Katy

+1 for ADMT, when I set up a new domain (admittedly ages ago on a 2003/XP network) it made things so much easier for migrating the users and computers over. Pretty sure all I had to do was have the PCs turned on (and both old and new DCs running) and the tool handled the joining to the domain for me. I certainly don't remember having to visit every PC putting my password in or anything like that.

No, chrome. New emails in OWA in chrome and the tab makes a noise. You could always set the startup pages for the browsers to iSAMS and Outlook in group policy for the staff OU, that way when they open a browser they get those 2 tabs by default.

We don't have anything like this, teachers log on to the computer in the room they are timetabled (teachers move rooms quite often), first things they open are iSAMS and Outlook Web, then do their register then teach. New emails pop up the little card and make a bing noise.

If you require MFA for your tenancy admins you need some aditional steps to connect from powershell: https://docs.microsoft.com/en-us/powershell/exchange/exchange-online/connect-to-exchange-online-powershell/mfa-connect-to-exchange-online-powershell?view=exchange-ps

I've got this set on 1803 by setting the computer reg setting within the user policy: User GP Preferences -> Registry Update Key: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer Value name: SettingsPageVisibility Value: showonly:sound;display;printers;easeofaccess-narrator etc etc It will change it for the entire PC but just stick a setting to delete that key in the user policy for IT staff/admins, so that you can get at the settings.

Is it just as slow using your script or does that speed it up any? 5 minute wait at the start of every lesson for pupils (except the lucky few who happen upon a PC they have used recently) isn't gonna work.

Our trust used to run one, we since moved to normal Internet connections and running it all over VPNs. MPLS connections were loads more expensive and the way it was set up meant we had to have centralised filtering, fine until the trust grew a bit too big to cope with it. We're still on the same AD forest (child domain per school) just over VPN.

I've found it! Under User -> Policy -> Admin Templates ->Start Menu and Taskbar -> Remove Run menu from Start Menu. Side effect is they can't type C: into the address bar and get anywhere.

Well - my plan is subject to testing. The idea behind "move it yourself" is that they can tidy up but I can't see many staff actually bothering... might use the sharepoint migration tool to move the data, then set folder redirection in the GPO to unconfigured (to point it at empty folders on C:) and turn up "move folders to onedrive". Got until Easter to have a firm plan....

We're moving to onedrive and ditching local (i.e. network drive) storage. My plan so far is to leave the N: mapped (as that's done in the user account properties, not GPO), remove the folder redirection (so documents will point at an empty folder on C:, and turn on onedrive "migrate folders" or whatever it's called - when testing this, with empty folders they are redirected to onedrive within a few minutes of the first logon. The users can then move their files out of the N: drive and into their documents (now redirecting to onedrive) themselves. Eventually we remove the mapped drive.

We've still got an open site (no fences or gates, we're just surrounded by sand banks). Our current site manager moved in about 20 years ago, not sure what is going to happen when he retires in a year or two - might just end up empty and mothballed, depends on whether the new site manager wants to (or if their contract says they have to) live on site. It's a nice house with a private front garden, sheds, garage etc but the problem with living on site is when you do retire - you're homeless, and you have no property to sell, good luck getting a mortgage age 65. (I think ours said he managed to get a 14 year mortgage and had some savings)

We do (but it is a house rather than a bungalow ), nice 3 bed house with 2 reception rooms. Semi-detached as it's stuck to the side of the school, and one of the bedrooms is directly above the site manager's workshop. We don't provide any services - used to provide a work phone and internet connectivity but when we joined a trust and got our internet through an MPLS link to their core it became impossible to manage, so we told him to just go get a line installed and get BT Infinity. (We used to just give him a router which sat on our public IP block VLAN with one of the spare IPs, the way the network was set up when we were on MPLS was we had no external IPs. Now we've a normal connection we could go back to providing a connection but as he's already got his own sorted, not worth the hassle)

Going to resurrect my old thread (googling for this issue brought me back to my own thread as one of the top results...) I've got Win 10 1809 installed, office Click to Run, and the GPO settings to make OneDrive automatically configure. It does - but eventually, there is a 5 minute delay between the desktop appearing, and explorer restarting and "OneDrive - TenancyName" being available. During this 5 minute window at one point "OneDrive" appears in Explorer and lets people save things into a folder on the C drive which isn't synced anywhere. Subsequent logins on the same user/machine combo and it works perfectly - OneDrive Tenancyname is available straight away. Has anybody managed to get this 5 minute delay reduced down to a couple of seconds? I can't really tell everybody "Your first logon you can't do anything for 5 minutes" - especially pupils who move machines every lesson - and we're having to remove all on premise storage, so users will only be presented with OneDrive for storage. As a side point, getting Office Click to Run to auto sign in seems to be a black art - if I open it before OneDrive has finished doing its thing, I'm prompted. If I open it after, I'm prompted but cancelling lets me in anyway. If I wait for subsequent logons, I'm not prompted at all.

I was thinking things like, pupil plugs in camera in art and copies 100MB of jpegs into the onedrive folder then logs off. Comes back next lesson onto a different PC to find they never synced. Will try it tomorrow if I remember.

One thing I need to test is what happens if they save something into a folder within explorer (either sharepoint or onedrive) then log off straight away... does it upload in the background once they have logged off, or does their work never make it to the cloud storage and is lost (unless they log back onto the same machine before the profile's wiped)

It's part of the OneDrive GPO although last time I read up on it they said the GPO to do this was "coming soon". Not sure how soon that was (think the setting existed it just didn't work)

We found you have to undo the "Prevent access to these drives" GPO, but you can keep the "Hide these drives" GPO. For some reason when they type C: into the address bar it tells them "Access to this resource has been disallowed" but I'm not sure why, whether we have a third GPO somewhere causing this (which is nice as it is enough to let Onedrive work without them being able to browse the drive).

We're currently working through this to decide the best way for the staff, as we're moving all our file storage into OneDrive/Teams/Sharepoint. You can have it sync in Explorer (I think it works the same as files on demand, i.e. doesn't download EVERYTHING onto the C drive) as below: There is a GPO setting to do this but last time I checked it didn't work and was "coming soon" - I've got those to appear by clicking "Sync" on each sharepoint library.

Where does it say that? I presume you're planning to take a backup of all your GPOs beforehand anyway. https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/dcgpofix You specify either domain or DC as the target, to reset the default *domain* policy or default *domain controllers* policy (or both to do both of them) PS C:\Windows\system32> dcgpofix /? Microsoft(R) Windows(R) Operating System Default Group Policy Restore Utility v5.1 Copyright (C) Microsoft Corporation. 1981-2003 Description: Recreates the Default Group Policy Objects (GPOs) for a domain Syntax: DcGPOFix [/ignoreschema] [/Target: Domain | DC | BOTH] /target: {Domain | DC | BOTH} Optional. Specifies the GPO to be restored: the Default Domain Policy GPO, the Default Domain Controllers Policy GPO, o r both. /ignoreschema: Optional. Use this switch to enable this tool to ignore the schema version of Active Directory. Otherwise, this tool wi ll only work on the same AD schema version as the Windows version in which the tool was shipped.

You could do the same and connect the classroom switch to the SCCM server, although that'd still require someone to go down there. Out of ideas, hopefully somebody else will have a similar scenario to yours and some good ideas

Assuming your image is Windows with all the linux running as HyperV guests or similar: We don't have that kind of setup, but we re-image machines with SCCM and MDT. Task sequence which does the OS install and sets everything up, PCs are set to PXE boot as their default boot option. We then have a task assigned to an empty device collection (set to "Required", and only advertised to Media and PXE clients). To re-image a PC we stick it in the device collection and remotely power cycle the PC, it then PXE boots and is zero touch. If there's no task waiting then the PXE boot just fails and drops through to booting off the local disk.

Run dcgpofix. This resets the default domain and default DC policies to default.

Just started using Enviro Electronics too - almost ready for our first collection. We have a bin locked in the compound, with our own padlock on the bin lid. When they dropped the bin off they said I could put toner cartridges in there if I wanted - although we have smaller cardboard bins in school for toners with greener-side.co.uk

We don't do it, if someone has a problem with that they get sent off to SLT where they are told "no, and learn to be polite to people". The most we do is guide them through installing Office or ActivInspire, with them stood there doing most of the work on their laptop and us just saying "click next, next, next, finish". They want you to fix their laptop in your own time for free? How about they teach your kids in their own time for free? Bet they turn that offer down!

You can stop people opening command prompt via: User Config -> Admin Templates -> System -> Prevent access to the command prompt (Doesn't stop them from running powershell instead though)