StephenPink

Both - all our 1:1 staff/student iPads are managed using Jamf school, so pushing the SmartPAC with username variable. Are you sure you can't push with InTune? I'd be surprised, I thought it had significantly improved in the past few years? The personal devices that staff can bring in will pick up the DNS filtering, and get forced login. Cheers, Stephen

We've just gone with Securly - impressed so far. We're a 1:1 iPad school as well, and so I wasn't happy with others who force you to use a proprietary browser on those devices in order to filter, whereas Securly happily works with Safari/Chrome/Edge. However, don't forget that you'll still need a firewall as well...

Yeah I bought a bunch of Vostro's as they were on a special offer - wish I'd stuck with Latitudes! Just lots of weird issues, and I think almost all of them have had at least one part replaced under warranty (within a year)... build quality just isn't quite up to the normal Dell level I think. But could have just been unlucky! On paper, they're great, just seem a bit of a let down in person. My experience anyway!

So I spotted this one in Patch Tuesday's list: CVE-2021-36970 More details here: Microsoft’s October 2021 Patch Tuesday Addresses 74 CVEs (CVE-2021-40449) - Blog | Tenable® but still no real explanation as to what the patch fixes/does that I can find. Chances of this making things better or worse? Anyone care to take some bets? Cheers, Stephen

Okay something has definitely changed with the September patches, just not sure what - we're getting a LOT of requests with UAC prompts now, that previously wasn't happening (having made the recommended tweaks/workaround) No clue what's going on! Sigh.

Almost everyone seems to be backwards to mine! Students: FirstInitial|Surname|IntakeYear > JBloggs21 (current Year 7) Staff: FirstInitial|Surname > JBloggs Handled by Salamander, again using preferred forenames. Although from the sounds of it we will be having to change a few, leading to username/email changes due to changes in identity.

Yeah the tricky bit is actually collating the points correctly - SIMS outputs them in such a horrible way. I wrote a custom HTML page, that is Powershell generated as not only did the report require a lot of fiddling to actually be able to total the points, because SIMS can't allocate House Points to just a House (rather than a student) it also has to pull in the additional House Points from events (that are just saved in a spreadsheet somewhere). All in all quite a faff! Cheers, Stephen

watching this with interest - I've started purchasing consumer grade 75 inch TVs for classrooms, as they can now be had for only £700. None of the enterprise/commercial grade stuff is anywhere close to that price, and a few have asked about the ability to freeze. Not the end of the world (so far) as most are happy and have had training on how to use them in extend instead, but I can see how some in the future may cause more fuss and struggle to cope with extend!

Yep that's what I meant! D'oh my bad - it was a while ago! Essentially moved everyone over to the new location gradually.

I'm pretty sure you can use your VPP token in more than one - I think that's what I did when we were migrating from AirWatch to Jamf School...

Sure no worries - this may not be the best/neatest way to do it but works for us... # Script to unrestrict driver installation - as per August 2021 Windows Update change (https://support.microsoft.com/en-gb/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872) # Checks to see if Print Driver installation already unrestricted If (Test-Path -Path "C:\Windows\InstallFlags\PrintDriversUnrestricted") { EXIT } # Unrestricts Print Driver installation to allow users to install $RegistryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" $RegistryKeyName = "RestrictDriverInstallationToAdministrators" $RegistryKeyValue = "0" New-ItemProperty -Path $RegistryPath -Name $RegistryKeyName -Value $RegistryKeyValue -PropertyType DWORD -Force # Sets Flag to show that Print Driver installation is unrestricted New-Item -Path "C:\Windows\InstallFlags\" -Name "PrintDriversUnrestricted" -ItemType Directory and then # Script to restrict driver installation - as per August 2021 Windows Update change (https://support.microsoft.com/en-gb/topic/kb5005652-manage-new-point-and-print-default-driver-installation-behavior-cve-2021-34481-873642bf-2634-49c5-a23b-6d8e9a302872) # Checks to see if Print Driver installation already restricted If (!(Test-Path -Path "C:\Windows\InstallFlags\PrintDriversUnrestricted")) { EXIT } # Restricts Print Driver installation to administrators only $RegistryPath = "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Printers\PointAndPrint" $RegistryKeyName = "RestrictDriverInstallationToAdministrators" $RegistryKeyValue = "1" New-ItemProperty -Path $RegistryPath -Name $RegistryKeyName -Value $RegistryKeyValue -PropertyType DWORD -Force #Removes Flag to show that Print Driver installation is unrestricted Remove-Item -Path "C:\Windows\InstallFlags\PrintDriversUnrestricted" The first one, to unrestrict is deployed via Group Policy scheduled task and the trigger is user logon. The second, to re-restrict is the same but the trigger is delayed by 30 minutes. However, I'm not 100% sure that background Group Policy refresh isn't causing issues with this... need to investigate more today, because it didn't when testing but now they're back, users are reporting no printers! Cheers, Stephen

In the end I decided to over-engineer it slightly; basically option 3, however the reg key is set to 0 via a powershell scheduled task at login, then reset to 1 30 minutes later. Slightly less risky bodge maybe? Did try option 2, but even with drivers installed, couldn't get the printers to map!

Okay so just having a play with this now - I can install the driver on the client machine, (based on the script by @free780, thanks!) verify that's its there in the local print management, however the printer still fails to map - with the same "specified driver was not found..." error. Have I missed something? Point and Print is disabled so shouldn't be affecting things... Cheers, Stephen

Thanks both - yes, agreed Senso does do far more than just filtering/monitoring, but did seem to be coming from a classroom management side of things. Which is not what we are interested in; however they do have an interesting MS Teams monitoring functionality. Appreciate you both coming back to me, always good to get a bit of a sanity check! Cheers

Hi all, Am in the process of looking for a new filtering/monitoring/reporting platform, to sit on top of a PaloAlto firewall. I've had calls with both Senso and Securly, as has my safeguarding lead, was just wondering if anyone out there had first-hand experience of either/both and would be willing to share their thoughts? Or if there's another that I've missed... Specific requirements: - 1:1 iPad school, using Jamf School and not wanting to change MDM - Happy with the Palo for firewall, so it's specifically filtering/monitoring/reporting - Driven by safeguarding mostly So far they both seem very capable, and are similar costs! Cheers, Stephen

Ahh I had this when we upgraded back in February - took forever to figure it out, but there is a bug with Adobe Acrobat being unable to install when there is no user logged in. This is fixed in the update here: https://www.adobe.com/devnet-docs/acrobatetk/tools/ReleaseNotesDC/continuous/dccontinuousfeb2021qfe.html#dccontinuousfebtwentytwentyoneqfeHowever this is NOT included in the package downloaded from the Admin Console. For unknown reasons. Because Adobe? MANUAL FIX Download package from Admin Console Download relevant MSP from the link above (AcrobatDCUpd2100120138.msp) Navigate to \Build\Setup\APRO21.0\Adobe Acrobat Replace the AcrobatDCUpd2100120135.msp with the AcrobatDCUpd2100120138.msp Edit the "setup.ini" file, changing line: PATCH=AcrobatDCUpd2100120135.msp To PATCH=AcrobatDCUpd2100120138.msp And save Would then need to update content in SCCM/whatever you use to push out software. Hopefully that helps someone/saves days of head-scratching! Cheers, Stephen

You know I spotted this a few years ago, and never quite managed to figure out the cause - but also decided it was a nice feature to have (in case someone has deleted something accidentally, and previous versions didn't catch it). However when space is low, I wrote a little Powershell to iterate through and remove them. Tried posting it but couldn't get it to keep the carriage returns/new lines so looked horrendous, but happy to share if interested. Cheers, Stephen

I've got a couple of old ProCurve core switches with fibre modules if it helps - a 8212zl/5412zl/5406zl. PM me if needed. Cheers, Stephen

I used alternatives for all of our Aruba switches, during the refresh last summer - that saved a ridiculous amount of money, and there have been no issues. Not 100% sure on the brand though, think they are also FS... all 10Gb.

Just putting this out there - I've used plenty of "consumer" grade TVs with no issues. And last purchase was a 75" for just under £700... hard to say no really! Cheers, Stephen

We run a 1:1 iPad scheme that is entirely parental contribution, with almost zero objections. I'd maybe look at how affordable the payments are; providing devices for PP students from that budget, "selling" the device as being able to be used personally, at home as well. That sort of thing - have you done any sort of launch event/q and a? We found that helped with getting parents on-board, as well as students demo-ing how the device has enhanced their learning.

Likewise, I would also be curious to see some examples if others are willing to share

Using Jamf School here (different product completely to Jamf Pro) - cheap, works pretty well. All MDMs seem to suffer from the same issues (having used AirWatch and InTune previously) when it comes to Apple stuff, and that is that they all rely on Apple allowing them do certain things. Got around 1500 1:1 iPads on there at the mo, and 30 iMacs. Having some weird issues with the iMacs though.

Thanks guys, sounds promising! Were any of you doing it as a migration from an on-prem AD sync to Azure sync or was it just Azure from the get go? @jmak - totally agree, one to test however not sure how I can test easily without disruption... that's my main reasoning behind trying to find people that have done it before haha! Cheers, Stephen

Hey all, With the push for MFA (now on for staff, for 365) I'm keen to do the same for Google - however really don't want staff to have to have two apps, and for it to be as straight forward as being said. So came across this: Federating Google Cloud with Azure Active Directory as I hadn't realised you could federate Google with Azure! I was wondering if anyone has done this, and if there are any first-hand experiences? Currently we sync both Google and Azure from on-prem AD - and I figure if I can change our Google instance to sync from Azure, instead of on-prem AD, that can then leverage the Azure MFA/conditional access, all without requiring staff to do any further setup... Cheers, Stephen