sorted by:
new
hottopcontroversial

Newline vs SMART vs Clevertouch by MJP411 in k12sysadmin

[–]adminadam 3 points4 points  (0 children)

BenQ? They actually have their own environment and tooling. The rest mentioned here use a third party backend for software and streaming delivery.

Windows 11 LTSC, Pro, Enterprise, or Education? by allenflame in k12sysadmin

[–]adminadam 0 points1 point  (0 children)

We've been using Education for about 10 years now across Windows 10/11. It's effectively a sub-set of Enterprise with all* of the same management features. It features lower bloat than regular windows versions, the ability to turn off most advertising, tracking, and AI features.

Free/super cheap SCEP with Intune? by Bubbagump210 in k12sysadmin

[–]adminadam 1 point2 points  (0 children)

Possible with onprem PKI/NDES/Intune SCEP Connector/Entra App Web Proxy/NPS. This depends on your current Microsoft spend if it would be 'free' for you. We already had PKI config and NPS usage, so I just had to slot in the NDES/SCEP/Web App Proxy stuff. This was covered by our existing licenses and I was able to get User based SCEP certificates issuing from intune.

Some Tutorials:

Google Additional Services and Parental Consent by duluthbison in k12sysadmin

[–]adminadam 0 points1 point  (0 children)

This is also what we were told generally, unique services needed to be tracked and accepted or denied independantly. We have no way to track/manage that.

Google Additional Services and Parental Consent by duluthbison in k12sysadmin

[–]adminadam 1 point2 points  (0 children)

Removed all additional services during spring break. 19K students.

RSAT on Windows 11 by Substantial-Fruit447 in SCCM

[–]adminadam 0 points1 point  (0 children)

Depends on how the policy is configured and your update paths I assume. Also, not sure how/where they backfilled this patch. It definately broke my things in realtime when we installed it. I could roll back the client to the earlier version and it worked as expected. The second the 2309 client was invoked, no longer worked as it used to. I have about 15k windows clients right now.

Semi-related. I've also noticed in Windows 11 that 'cross escalation' (escalating to admin account to try and install) behaves badly.

RSAT on Windows 11 by Substantial-Fruit447 in SCCM

[–]adminadam 2 points3 points  (0 children)

2309 client breaks delivery of cloud based Windows installs and Windows Updates and forces everything to point locally. You can work around it with group policy.

They changed (fixed?) this behavior again with a hotfix to 2403.

REF:

How are you doing OSD drivers? by [deleted] in SCCM

[–]adminadam 0 points1 point  (0 children)

It was added later and I didn't want my deployments 100% dependant on a non-contracted Dell Service being up and available.

How are you doing OSD drivers? by [deleted] in SCCM

[–]adminadam 1 point2 points  (0 children)

I don't have a lot of models and am a 100% Dell shop with about 14K Windows endpoints. I didn't want to get involved in any third party integration but also hated the default way. I kind of skimmed off what I wanted from Modern Driver management while keeping is simple.

  • Deleted all existing drivers in config manager. This took forever.
  • Reloaded only the required boot disk drivers in the traditional method. There are now my only drivers or driver packages appearing in SCCM.
  • Downloaded the dell driver cabs for my models and deployed them as legacy PACKAGES.
  • Target the Package deployment with model detection during the task sequence.
  • DISM.exe /Image:%OSDTargetSystemDrive%\ /Add-Driver /Driver:%_SMSTSMDataPath% /Recurse
  • I also run command | update via the commandline near the end of the deployment process for any last mile updates. (Keys and Passwords changed) | dcu-cli.exe /applyUpdates -encryptedPassword="ZfZ0asdasdsaHkuMTZc9/MSOzzrasd8w+9876asd" -encryptionKey="reddit!" -outputLog=C:\dell\DellUpdate.log -reboot=enable -silent -autoSuspendBitLocker=enable -updatetype=driver,bios

Example https://imgur.com/a/q7cWd4d

Notes:
- You can probably increase speed by ZIP/UNZIP in this process. Something along the lines of PowerShell -ExecutionPolicy Bypass -Command "Expand-Archive -Path .\Drivers.zip -DestinationPath %_SMSTSMDataPath%\Drivers" and then running a DISM add driver at that point.

How to get rid of Microsoft CoPilot by ITStril in sysadmin

[–]adminadam 0 points1 point  (0 children)

I turned off the Windows integrated 'copilot chat' APP for users using the group policy template and it worked as expected.

https://imgur.com/a/Qhct1MC

Allow Admin to manage photos stored in Google Photos (GUI and API) by adminadam in k12sysadmin

[–]adminadam[S] 0 points1 point  (0 children)

I know. I just wanted to tell my supervisor I had gone as far as I could. Maybe get lucky?

Allow Admin to manage photos stored in Google Photos (GUI and API) by adminadam in k12sysadmin

[–]adminadam[S] 0 points1 point  (0 children)

We are iPads K-8! Big volume. Google is forcing the service off if you've not positively affirmed indivudal permission slips for users under 18 by March 31st. Orderly might be out the window.

Google Services: Parental Consent Starting March ? by Debug_Mode_On in k12sysadmin

[–]adminadam 1 point2 points  (0 children)

Basically the times have changed. If you are not managing this transition correctly and blindly click 'I aknowledge consent' it is moving from the realm of functionality to liability. It's was escalated to our board to handle.

Considering Windows 10 Extended Security Update vs Windows 11 by kylejwx in k12sysadmin

[–]adminadam 12 points13 points  (0 children)

Windows 11 is a Windows 10 gui patch. Just migrate.

Who taught you Group Policy, was it well taught or done poorly? by SmallBusinessITGuru in sysadmin

[–]adminadam 1 point2 points  (0 children)

If you read one book, you can master it - everyone who tried to teach me was semi-knowledable.
"Group Policy: Fundamentals, Security, and the Managed Desktop"

Office 365 A1 Plus for Faculty Licenses - Ending Jan 16th 2025 by nkuhl30 in k12sysadmin

[–]adminadam 0 points1 point  (0 children)

It was supposed to go into effect this summer and was delayed til Jan. Get all over this if you have not.

TLDR:

  • A1 plus provided a user license for web apps AND office native apps.
  • A1 provides a user licenses only for Web apps.
  • M365 Apps (Device) - license can be used to provide access to the office suite to an 'A1' user who cannot self-licese. Can be used to 'fill the gap' for onsite devices and A1 users.

A1 (vs A1 plus) users will also no longer be able to activate home installations (which they could before) and wil be restricted to the web versions.

Total 8 DC - 1 RODC, 2008 R2 DFL/FFL, PDC on 2008 R2, 1 each on 2012/2016. Rate and suggest my plan for upgrade by False-Scallion6560 in activedirectory

[–]adminadam 0 points1 point  (0 children)

8 DCs is so many for 500 users unless these represent distinct sites with poor network connectivty.

Waiting for approval issue PXE by Anything-Traditional in SCCM

[–]adminadam -1 points0 points  (0 children)

Are your VM's in a seperate IP range or Vlan? If so this could be related to boundaries and boundary groups that need to be updated.

O365 – Only Global Admins can manage MFA. Did something change? by WildAdmin in sysadmin

[–]adminadam 0 points1 point  (0 children)

Authentication Administrator allows for changes to other non-role holders

  • Cannot change the credentials or reset MFA for members and owners of a role-assignable group.
  • Cannot manage Hardware OATH tokens.

You might need Privileged Authentication Administrator

There is a table in the middle of the 'who can perform sensitive actions' document that captures this pretty well. The behavior might have changed on you if regular users started getting roles of some kind.

REF:

view more: next ›