Katy

Well, I think it might have been a red herring that I had so recently changed the filtering.... the PCs with AUTOPILOTVETOESTS worked after their third re-image from the Windows ISO/delete from Autopilot/re-add to Autopilot, and the laptops eventually synced after 5 restarts and an hour's wait.

Hello, Has anybody else experienced the same issue I am facing, or found a workaround? We have configured the DNS forwarding (so it requires the user to authenticate when they try to access anything filtered in the browser, but it doesn't require this for unfiltered sites e.g. Microsoft.com), however if we have a device which isn't logged on we find it won't check in to Intune, presumably being blocked by Securly (although nothing ever shows up in the Activity log). We can make the device check in if we log on to it and manually sync, but at this point it's installed the admin user's SmartPAC and authenticated. I don't want to have to do this with every device that comes back. Similarly we get AUTOPILOTVETOESTS error when trying to build self-deploying PCs now (but only in 50% of cases), previously these were sporadic, although I've only tried 4 PCs since implementing the DNS setting so not sure if it is related, but we have 260 devices to go out in September. Our devices have the browser extension and Smart PAC but we have added the DNS as a catch-all to make sure anything else on the network still gets filtered as we do not have any traditional on-site appliance any more. There is very little on the Internet about this, very frustrating, so hoping somebody else has got Intune managed devices and the DNS filter method set up? Or do other people have a subnet without the DNS filtering for this kind of thing? Cheers Katy

They have finally updated the status page Securly System Status pointing the blame at AWS

All pages (not just Microsoft) take a long time to load, at which point they either sort-of load or go 504 Gateway Timeout. Blocked sites are still blocked, but the block page either takes ages to load or 504 Gateway Timeout. SharePoint appears to work but then all the page content besides the static header/menu just never loads. The admin interface... 504 gateway timeout. It's a very fun morning to come in to after a late night at the school musical and glad it's only been deployed on 75 devices at the moment, but not a good look to a new customer such as ourselves

I tried this to link mine up to the office TV and it didn't work, but to be fair I didn't put much time into it. Does it also carry audio from the laptop through the USB-C then through the P2425HE out the display port, then into the HDMI on the screen?

I was looking at these (recently got some P2425HE for offices, with P2425H on the Display Port pass-thru), how are you linking the laptops to the Smart boards? We have Promethean ActivPanel LX but I can't think how I'd link this in - USB for the touch is easy, but the display - it's only got HDMI, and the P2425HE only has DP output. Can't really USB-C it as that flakes out when you go more than about 1.8m on the cable. (We currently have PCs connected with HDMI and USB cables, but I want to get a monitor for docking laptops/tablets instead - rather than using the built in laptop display which is never at the right height for DSE requirements, and we don't have departmental offices so classrooms get used for admin work by teachers)

We're iSAMS, with Access Dimensions for the finance system (no idea what it's proper name is, the company is Access Group (of My School Portal etc fame), and we use Focalpoint (web based ordering/expenses) and Dimensions (full fat client for doing the accounts). Can't comment on Access but we've found iSAMS to be good, been using it since about 2016 maybe? Previously used Doublefirst Engage, Phoenix e1 and Phoenix Gold. I think e1 was my favourite (web based, back in 2008) but that doesn't exist any more. We recently moved from self-hosted iSAMS to their cloud hosted, not really noticed any difference in speed or uptime since moving over around November last year. Edit: I should add, we use iSAMS to raise the fee invoices and this has a connector that makes them appear in Dimensions.

We pay in GBP by invoice, direct with FreshDesk. Email them and ask and they'll change your account from card to bank transfer.

There's a few things on the MS docs about what would make an app not show up in the Intune store search, so make sure your app doesn't fall under any of these: The app is not available in US region. The app is not available if there is an age restriction. The app is a paid app, which is not supported.

Assuming your users are all synced from on-prem AD, then logging on using username/password to an Azure AD joined device they will automatically be able to access on-prem domain file shares, printers etc. To have this work if they log in with Windows Hello you need to set up (preferably, as it's the easiest) Cloud Kerberos Trust - as per https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/hybrid-cloud-kerberos-trust?tabs=intune - basically creates an object in AD and sets a couple of settings in Intune policy. You also need ms-KeyCredentialLink attribute to be writing back from Azure AD to on-prem AD (I think this is configured by default in Azure AD Connect, unless it's a very old configuration). This attribute is where the public key for the Windows Hello lives for the user (the private key being on the specific device).

We are currently in a split, of shared devices being hybrid joined but Configuration Manager managed, 1:1 devices (currently only for staff) are Intune managed and Azure AD joined. With the recent Cloud Trust you can still seamlessly sign on to on-prem resources with a user logged in using Windows Hello (assuming the user is synced from on-prem rather than cloud only), one of the previous sticking points for us (there were ways round this - key trust/certificate trust - but they were not very reliable)

I also have the problem of devices clinging on to far away Unifi APs despite having one AP per room so I've made the changes mentioned by Primus... will see how much of a difference it makes over the next week. I would expect it to make a decent improvement, especially the minimum RSSI.

I don't know what AI they have been using but I'm sure it is not the same one the rest of us have seen! I don't understand this. Having three "learning coaches" means it's not about saving money, as that'd pay for a teacher capable of teaching a class of 20 kids.

Bit of a thread necromancy here but "sort of" - I have just had a load of LX panels with OPS-A boards, and I have got the OPS-A boards onto Intune as dedicated kiosk devices - see https://katystech.blog/mem/promethean-ops I would have thought the panels with built in Android might be enrollable in the same manner. Big word of advice DO NOT block factory reset as if the device disappears from management there isn't a way to factory reset it without going into Android Recovery, and Promethean don't know how to do this (On a mobile it'd be holding Power and a volume key, there is no volume key on the OPS-A. So I have one board that is stuck not properly managed but not resettable.)

I'd do it via a Run registry entry (HKLM\Software\Microsoft\Windows\CurrentVersion\Run), the way I'd deploy it is create an MSI using Advanced Installer (the free version is adequate and is actually free even for commercial use). Then deploy the MSI through Intune (either package as a win32 or use the "Line of Business" app type). That way it can be easily uninstalled by just setting the Intune deployment from "Required" to "Uninstall". Alternatively you can push a PowerShell script to set the reg entry but more difficult to remove unless you write a script that will handle the removal.

+1, I'd do a single backup of the entire file server VM (all disks), you can then restore either the entire VM, all config and disks, or just an individual virtual disk or even just individual files and folders from Veeam with that one backup. Covers you for "oops I deleted a file" to something taking the entire VM down from the one backup. Obviously make sure there are multiple copies of the backup, air gapped etc.

Intune's win32 file limit is 8GB, however you can get this increased by raising a support ticket. When deploying huge stuff make sure you think of the implications e.g. if a device lives at home, you're going to force it to download a 20GB installer on somebody's wet-string-level home Internet.

Basically this: As it applies settings after logon, some settings only take effect after Explorer has been killed and re-launched, e.g. all the ADMX settings for "Remove Run from the start menu", "disable command prompt" etc so you only notice them on second logon. Regarding slowness, it all depends on the connection, and the load on the tenant location. I've had one tenant that takes 8 hours to report anything back to the console, where I'd normally expect this to take 5-10 minutes. Microsoft said the location is under heavy load, the fix is move location (not an easy task) where there is no guarantee the target location will remain under light load... Where there's a "(User)" and "(Device)" option on the policies, setting the device instead of the user might get round this - although you then block it for your admin accounts.

I use this, if you pick 10.22000% you only match Win 11 RTM, and not 22H2 etc. select Version,ProductType from Win32_OperatingSystem where Version LIKE "10.0.2%" and ProductType = "1"

Not used it for over a year as I left edu, but on the reporting - for ours we hosted it in Azure in our tenant, iSAMS had remote access for support to be able to fix things for us, I actually liked the reporting in that it was all SSRS and as it was our server, we had full access to it so could update reports ourselves. iSAMS ran a course on the iSAMS specific bits of SSRS (in a Basic and Advanced version), I'm not sure if they do this any more or what the cost is/was, but it really helped with understanding how the whole thing fits together to write reports. Previously we used Phoenix Gold, then Phoenix e1, then Engage, then iSAMS. I think my favourite of them was e1 but that's not existed for a while now, I was happy with iSAMS (and happy we didn't get stuck with SIMS). Engage I hated with a passion.

If they are trying to configure remote management as a step you can't skip after doing a factory reset on them, then this means they are still in Apple School Manager pointing at Intune. You'd need to make sure that the Intune MDM is removed from within Apple School Manager.

Ah. Yeah I've always (since it appeared in ~2008) used Group Policy Preferences (and when that fails you sometimes get an actual error code. It might not make any sense or have any relation to the problem, but there's a code!), and when I had issues around Win 10 1607 I moved to a PowerShell logon script (if you are feeling brave, https://katystech.blog/on-prem/powershell-printer-script and https://github.com/CoasterKaty/Printers) Things to try: - Point and Print restrictions - Driver installation - either pre-install the driver or enable the setting that allows standard users to install drivers (One of the settings around these lets you define a list of servers from which drivers can automatically be pulled from, that'll be the print server) - Move to Group Policy Preferences for the printer deployment (or my script) Also to note, if you deploy a printer to a computer (rather than a user) you lose the ability to target a shared printer, so it'd install as a local printer on each computer, pointing at the actual physical printer's IP, so this would bypass anything such as PaperCut you might have running on the server.

Does the event log on the machine show why the printers failed to appear? Will most likely just be an error code but there should be an entry specifically saying it's to do with Group Policy printers. Have a look and paste in the error details and I'll see if it sounds familiar as I had a nightmare with GPP printers a few years back.

As far as I'm aware there is no set order (unless you are using dependencies, then it'll install the app that others depend on first - think this is just for Win32 though), it's likely that Office finishes last as it's the biggest package.

No - if you create users within Azure, they are cloud-only. The only way to create a user and have it on-prem synced is to create it on-prem in AD, and configure Azure AD Connect (...or Cloud Sync, long story but just use Connect instead) to sync the accounts. The problem you have is that I presume all 515 users have accounts in the on-premises AD domain, so unless you sync just a specific OU containing these 10 users, you've got to cope with users matching up (e.g. via the msDs-ConsistencyGUID) although in theory they should match based on UPN or e-mail address before you have to worry about the GUID. It's a bit more complex than just linking the server to Azure - you'd need the following, probably not an exhaustive list: - Azure AD Connect to sync identities to Azure - preferably sync all users and sort out the user mapping. You would first need to make the UPN suffix on-premises match that used in Azure AD and get the UPNs of your users matching the cloud sign-in addresses (AzureAD UPNs). - Devices either Azure AD joined or hybrid Azure AD joined -- if hybrid joined, can use group policy preferences to map drives to the local server, and cloud management to set the start layout -- if Azure AD joined, ??? there isn't really a way to map drives as it's not designed for this, would need something like a script in the user's startup folder (typically placed in the default user's startup folder before anybody logs on, so that this copies to their profile). You'd have to use something like a Win32 application app deployment to push a script which installs the drive map script, or maybe a PowerShell script targeting the device.