problem with black stuff appearing behind book cases that were in the corner of the larger rooms - no more since. I was skeptical about the overpressure thingy but no more.

wow that does seem high. Im on a smart meter so I know what my usage is annually. Im with octopus and my usage from May to March is £2690. We live in a 5 bedroom house with 4 kids (2 are foster but have been with us over a year), heating is on from 6 till 7 and 5 till 8 in the evening, boost till 9pm if its cold. Thermostat set to 19C. We run the tumble drier weekdays for school uniforms if they get dirty. Otherwise I have a utility room with a dehumidifier where the washing dries. Gas cooker, gas heating. No TVs in rooms, computers and electronic devices to be used in communal areas (house rules), rooms for sleeping (and homework but door stays open.)

there is a BETT app with the floorplan. due to data and WIFI being inconsistent it didnt load up 100% of the time. There were still paper ones which I used. Sometimes the search on the app timed out so it was quicker for me to fold up a map and look.