ITManLT

Hi All, Just wondering how the majority go about setting up a staff laptop? We're looking at giving our staff laptops and replacing the computers in classrooms. Up until now only a few staff have staff laptops, so we've done a solution that works but wondering what people think is best now for moving to mass laptop use. The laptops will be imaged through SCCM/MECM with drivers/software installed through the task sequence. In terms of then users using the device both in school and at home, I'm aware of the 2 options below, but wondered what people think of these and if you guys do anything different: Option 1: Following the domain build, have the staff member log on to their device. Log off of the device. IT log on as admin and load up System Properties > Advanced > User Profiles, select the staff member and convert their profile to local. With the above being done, the staff member can then log on both in school and at home. Option 2 (less ideal, best for home use only really): Following the domain build to install the relevant software, remove the device from the domain. Create a local user account on the device for the staff member to use. I'm looking to enable MECM/InTune Co-Management so that we can use this to manage laptops externally too. What process to people use if none of the above for configuring staff laptops on mass? Also - for the few staff who have laptops already, we have enabled Offline Files and sync their user area to the device, but Microsoft's offline files seems archaic and sometimes just doesn't sync. Not because the files are in conflict (edited both in school and at home) but the file shows 0bytes in the folder for example. Are there any credible alternatives to offline files to help sync staff's user areas to the devices? (They will be bitlocker drive encrypted so security shouldn't be an issue). Thanks in advance.

Good Afternoon, Our school is looking at how we can manage our policy documents easier, with an online system ideally, so that the governors can approve new policies easily enough. We're trying to find something that meets the following criteria: Template cover page Upload our policy cover page so that it automatically adds it to the front of each policy, just with the title/date of approval changing [*]Approval workflow So that our governors can approve any policies before they are published [*]Embedding into our school website once approved This one would just be a nice to have feature, so that once approved on this system, they are automatically on our website without having to download a PDF and upload it to the website. Do any schools use any such software? Currently we just have Word documents that are used and trying to look for something better. Thanks.

Ahh, just my luck then! Is there any way to recover the data from the backup if I update the software? I can open the 4kb auto-backup file in notepad and see some data in there that it looks like the student has written. If we try open this auto-backup file in the new version will the work show? Or can we import the data to a new document in the new version somehow? I could copy and paste the text from the notepad that I've been able to open but this is all written on 1 line so it will lose any formatting he put in his exam. It's doable but if there's a better way of opening this file then that would be a massive help. Finally, I asked previously how to update the version that I have put on a network share and was advised to use the updater. If I download the latest .zip file and just extract this to the same network folder, will my existing .json config file from 22.2.5.2334 work okay with the new 22.4.2.2024 software or will I have to go through all of the ConfigEditorGUI again? Kind regards,

Hello, It's backups - the Auto Save is the one that I mentioned shows 0kb. The Auto-Backup shows 4kb. This is using 22.2.5.2334 (properties of the .exe file). Kind Regards.

Hello, We have started using ExamWritePad and it's working great. The only issue we've just ran in to is that I believe one of the laptops crashed, so I'm trying to open the backup file as the auto-save shows 0kb. The backup file shows 4kb but when I double click on the backup file it opens ExamWritePad but with no data. Am I doing something wrong? Is there a specific way to open a backup file? Thanks in advance.

Hello, Just a quick one. I literally downloaded ExamWritePad on Monday this week and got it set up yesterday. We used the .zip folder so the software sits on our network share. To perform an "update" to this latest version, can I literally just download the latest .zip and overwrite the folder on our network share? Will the config file that I created still work or will I have to create a new config file each time there is an update? Thank you - great looking software, looking forward to using it for the first time when school resumes after Easter! ITManLT.

Good Morning Edugeekers, We have TrendMicro as our AV solution, and use Veeam for our server backup solution. We run into issues every now and then (every few weeks maybe) where a backup in Veeam seems to stick as one of the VMs is stuck on 'Indexing guest file system'. What I have noticed is that this is when a scheduled AV scan is occurring on the server. If I jump on to the server and skip the scheduled scan, the Veeam task will complete. This does not occur every time a scan is in progress on the servers, just once in a while. I can change the time of the scheduled scan to try and finish the backup off first but then if the scan starts too late/early in the morning this may have an impact on server performance during the school day if it does not finish in time. I have 2 questions: Does anybody else have a similar issue? If so, any pointers to how to prevent this from happening. Just out of curiousity - what frequency do you do an AV scan on your servers? - I know the more frequent, the safer technically, but with on access scanning on the clients around school, has anybody dropped the server scan frequency to weekly, say after a weekly full backup for example? Thanks for any answers, ITManLT.

Hi All, Just jumping on the back of this one as we've recently successfully managed to re-image 30 of these on a Win 10 SCCM image and all is working great, so wanted to share the steps we took to hopefully help others. The main issue we faced was that they wouldn't PXE boot from the USB adapter as we couldn't find a BIOS setting to enable USB network devices before the OS loaded. With that in mind the only option therefore was to boot from a USB installer instead of PXE installer. Within SCCM, under Software Library > Operating Systems > Task Sequences we used the "Create Task Sequence Media" to create a bootable USB that included the network drivers just for a Startech USB - Gig Eth adapter that we have. In the BIOS for the Dell Latitude 3190 we enabled the Network Stack support. Boot from the USB and it will connect successfully to the SCCM server at this point to authenticate and present any task sequences available. When the first one was completed, because we had used a USB Network adapter, SCCM had the MAC address of this device tied in with the machine, and therefore wouldn't let another machine be imaged with the same adapter. To resolve this, we added the imaged laptop to the WiFi, removed the USB Network adapter and then inside of the SCCM Configuration Manager on the client, run the "Discovery Data Collection Cycle". This prompted the device to report back to SCCM that it no longer had the MAC of the USB Network adapter, rather it then updated the MAC with that of the WiFi card. This then freed up the USB Network adapter to be usable again to image the next device. Repeated this process and all 30 are imaged with a Startech USB adapter, didn't need the specific Dell adapter at all. As an ex RM employee - this process should hopefully work very similar on a CC4 network just that you will need to create a USB boot stick instead of the usual PXE boot imaging, and then work out the CC4 equivalent of removing the MAC from the first imaged device in the RM Management Console (been a while since I touched this) so that the adapter can be re-used again in laptop 2 onwards. Hope this info helps someone

Hello, If our guides are any help they are available on our page below: Pudsey Grangefield School | - Working from Home The 3rd guide on there may help you get started as it's a "how to do the things" guide for students that we sent home to parents. The first two are more for our school as to how students log in from home etc. It is a PDF that one of our ICT staff created and I don't have the original doc but feel free to use this and convert it back to a word document if you want to tweak anything. It goes over both CREATING new work on a Google Classroom Assignment and UPLOADING existing work, from both a computer and a mobile device. Hope it may help in some way.

Afternoon EduGeekers, I know a few of us make use of Guacamole for remote connection into the building. We made great use of it for a quick remote access solution during lockdown when we had 64 computers in our IT suite not being used in the building, so just fired 1 staff member explicitly to 1 of these machines. Now that we're kind of some in school, some out of school with only a few spare machines that I've now plugged in in our server room, I need to create a pool instead of a direct computer connection. Does anyone know if it's possible with Guacamole to set up a connection pool with these 4 PCs in so that I present this pool to our staff. I'm wanting them to click onto the pool and it just go to a free computer (A) then the next person clicks the pool and it goes to another computer (B) if A is already in use. Thanks in advance for any assistance.

I also had a generic leaflet through from them a few weeks back and have today had a more detailed letter saying they have completed some network expansion work in the area and can offer us a 1Gbps line for £7,450pa through an Openreach fibre circuit. We are actually looking at our ISP options this year as our current contract is up in December. I actually came on EduGeek to search for Edu24 and this was the only article that came up. I was also curious to see if others had heard of these or even used them. New startup then I'm guessing?

Just to add too as I've had this crop up when migrating onsite shared folders to Google Team Drives etc and a helpful tip is to browse so far deep in the folder structure and then shift, right click and do open in command prompt. It will open a command prompt and name the path to that point as X:/ (assuming you have nothing mounted as an X: drive) then you can go further in this command prompt.

Hello All, We're just about to try moving from the antiquated Software Restriction Policies to AppLocker to follow previous advise and best practice (we've had issues with SRP in the past so want to move away from it). Just after some advice/guidance and if anyone can send a screenshot of their basic config as a starting block that would be great. Also - do you apply 1 AppLocker GPO to all users, all computers (with it being a computer policy not user policy) - or do you just apply it to your Students / Staff groups etc? (currently using 1903 but working on a 1909 image to deploy soon if that makes any difference). Thanks for any advice.

Hi Achandler, Thanks for that reply. I'm aware of the incompetencies of some people using gloves - it frustrates me seeing people in supermarkets wearing them, picking everything up and then still rubbing their face etc... single use, then dispose. But what is a really good point is what you say "Better to clean and kill the virus then leave it on the device then to use gloves." That's a very good point actually and perhaps it does make more sense to wipe before we use it. Thanks - I'll take that into consideration.

Hello All, I have seen there is a very big Coronavirus thread, but just for this one query so it didn't get lost in a huge conversation, I wanted to ask separately. We have been open all throughout this for children of key workers (secondary school) and had between 3 - 20 students in the building which has been okay. Now that the Government have announced "some contact" with year 10 and 12 students and there will be more students and staff in the building, what are all your thoughts regarding ourselves and PPE. Are you asking/requiring PPE so that you can stay safe in the building? I'm wanting to email and suggest that we have a supply of disposable gloves and each time we leave the office to go repair a computer (that another user has been using without gloves - potentially coughing/sneezing or just simply breathing on the device) we put a clean pair of gloves on and then dispose of them immediately afterwards. Is this a general feeling with others on here? What are you requesting for the return to the building? Kind Regards.

Hi, Just to reply to this one, I think there are 2 sides. 1) general comms to parents. 2) specific account details. 1) From a generalised perspective, one thing we have done for our new intake is create a page on our website with a timeline for a "virtual welcome" to our school (page here: Pudsey Grangefield School | - Year 6 Transition). 2) I've made so many guides over this period regarding working from home so I will shortly be amalgamating these into a form of a new starter guide for students. Luckily we already have all of our pre-admissions email addresses in our parent communications system so when this guide is done it will be sent out via the app to all pre-admissions parents. We just need to consider a way to send their account details home.

Hello All, I hope you are all doing okay and staying safe in the current times. As it's "half term break" in some capacity now, I'm trying to look into speeding up our logon times. I've made a default profile following the James Rankin guide and placed it on the NetLogon share. This did make a difference to the first logon times which was good. I'm aware that what takes the time during the logon is the "Preparing Windows" stage where it sets up databases and file/folder structures for each modern app. I'm just curious as to what scripts we should run during the SCCM task sequence to remove these Windows 10 apps so that the fewer there are there to configure, the quicker the logon process. If you could share any useful imaging scripts you are using that would be great. Many Thanks, ITManLT.

Hi @simpsonj I'm guessing it suddenly became relevant for a lot of schools. We went down the portable MiFi hotspot route as we have an account with EE for a few already. We calculated who needed these and we have got 20 on 1 year contracts with 25GB data a month. I spoke to a manager about the number of these devices and anything they could do to help our disadvantaged students. The manager understood the situation and drastically reduced the monthly price. We are doing this approach for 2 reasons: 1) we already had an account with EE and they invoice you and you can pay via PO - this greatly appeased our Finance dept! 2) after the 1 year contract, we will have the devices to keep. So if we have any students in upper years from disadvantaged backgrounds, who do need a WiFi solution to learn we will only need to get a SIM only data deal In direct response to your question, I'm not sure if there is anything like that out there where you can just release an amount of data. save from doing something funky with EE's "data gifting/sharing" ability as if you're sharing your data with your family... Sounds potentially messy though.

Until running into this issue - nope, as SRP was running perfectly fine. I may look into it now as I read a few places that Microsoft are trying to phase out SRP as we know it in favour of AppLocker anyway. Now we have the SRP working again I will test an AppLocker policy and perhaps migrate in the future. Thanks.

Thank you for the replies to this thread. Just to come full circle and in case anyone has this problem in future. I have managed to get the Software Restriction Policy working as @jthompson suggested by copying the GPO to create a new one and selecting "Use the default permissions for new GPOs" when pasting the GPO. I then edited the scope/delegation tabs to match how we had the existing Software Restriction Policy applied (including the deny apply for our domain admin accounts). This GPO is now applying fine - with the exception of it's now ignoring the deny for our domain admin accounts.. so we cant install anything without right clicking and run as administrator! We will accept this for now, at least we have a working SRP again.

GPResult show it being listed as a denied GPO.. It has prompted me to check the GPO settings again but as shown in the attachment, these look fine too.. GPO Security Settings - Standard Station Security apply Members of Standard Station Security: It all looks to be set up correct to me. Thanks for the replies so far.

@jthompson thanks for the reply. Authenticated users are on the GPO with read. And yup, GPO status set to User Configuration Settings Disabled - which should be fine as it's a computer config we're applying.

Just double checked the specific event logs for group policy - interesting one actually.. The Microsoft > GroupPolicy event log shows the below: EventID 5313: The following Group Policy objects were not applicable because they were filtered out : Software Restrictions Denied (Security) __________________ Despite the fact that it is in the correct security group and Group Policy Modelling from the server shows it should apply...

Yep they look to be. Set to apply to a computer group called standard security. The computers are in that group. Checked the GPO Delegation tab and it shows standard security group having "Read (from Security Filtering)" permissions. If the permissions were not set correctly, the group policy modelling would have picked this up as a denied GPO with the reason showing "Access Denied (Security Filtering)". So it's definitely fine permissions wise here I think.

Hello All, Currently scratching my head with this one. We have software restriction policies in place which have been working fine in the past (Windows 10 1903). We noticed yesterday that a student in an IT lesson (clearly not doing a lot of work) decided to install Firefox and some random AutoClicker to get a high score on a game online..... (marvelous use of time). I did some testing as one of our student accounts and found that anything I downloaded - I could run... From any folder in my N: Drive. I have double checked our Software Restriction Policy in Group Policy and the N:\ drive is listed as a Disallow as expected. Within Group Policy I used the Group Policy Modelling Wizard to see which policies would apply with our test student on this machine and it shows that the Software Restriction Policy should be applying. The strangest thing is that if I log on to the computer as an admin and do a Resultant Set of Policies and choose the student test account - it shows no Software Restriction Policy being applied, and that the Security Level is set to Unrestricted! I can't figure out why this SRP is not applying. I have checked the local administrators group to see if for some reason our students group is in there, nope - just the admins we would expect. The other strange thing is in the second image, where you type an administrator account, if they just press no - IT STILL PROCEEDS WITH THE INSTALLATION!? This is obviously a pretty big security concern for me at the moment - does anyone have any ideas as to why this may not be applying? Some photos below for information too.. Thanks for any assistance!