Katy

There is also a bug where it doesn't set the default printer as instructed on first logon - looking into it, it runs the "set the printer as default" bit before it finishes the "add the printers" bit and the official workaround is "log off then back on again" or "run gpupdate once you are logged in". I just don't understand how they have managed to break something which used to work without fail every time somebody logged on.

You give each member of staff a section of a few words, then as an inset day it's a teamwork session for them to piece together their fragments to make the document.

Especially if you set the DC to be wrong, send them round "fixing" it on each PC, then leave it long enough to sync with the DC and revert to the wrong time and check one "This is still wrong! Do it all again!"

No! If i'd have realised I would have told everyone "late start" on Monday Evil farmers stealing my sleep!

Secure room with it on a small screen, no keyboard or mouse, one person at a time in via metal detector and body search? Plus some memory-loss-inducing drugs on the way out to stop them remembering it and telling anybody.

Sorry, just went and re-read them and you're right, it can be done with Azure RM although it's easily circumvented with the "take a photo of it".

How? No matter how well you protect it with Azure RM it won't stop me taking my phone out and getting a photo of it on screen.

Whispering the contents to each staff member might work, as it'd be too quiet for them to record and there's nothing for them to screenshot or take a photo of.... would be hilarious if this actually happened

The old "if you can see it with your eyes, you can copy it" comes into play. Impossible as even if you could prevent a screenshot, nothing to stop a photograph being taken of the screen.

Also interested in the "getting everyone on one SSID with RADIUS vlans" thing - I can see how to do it for domain computers and users on their own device but we've got two ipad SSIDs currently (ipads and ipads-staff) - there must be an easier way to dish out the vlan to ipads via radius besides a huge list of MAC addresses. Is it possible to embed a user/pass in the wifi connection settings pushed via the MDM, then I could just look for that ipad/ipadstaff user? (And also, does anybody have vlans assigned by radius using HP MSM765zl controller? I can see how to do it on the Unifi in the junior school, but the HP for the rest of the site is a nightmare)

I've done this too, left the router as a router but disabled its wireless and installed a decent AP on the living room ceiling (pretty much centre of the house), don't really have any issues and I'm on the 300/20 package.

I'm not going to go looking for the policy, I manage the network I don't have anything to do with those sorts of policies, however I'm sure one exists and we get consent from (and when sending communications out it goes to) both parents unless there is a court order preventing us from contacting one of the parents. (That's another thing to add into the mix which may confuse the data even more)

How loud is it if it's interfering with phone calls? We have music playing in the tech office but it's on low to just get rid of the fact that it'd be sitting in silence without it, certainly can't hear it when on the phone.

I've used these before: https://www.amazon.co.uk/MASUMARK-Charging-Lightning-Connector-Certified/dp/B0738RQ651/ref=sr_1_3?ie=UTF8&qid=1521719033&sr=8-3&keywords=masumark They charge fine and seem to work fine moving files to/from a PC, only thing I found (might have been coincidence as I just tried a single cable) is I couldn't get the ipad to do a content/settings erase when plugged into AC2 on the mac mini and swapping to an "official" cable it worked fine.

As I said we're an independent school, "ermmmm" no public funding = no FOIA. It applies to the academies and the parts of the central structure which are funded through the academies.

I've got 21 of the AC Pro in a new build, one per classroom, wireless "just works" and I didn't have to do any messing with power etc. Although our new build is steel frame with this weird thick board covered in tin foil for the partition walls with what feels like 18 layers of plasterboard either side (it's probably about 2 or 3) - on our old APs we had one per two rooms and really struggled so it may be that the walls were blocking the signal for us (and therefore would reduce interference when they're one per room)...

We do this as our trust is HUGE, although it's not a "number of female staff" etc, it's a staff list where you would have to count up and total for each gender yourself. Not that it matters for this as FOIA doesn't apply for us (Independent).

Ours we have the APs themselves sat on VLAN1 but all of the SSIDs are on other VLANs, on the switch ports for the APs we have vlan 1 untagged, and vlans 20-23 (the wireless vlans) tagged. We got ours off Complete IT (Home | Complete IT Systems Ltd) and they were quite a bit cheaper than Comms Express. Think we got four 5-packs and one single AC Pro.

Oooh clever, so I could do "java 8%%" in the above to remove ALL version 8 java. I had been doing it this way: REM 32 bit start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F83218045F0} /qn /norestart start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F83218091F0} /qn /norestart start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F32180101F0} /qn /norestart start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F32180111F0} /qn /norestart start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F32180121F0} /qn /norestart start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F32180131F0} /qn /norestart start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F32180144F0} /qn /norestart REM 64 bit start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F86418045F0} /qn /norestart start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F86418091F0} /qn /norestart start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F64180101F0} /qn /norestart start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F64180111F0} /qn /norestart start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F64180121F0} /qn /norestart start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F64180131F0} /qn /norestart start /wait msiexec.exe /x {26A24AE4-039D-4CA4-87B4-2F64180144F0} /qn /norestart which removed 8u45/91/101/111/121/131/144 (which are the versions I have installed as I don't update as fast as they spew out new updates) (That went in a start up script and only ran the uninstall sections if an old version was present, followed up by the installer for the new version)

That, and nobody can guarantee something as virus free, even with all the antivirus in the world, with zero day exploits existing.

It's not added much time unless you're on an ancient PC which is slow anyway, the one I just logged on to was about a 60 second delay (although it felt like about 5 minutes) - we don't have any that old in classrooms though (this was an old one we stuck in a distant server room "just incase" we needed to get on and poke switch configs or something)

Also interested in one of the 5406zl and a couple of 2530-24G-PoE depending on price.

We're Office 365 but all the "getting ready for GDPR" stuff we've been given by our trust implies that they just have to have the phone passworded/coded (but the finger swipe thing doesn't count as you can just follow the greasy pattern on the screen of the nicked phone). Not sure if this can be forced in 365, no idea about Google but ours is just in the policy that staff have to sign, appears to be okay as a bare minimum effort.

Might try updating my servers, the DCs and print server are all still 2012R2. It's odd as it's random where and when it doesn't map.

This is what I do, it works as expected in general although for some of us they still only map about 90% of the time with no fix (see the other windows 10 printing thread)