SimonInOz

Hi, We have some extensive group policy implemented at our school, including Google Chrome policies which lock Chrome down. In relation to the browser history, I have put a setting in to prevent the deletion of it. Does anyone know if there is a way to bypass these settings and use Chrome natively without restriction? Cheers

Hi Paradigm, I ended up using a tool called PDQDeploy. I set up a step which included the following command: MinecraftEducationEdition_x86_1.12.0.0.exe /exenoui /q AI_DESKTOP_SH=1 Worked ok for me.

Hi Dave, is this procedure still valid? I went to the Minecraft download page, and the only download is an actual installer. Cheers

Hi, We have disallowed the use of the 'run' command by group policy, which has also prevented me from running powershell scripts from group policy pointing to any server drives or \\ locations for the ps1 files. (Example: \\server\share\test.ps1 or X:\share\test.ps1 etc) How do you all deliver or run powershell scripts if you have disabled the run command? Many thanks.

Thanks, does this allow us to connect them to O365 with their domain account still?

Hi, Using W10 Edu 1809 in a domain setting with group policies. Is there any way to prevent students from adding their own personal Microsoft accounts to Windows? (Email & Accounts in settings). Cheers

Thanks Arthur, we use mostly Adobe/O365 plus a few other apps, so I am guessing this would be safe for that sort of environment? I will need to do some testing, but looks pretty comprehensive. many thanks for the link and post. Cheers.

Hi, I have been using SRP's in a W10 EDU domain environment. According to this article: https://www.bleepingcomputer.com/forums/t/679012/microsoft-planning-to-scrap-software-restriction-policies-feedback-this/ These are gone, or going. The replacement suggested, Windows Defender Application Control doesn't seem to be for EDU machines: https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control Just wondering if anyone else is in this position, and what you are using as a replacement. We do have some webroot licenses, but not enough and I would have to buy more. (not that thrilled with it TBH). Anyone using Sophos Endpoint? Cheers

Man, that was it. Sometimes, it is hard to see the wood for the trees right? You saved me some hours troubleshooting something that was pretty straightforward. Thanks for putting your eyes across this and assisting. Cheers!

I did it pretty much as stated here: Running PowerShell Startup (Logon) Scripts Using GPO | Windows OS Hub

I have already selected Skype in application control, it is not stopping it.

Yes, it is already selected and saved as part of the group policy object.

Hi, Will having a group policy to remove the 'Run' item from menus, thus preventing UNC path access also affect the running of powershell scripts from a UNC location? I cannot get a powershell script to run on a user workstation, it is a computer policy which has security filtering added to tie it to specific computers. Further info: The script is in the 'powershell scripts' tab, not the 'scripts' tab Script Name: %windir%\System32\WindowsPowerShell\v1.0\powershell.exe Script Parameters: -Noninteractive -ExecutionPolicy Bypass -Noprofile -Confirm:$false -file %~dp0test.ps1 (the %~dp0 is supposed to convert this to a UNC path on the scripts directory on SYSVOL.) Anyone have any ideas? I just want to remove some microsoft store apps from a user workstation. Does a computer policy automatically run as the SYSTEM user? Will this affect its ability to remove apps from a user login? Cheers

Hi, We have an setup where students have W10 Edu, and despite all my efforts at stopping it, Skype still seems to be runnable. I have tried locking down executables, applocker, registry setting changes, uninstalling it via powershell, group policy, Sophos UTM9 changes. It still runs. Is there any way to prevent use of Skype (both Business and Store version) on a W10 domain pc? I am totally frustrated with this one, and despite research cannot stop it from being used. If anyone has a detailed map on how to stop this, it would be a great day for me. Happy to try anything really. Thanks a lot. This is what is running according to remote process explorer: SkypeApp.exe,10256,276,1,095,29,8,C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.44.40.0_x64__kzf8qxf38zg5c\SkypeApp.exe,7,221 K,0:00:8.796,282,308 K,3.40%,285 K,102,630,1 K,0 K,1,663,611,15 M,3 M,10,048,223 K,15/08/2019 9:02:29 AM,"C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.44.40.0_x64__kzf8qxf38zg5c\SkypeApp.exe" -ServerName:App.AppXffn3yxqvgawq9fpmnhy90fr3y01d1t5b.mca BTW, I have Sophos UTM9 which does a very poor native job of blocking skype, even though skype and SFB are included as blockable items. In fact, my students can run the windows skype easily, while SFB has issues running for staff and teachers...... yeah.

Yes, I did this and have had no luck with it.

Hi, Using Outlook 2016, latest updates. Trying to share a calendar, for a new account which was created just to share the calendar with staff. I have added permissions to the calendar for staff, and this has included Publishing Editor and Reviewer. Each time I try to send a link to a person who has been added, it shows an email with 'Sharing Invitation' in the title, and a further opportunity to 'Allow Recipient to View Your Calendar' box (checked) with options of : 'Availability Only', 'Limited Details' and "Full Details' If I select any of these, and send it off to the user, their permissions get set to 'Custom' with no ability to add any entries to the calendar. I have tried adding one person as a 'delegate' (File/Account Settings/Delegate Access) but this does not change their overall rights/permissions. I am going round in circles here, can someone point me in the right direction to set the right permissions so someone can add entries to the 'shared' calendar? I have also looked at powershell Get-MailboxFolderPermission -Identity schoolplanner@:\calendar |fl This shows: RunspaceId : d4680e04-b1ab-4db3-99ca-a38fb08a3d4bIdentity : School Planner:\calendarFolderName : CalendarUser : AccessRights : {Editor}SharingPermissionFlags : DelegateIsValid : TrueObjectState : New Help?

Thanks, can you provide some links on azure connect in relation to getting it up and running? Many thanks

Hi, We use W10 Educational, v1803 currently in a domain setting. When users change their passwords, they then go to OneNote, OneDrive, Store, Email and update the password in the box(es) provided and save it etc. Is there any way to propagate a new password so it feeds into these applications automatically? Some of the students just don't do it (update the password), and end up back in IT because the app is 'not working'. They also save their password into Chrome, but that is easily updateable so not a huge issue. I just need a way to have them change their password, and just do it once. Is that even possible? Cheers all.

No probs, thanks all.

No, don't think so. We are not on premises exchange, do it all through O365/Powershell now.

Ok, I cannot seem to do this for any other users apart from myself on Powershell. How do I give myself enough rights to see other users calendars? Is it even possible?

hmm, command didn't work for the user I wanted to look at, but did for my own. Not sure why, will have a look at it. It says the specified mailbox does not exist. It does, he is a colleague and he is definitely on AD and O365 as a user with a mailbox.

Hi, thanks for all that. I just tried the first command, and it doesn't like the -Recurse parameter. (The command without the -Recurse works fine btw) Also, once permission is given, how does the end user access the calendar?

Hi, Is it possible to give users access to a calendar belonging to a staff member? The person is away on leave ATM, and I cannot contact him. I believe the calendar is one he created, so is it possible to view that with powershell. This shows for a given user, but does it show for calendars they have created and shared themselves?: Get-MailboxFolderPermission -identity “username:\Calendar” Hope this makes some sense. I don't want their personal calendar details. Cheers

We do have this currently set, also users. I was hoping for some other ways to block. Cheers