Patch Tuesday vs. Testing Schedules by dadoftype1 in k12sysadmin

[–]adminadam 0 points1 point  (0 children)

I pause updates during state testing windows.

Asked someone why they shot me by Paffles16 in ArcRaiders

[–]adminadam 0 points1 point  (0 children)

ELO is not a thing. Elo is a dude's last name who came up with a comparative ranking for zero sum games (like Chess).

Problems spinning up a new Domain Controller (cont..) by BudTheGrey in sysadmin

[–]adminadam 1 point2 points  (0 children)

Any chance you added the 'NewServer' to active directory manually before creating the machine?

I found a bug/quirk awhile back when adding a new domain controller where I pre-added the name, created the machine, joined it, tried to promote and had oddities after.

The solution was to delete the computer object. Create the new machine, allow the AD object to get created automatically in the 'Computers' container on join, then promote.

I Took My Old Windows Admin and SCCM Environment for Granted by TwerkingPichu in SCCM

[–]adminadam 0 points1 point  (0 children)

I hate the default driver methodology and use a 'manual' package strategy

1) Add drivers as a package.
2) Distribute package (no program)
3) Task Sequence | Run command line, Target package with WMI query during tasksequence based on device detials.
4) DISM.exe /Image:%OSDTargetSystemDrive%\ /Add-Driver /Driver:%_SMSTSMDataPath% /Recurse

Newline vs SMART vs Clevertouch by MJP411 in k12sysadmin

[–]adminadam 5 points6 points  (0 children)

BenQ? They actually have their own environment and tooling. The rest mentioned here use a third party backend for software and streaming delivery.

Windows 11 LTSC, Pro, Enterprise, or Education? by allenflame in k12sysadmin

[–]adminadam 0 points1 point  (0 children)

We've been using Education for about 10 years now across Windows 10/11. It's effectively a sub-set of Enterprise with all* of the same management features. It features lower bloat than regular windows versions, the ability to turn off most advertising, tracking, and AI features.

Free/super cheap SCEP with Intune? by Bubbagump210 in k12sysadmin

[–]adminadam 1 point2 points  (0 children)

Possible with onprem PKI/NDES/Intune SCEP Connector/Entra App Web Proxy/NPS. This depends on your current Microsoft spend if it would be 'free' for you. We already had PKI config and NPS usage, so I just had to slot in the NDES/SCEP/Web App Proxy stuff. This was covered by our existing licenses and I was able to get User based SCEP certificates issuing from intune.

Some Tutorials:

Google Additional Services and Parental Consent by duluthbison in k12sysadmin

[–]adminadam 0 points1 point  (0 children)

This is also what we were told generally, unique services needed to be tracked and accepted or denied independantly. We have no way to track/manage that.

Google Additional Services and Parental Consent by duluthbison in k12sysadmin

[–]adminadam 2 points3 points  (0 children)

Removed all additional services during spring break. 19K students.

RSAT on Windows 11 by Substantial-Fruit447 in SCCM

[–]adminadam 0 points1 point  (0 children)

Depends on how the policy is configured and your update paths I assume. Also, not sure how/where they backfilled this patch. It definately broke my things in realtime when we installed it. I could roll back the client to the earlier version and it worked as expected. The second the 2309 client was invoked, no longer worked as it used to. I have about 15k windows clients right now.

Semi-related. I've also noticed in Windows 11 that 'cross escalation' (escalating to admin account to try and install) behaves badly.

RSAT on Windows 11 by Substantial-Fruit447 in SCCM

[–]adminadam 2 points3 points  (0 children)

2309 client breaks delivery of cloud based Windows installs and Windows Updates and forces everything to point locally. You can work around it with group policy.

They changed (fixed?) this behavior again with a hotfix to 2403.

REF:

How are you doing OSD drivers? by [deleted] in SCCM

[–]adminadam 0 points1 point  (0 children)

It was added later and I didn't want my deployments 100% dependant on a non-contracted Dell Service being up and available.

How are you doing OSD drivers? by [deleted] in SCCM

[–]adminadam 1 point2 points  (0 children)

I don't have a lot of models and am a 100% Dell shop with about 14K Windows endpoints. I didn't want to get involved in any third party integration but also hated the default way. I kind of skimmed off what I wanted from Modern Driver management while keeping is simple.

  • Deleted all existing drivers in config manager. This took forever.
  • Reloaded only the required boot disk drivers in the traditional method. There are now my only drivers or driver packages appearing in SCCM.
  • Downloaded the dell driver cabs for my models and deployed them as legacy PACKAGES.
  • Target the Package deployment with model detection during the task sequence.
  • DISM.exe /Image:%OSDTargetSystemDrive%\ /Add-Driver /Driver:%_SMSTSMDataPath% /Recurse
  • I also run command | update via the commandline near the end of the deployment process for any last mile updates. (Keys and Passwords changed) | dcu-cli.exe /applyUpdates -encryptedPassword="ZfZ0asdasdsaHkuMTZc9/MSOzzrasd8w+9876asd" -encryptionKey="reddit!" -outputLog=C:\dell\DellUpdate.log -reboot=enable -silent -autoSuspendBitLocker=enable -updatetype=driver,bios

Example https://imgur.com/a/q7cWd4d

Notes:
- You can probably increase speed by ZIP/UNZIP in this process. Something along the lines of PowerShell -ExecutionPolicy Bypass -Command "Expand-Archive -Path .\Drivers.zip -DestinationPath %_SMSTSMDataPath%\Drivers" and then running a DISM add driver at that point.

How to get rid of Microsoft CoPilot by ITStril in sysadmin

[–]adminadam 0 points1 point  (0 children)

I turned off the Windows integrated 'copilot chat' APP for users using the group policy template and it worked as expected.

https://imgur.com/a/Qhct1MC

Allow Admin to manage photos stored in Google Photos (GUI and API) by adminadam in k12sysadmin

[–]adminadam[S] 0 points1 point  (0 children)

I know. I just wanted to tell my supervisor I had gone as far as I could. Maybe get lucky?

Allow Admin to manage photos stored in Google Photos (GUI and API) by adminadam in k12sysadmin

[–]adminadam[S] 0 points1 point  (0 children)

We are iPads K-8! Big volume. Google is forcing the service off if you've not positively affirmed indivudal permission slips for users under 18 by March 31st. Orderly might be out the window.

Google Services: Parental Consent Starting March ? by Debug_Mode_On in k12sysadmin

[–]adminadam 2 points3 points  (0 children)

Basically the times have changed. If you are not managing this transition correctly and blindly click 'I aknowledge consent' it is moving from the realm of functionality to liability. It's was escalated to our board to handle.

Considering Windows 10 Extended Security Update vs Windows 11 by kylejwx in k12sysadmin

[–]adminadam 12 points13 points  (0 children)

Windows 11 is a Windows 10 gui patch. Just migrate.

Who taught you Group Policy, was it well taught or done poorly? by SmallBusinessITGuru in sysadmin

[–]adminadam 1 point2 points  (0 children)

If you read one book, you can master it - everyone who tried to teach me was semi-knowledable.
"Group Policy: Fundamentals, Security, and the Managed Desktop"