Katy

Is anybody using mandatory profiles for staff, and using Outlook 2016 (full client) to connect to Office 365? In the past we used something which ran at logon and set up the Outlook profile to connect to Exchange using %username%@school.com (can't remember what this thing was called but it was awesome, and we ran it with our Win7 student mandatory profiles). It doesn't seem to work with Office 365 as you get a https:// url that seems to change at random rather than being able to point it at the local Exchange server's name. How does everybody else get round this? Ideally I want to bin off the roaming profiles we currently use for staff and go mandatory, but I don't want them to have to run through that Outlook first run wizard every time they log on somewhere. Another sort of related thing is redirecting AppData - does anybody else do this? I've found that it breaks Outlook and ActivInspire if used with people who leave themselves logged in to multiple PCs at once, when they are both attempting to share data files off the redirected AppData.

Enabled.

All the lights in that building are on some sort of sensor... I will look into it, although just looking now there is an AP over there with 13 clients connected all using Radio 1 (which is the 5GHz radio)

An AP per room is not gonna happen this year at least, but hopefully the mandatory profile and moving APs to the rooms that they use the most will sort it... thanks

Yep all on different VLANs. Can't remember how I did it but it doesn't show any of that "welcome happy to see you" rubbish to them, think I managed to kill it all out of the image somehow. Might not have tested against mandatory and just roaming actually, due to how much of a faff it is making a mandatory profile these days with having to run sysprep, but it was still acceptable login speeds.

When we tested it (on wired pcs) it was quicker creating a profile for us than downloading the mandatory one, might look at mandatory profiles again at some point though. I also think it is the connection between laptop and AP rather than between AP and network, but we upgraded the backbone links anyway as the APs share a switch with phones and cctv cameras.

It's set as an aggregated link, and there's 15 APs in the building, so that means more chance of the busy APs hitting 1Gbps than when they are all sharing a single 1Gbps uplink. The users don't have profiles (i.e. it makes a local one each time, all restrictions etc are done via group policy)

Not sure... where abouts do you tell them which to use? Is it just in the wireless adapter properties in device manager?

It is starting to become more clear, they have finally told me their room number and turns out they moved over the summer from a room with AP to a room with no AP. Going to look for an AP that barely gets used over in the seniors and nick that, then go and observe once it's fitted down there.

We tried that, didn't get filled in. Forgot to mention it's in the junior school and we aren't based down there, so it's about 5-10 minutes to walk down there. I've asked them when they are next being used so we can go and watch, although when we have done this in the past it has worked fine (maybe the laptops can sense our presence and are scared of misbehaving)

Keep getting reports that the laptop trolleys are "useless" / "not fit for purpose" etc etc, actually frequently since they were put in place 3 years ago. We have done the following to try and fix the problems: - Swap all HDDs for SSD - Shut down when lid is closed - No switch user - Increase backbone to PoE switch to 4Gbps, and backbone to the building to 10Gbps Whenever we go over and test them, they work fine. Then the next day we get told "they took 15 minutes to log on, half of them are only showing search and customer support on the start menu". Which sounds like something to do with the network as it's failing to load the redirected start menu. We use a HP MSM460 based wireless network (with one of the 765zl controllers), all traffic comes out of the AP onto the VLAN (it is not tunneled back to the controller). There is one AP for every 2 rooms, the building is 3 years old. Does anybody have any ideas? All I can think is it's the fact they are attempting to log 16 on simultaneously and the wireless can't cope - when we test them we can only do 2 at a time (due to there only being 2 of us) and the only issues we get when testing were too many people logged on at once (solved by disabling switch user), not rebooted for ages (solved by shutting down with lid close) and no network (no permanent fix for this, it's when the children press the button to turn off the wifi, but it's a rare one). Getting sick of being moaned at really, I didn't pick the laptops and I didn't design the wireless network. In fact I proposed replacing the wireless with one Ubiquiti AP per room last year and was turned down (HP discontinued the APs we use so we can't just add more to the existing system)

What MIS system or other product are you using to generate the marksheets?

Also remember there are about three different ways of setting the proxy in group policy, plus it might be set via logon script somewhere, you will need to check all policies for all of the different ways (sorry can't remember them off the top of my head). Don't know a way of finding these besides running a text search on \\domain\sysvol\domain\policies for the incorrect proxy, then determine which policy it is in based on the folder GUID name.

As @yorkie said, you need to change your or's to and's. [color=#007700][font=monospace]if (([/font][/color][color=#0000BB][font=monospace]$hour [/font][/color][color=#007700][font=monospace]== [/font][/color][color=#DD0000][font=monospace]"11" [/font][/color][color=#007700][font=monospace]&& [/font][/color][color=#0000BB][font=monospace]$minute [/font][/color][color=#007700][font=monospace]> [/font][/color][color=#DD0000][font=monospace]"5"[/font][/color][color=#007700][font=monospace]) && ([/font][/color][color=#0000BB][font=monospace]$hour [/font][/color][color=#007700][font=monospace]== [/font][/color][color=#DD0000][font=monospace]"11" [/font][/color][color=#007700][font=monospace]&& [/font][/color][color=#0000BB][font=monospace]$minute [/font][/color][color=#007700][font=monospace]< [/font][/color][color=#DD0000][font=monospace]"20"[/font][/color][color=#007700][font=monospace])) This means it will only show when it is between 11:05-11:20 rather than after 11:05 or before 11:20 (which would catch all of 11:00-11:59)[/font][/color]

I use MDT and just deploy the WIM off the install media, then everything else is scripted via either command line run as part of the task sequence (e.g. removing all the modern apps) or installed via group policy (simple MSIs) or startup script (more complicated MSIs and EXE based installers). Used to build a reference PC then capture it using WDS and then importing the image into MDT (couldn't get MDT's capture to work).

We create individual accounts for Reception year and above, but there is a generic login for nursery and more recently we added a reception generic login and left it up to the teacher which they wanted to use (as usually in reception it seems to be the teacher doing all the logging on)

I remember when it was free with no device limit, unfortunately I signed up too late for that so got the 100 device one. They would only give me rough pricing when asked and in dollars without educational discount of $40 per year per device, wouldn't tell me what the educational discount was (??? think they wanted me to go through a reseller for that). The other thing that got me about it (at least this is how they explained it) was "up to 100 devices" = free, but if you have 101 devices you have to pay for all 101 and none of them are free. Just got to hope we stay under the 100 limit I suppose, or hope that anything over that is some sort of scheme where we can factor in £10/device/year or whatever it is into the cost.

I usually find it's worth installing nano as it's much easier to edit in.

You should also be able to do it all on a Windows PC/server either by installing mysql along with php for IIS or installing apache/php directly, but I've never done it this way so don't have any instructions.

I had never thought to even try this myself, pupils can log in to azure portal on our installation too... although it does look like they can't alter anything, and if they attempt to create/buy resources it tells them they need to set up a subscription (which needs their card details) but still would rather them not be able to log in to it... also noticed they basically have an easy to browse read-only view of the entire synced AD domain too!!

I would have them on a separate wireless network and VLAN, with routing ACLs in place to stop them from going anywhere except the Internet (via the filter) and your Remote Desktop server. However you do need to make sure your RDS server(s) can cope with the load it is likely to get from potentially several hundred laptops trying to use it at once. If you can get Network Access Protection working then you can at least make sure they have up to date anti virus running before they can connect, don't forget to run AV on your RDS server as they will be able to directly copy files to/from the network via the remote desktop session.

Here is how we do it: [h=1]Pre-requisites[/h]You will need to have installed MySQL and phpmyadmin on a fresh server. I usually spin up a Debian VM for this. Make sure you change the root password for mysql. [h=1]Adding Pupil Users[/h]Log in to http://server/phpmyadmin/ as root, and click on Users, then Add User. Fill out the username and password (leave host set to %). Tick “Grant all privileges on wildcard name (username\_%)”. Don’t tick anything else. Now click on Add User. Repeat this for each of the pupils. If you have lots and want to script it, these are the two commands you need to run for each user: CREATE USER 'katytest2'@'%' IDENTIFIED BY 'password'; GRANT ALL PRIVILEGES ON `katytest2\_%`.* TO 'katytest2'@'%'; [h=1]Adding Teacher User[/h]As with the pupil user, click on the User tab and fill out the form, however this time tick whichever global privileges you wish the teacher to have (such as just SELECT if you only want them to be able to read the data, we give ours pretty much full access as he's technical enough to cope with adding pupils). [h=1]Testing It[/h]Log in to phpmyadmin as one of the pupils – you should not be able to see any databases besides information_schema. You should now be only able to create databases named _, e.g. katytest2_1 or katytest2_exam. The pupils can create databases/tables either using the built in forms or just by clicking on the SQL tab and typing in the MySQL commands directly, which I think OCR expects them to do. When logged in as the teacher account it will nicely list all pupil databases in the tree view under their username.

We have FSRM file screen to email us if it sees anything that was in the "common cryptolocker extensions" list (probably massively out of date by now since I set it up months ago). Anybody can save an EXE to their home drives but only IT admin group can execute EXEs (by software restriction policy). Staff/students can only run EXEs which are allowed by file hash in the policy or located in specific folders that they don't have write access to (c:\program files, the programs share etc). Only problems with this is when they tell you at 3:55pm that they need to be on a 4pm webinar and it is ALWAYS stupid WebEx or Go To Meeting that tries to get them to download and run an exe with all the connection baked inside it, so you can't even allow the file hash. To get round this we temporarily de-restricted a randomly named folder and saved it/ran it from there. zip files aren't restricted at all but if they have anything nasty inside they would fail to execute when extracted. Another thing we do is set the default program for .js files (and a few others) to notepad to stop them from running if teachers are tricked into double-clicking on a nasty javascript or VBscript file.

We have the logon background set to an aerial view of the school with logo printed over it (but doesn't appear on most PCs as they're 10 LTSB), and once logged on the desktop is just a plain black screen. May change this in future to something similar to what @bossman has. Years ago we used to have a plain magnolia (ish) background with the school crest plus "STAFF (or STUDENT) ACCOUNT" written on it.

I'm guessing the LGFL router the default gateway for your PCs? If so then yes that points at the router not being able to "see" the client, usually due to incorrect subnet mask.