meakjoe

We find this issue mainly on laptops, and our thinking behind it is that they lose connectivity to the WIFI on logoff, or roam between APs as they're taking them back to the trollies and they haven't finished logging off and shutting down. This then doesn't finish the log off procedure properly leaving remains of the profile including the affected registry keys. We very very rarely have this issue on desktops which are hard wired.

Check HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList for entries. We find the affected users SID in there as a key, and the 'State' reg entry under there is the one which messes it up we think. Deleting the entire key resolves the logon issue.

I don't think you need that if you have AD CS, you might need SCEP for individual device certificates, but with generic credentials and the Root CA then it should work fine. You've proved that you can join it manually from the device so your settings aren't that far out, just need to make sure the WiFi profile is using the right certificate. I've never used Lightspeed so can't advise any further on that.

I think you can leave the PEAP certificate as the one for the NPS server, and if you deploy the Root CA certificate from your DCs to the iPads, then that will trust the NPS certificate automatically. Either should work though. When I've tested this before with Apple Profile Manager, in the WiFi profile it has 2 settings, one for protocols where you set the PEAP settings and add in the username/password, and another for 'Trust' which is where you set the certificate for it to use. From within here you select the certificate to use, so just having the cert on the iPad won't work, you have to tell the WiFi profile to use it.

I would check that you have the right certificate pushed out, as computer_expert says above, you can push the root CA certificate (the same one that goes to all the domain devices I believe), and that will trust any other certificates generated by the CA. Do you use Apple Profile Manager or Xirrus to manage the iPads? You might also have to make sure that the profile for the WiFi is set up to use/trust the correct certificate, along with the generic credentials that you've entered.

You might need to look at Hybrid Azure AD Joining the machines. Its quite easily done by enabling the options on the Azure AD Connect tool, and can be done manually by adding some registry entries to test a couple of machines before enabling the option globally. The new Edge requires the machine to be Hybrid Joined to enable SSO.

Looks like there is, but I've never tried it... https://www.papercut.com/support/resources/manuals/ng-mf/releasestation/topics/device-mf-secure-print-release-assign-accounts-config.html We might look into it too.

We use the same setup, and when they print from their device and need to select a shared account, they need to go to http://.yourdomain.prefix:9191/client and login with their credentials. Once they have submitted a job, it should then appear on that webpage for them to allocate it to an account.

If you fancy a real challenge then it is possible to run Mac OS on an Intel PC... https://www.tonymacx86.com/ I've done this myself at home on both a PC and Laptop, but never tried it in an enterprise environment. I think there might be something in the Apple Ts & Cs that say their software should only be run on Apple hardware which might make it an unviable solution in a school.

I've just been working on something similar too and used the instructions found here, namely post #5... http://www.edugeek.net/forums/internet-related-filtering-firewall/182658-smoothwall-radius-accounting.html Basically have to add the APs as a RADIUS client within Smoothwall, and foward RADIUS accounting requests onto to Smoothwall from the AP. This is set up on the Unifi controller. Add an authentication policy to the port the traffic arrives on for that IP range, and set it to 'Core Authentication'. All should work quite smoothly. On the above post, they say to set it to Negotiate NTLM/Kerberos, although I haven't tried that.

We've used some of these for video chats... HUE HD Pro USB document camera for Windows Can also be used in the classroom as a visualizer when not being used as a webcam.

I've been testing this recently with RADIUS through NPS and iPads. I created a generic 'iPad User' in AD, and added that to the group which is also set in RADIUS to allow connection on the SSID I wanted it to connect e.g Student-Wifi. I then had to export the certificate for the NPS server, and uploaded that, along with the iPad User credentials into a WiFi Payload in Profile Manager. Once the iPads picked up the new WiFi payload, they could connect to the wifi straight away. Without including the certificate, there is a prompt on the iPad asking if you would like to trust the server certificate. I've only tested this so far, and is by no means the best way of doing it, however it did work. I would be interested to know if there is a better way to do it, or which certificate I should be using, if the server one is incorrect.

I followed this guide which was very helpful, might be worth running through it and checking the steps are the same... Tutorial – Deploy Always On VPN | Alex Ø. T. Hansen

There's a GPO under Windows Components -> OneDrive called 'Prevent the usage of OneDrive for file storage' that I've had to change to disabled before to allow OneDrive to work. Without doing that, the program just wouldn't launch.

Have you tried plugging it in another port in a different building, to rule out any other network issues?

Hi All, Currently looking at options in regards to shared iPads connecting to a 802.1x wireless network through RADIUS, PEAP etc. I have it working, by deploying the WiFi configuration through Apple Profile Manager, with a username and password. My question comes to the certificate part... you can upload the certificate which is selected within NPS to Profile Manager, which then means there's no prompt on the iPad to connect to the wifi. Without this you have to manually accept the certificate which we want to avoid. The difficulty I'm having with this is what certificate should this be? The main CA, the one for the server, generate one specifically for the WiFi?

Hi all, Does anyone know if its possible to change the icon on the Win 10 lock screen, when you're connecting to a VPN? This is after you have selected the small icon down the bottom right, and the screen changes to the VPN section. I've previously modified the main icon by changing a .png file within a folder, although I can't seem to find anything regarding the VPN logo online... Thanks!

With our Start Menu, we had to add StartTileGroupsColumnCount="2" into the towards the top so that our 2 groups appeared side by side. Without that you had to scroll down to see the other tiles. This didn't affect 1803, only 1903 for some reason...

I don't think we have 'Move the Contents of the Desktop to the new location' ticked as per our policies. Maybe that is trying to write the desktop back to the share and falling over there? Everything else looks good to me. You could change the REDIRECTION$ share advanced permissions to just 'Read' if you wanted to make sure they can't edit the share permissions.

We don't redirect to the Home Drive either, we have a dedicated folder which is then shared as read only and redirect to that. That way all students have the same desktop that they can't edit or save to. This is what you're trying to achieve isn't it?

This is what we use for our Student desktop redirection. Enter the UNC path where its located, make sure the users only have 'Read' permissions in the Share properties, and only 'Read' in the Security section too and all should be good.

We've had the exact issue that you describe with both Smoothwall and Chrome. The 'Establishing Secure Connection' issue we think was down to our modified profile that we sanitized and copied into the default user folder within the .wim, which was then deployed to all machines. If we replace the default profile on a affected machine with our new one, the issue is resolved. Don't bother changing the Log On details of the Cryptographic Service as that causes all manner of other problems with installing drivers and admin elevation later on. We resolved this last year when we went to the latest version of Windows 10. Normal Edge wasn't affected by this problem, although Chrome and Chromium Edge was. All is good now though for all browsers. The Proxy Tunnel issue we resolve by rebooting the Smoothwall, we haven't found any other fix as of yet. The Smoothwall doesn't show any problems when this occurs which is annoying...

+1 for Always on VPN with Machine Tunnel. Once set up it works really well and requires no input from the user. Once the Laptop has an internet connection, it knows its not on the internal domain and connects the VPN, allowing them to sign on as if they've never left the site...

Ah right no worries, thank you for your help and hope everything goes well with the hospital.

Ok thank you, with your setup, if you remove the device from the Security Group, is it not allowed to connect? I can't get it working with our set up, it's not forwarding any Computer Connection requests to the NPS server over RADIUS, it only seems to do that for users. Computer connections just go straight through with the Machine Certificate.