Windows 11 Pro units managed by Intune. Students are not admins on the machines. We discovered a few students today who have been able to install duckduckgo on their machines. Have any of you seen this issue? Any recs on how to stop this?

Hi k12SysAdmin family,

Is anyone here using GLPI or Zammad as a helpdesk/ticketing system?

I’d love to hear about your experience with either platform, especially:

• Pros and cons
• Number of users
• Number of agents
• Average tickets per day
• Overall environment/setup
• Performance and reliability
• Any issues or limitations you’ve encountered

If you’ve used both, I’d especially appreciate a comparison between GLPI and Zammad.

Is anyone else with Lenovo Chromebook Plus 2-in-1 devices having sporadic fingerprint sensor issues? It will work for a day or two, and then stop working. After a powerwash, it will work again for a while. Some users have no issues; others have them all the time.

On the surface, it seems like a hardware issue, but it always works after a powerwash, which makes me think maybe not?

If anyone has any ideas or a solution, I am open to suggestions.

Recently I've noticed huge swings in pricing on some Cisco phones from our CDW sales guy. I'm talking like a $300 swing in price, up and down. We are piggybacking off the " Irvine USD 23/24-01 IT Technology Equip & Periph (#23/24-01 IT)" contract.

It's got me wondering, what does the piggybacking really mean? Of course prices are going to fluctuate over time, we've seen it in every tech product across the board, so what exactly is the contract gaining us? Looking into the contract details is more complicated than I had thought so I thought I would ask for a basic explanation here.

Happy Monday, everybody. This place has become indispensable for me for seeking advice and such. So now I need some advice.

Each of our classrooms in the elementary school is fitted with an Epson 922F projector that have full Wi-Fi capabilities and such. Also attached to these projectors are Roku sticks. Which has served us well over the last seven or eight years. But now we’re running into limits with our Wi-Fi network because these Roku’s love to attach at the 40 MHz Spectrum.

Does anybody know of a device aside from the Roku ultra that we can purchase that is supported on Wi-Fi six and does all the same things that Roku does. I can’t afford to break the bank.

Thank you in advance…

I probably get two or three a day saying someone signed into their account from a suspicious login. Do you do anything about those? Do you have a cyber security person on staff to actually review these? do you just assume they are logging in using a VPN? I am just curious how involved with these alerts I should be.

Does FACTS finally have SSO support yet, and is anyone using it? With the recent push for MFA every 24 hours, staff is getting annoyed. We would like to relinquish back control over the login process, as well as simplify login; for staff and preferably students.

We're what I like to call an "Everything" shop in terms of IDP. We have AD, Entra, Google, and Duo (On-Prem AD is the source of truth that pushes out to everything else).

I'd ask our SIS admin to email RenWeb, but don't feel like putting him in the 6th circle of hell - that is RenWeb support.

Hi all, sysadmin (part-time, wearing many hats) at a small school trying to make a sensible call on a laptop refresh. Would appreciate some input.

Small school, ~10 new teacher laptops. Comparing:

• Dell Pro 14, Ryzen 5 220, 16GB/256GB for €1080, 5-year off-site support, accidental damage flat-fee €50
• Framework 12, Core 5, 16GB for €1200, only 2-year warranty, but everything's user-replaceable. Currently loads of NVME SSD’s laying around in stock.

Our current 50-device Dell fleet has had 8 issues + 3 accidental damages over 5 years, so failures are genuinely rare here, and the off-site support isn't fast turnaround anyway.

Two things I can't figure out on my own:

1. Cost-wise, does Framework actually come out ahead once you factor in self-repair after year 2, or does one bad mainboard swap wipe out the savings? Curious if anyone's tracked this in practice.
2. Part of the appeal for me is just liking the idea of full control over the hardware, being able to fix it myself, cannibalize parts from a dead unit, not depend on a vendor. Is that a legit reason to lean Framework for a small school fleet, or is it me romanticizing repairability for a device that, statistically, will almost never break?

Would love to hear from anyone who's actually lived with Framework post-warranty, or who has decided against getting Framework themselves.

Hello,

I took over a small private school's SysAdmin role which includes their PowerSchool SIS. Looks like their former PowerSchool admin/registrar entered everything by hand for new students (problem to solve later); and so when I was updating the emails of parents under:

Student Profile>Contacts>Contact Management

and adding mom and dad's emails, it swaps only a handful of siblings? 5th graders are now 7th graders, the profile names stay, but the names change?
Has anyone seen this before? Or know what I'm doing wrong?

I'd make a support ticket with PowerSchool but I'm not the District Admin yet and can't create a support case in the new "Community Center" and the AI bot just tells me to undo what I did...

Thanks,

We are a Google environment. I have one user with an iPhone Xr that keeps getting the error message "Your Apple Account does not support the expected services on this device."

No one else has this issue, I have double checked all of our settings against the Apple documentation and they check out. No one else has this issue. Additionally I attempted to sign in with my account and received the same error.

Does anyone have any ideas? Thanks

One I haven't seen before. I use groups for each class/grade to simplify the invite process for the teachers. Students members, teachers managers. All addresses are internal to our domain. It's been working for years this way. This year, one homeroom teacher does her invite, and GC only shows the co-teachers as invited. I set up a test class on my own and duplicated the result (Yes, I made sure I was inviting students, not co-teachers). Only the teachers/managers show as invited IN GC.

Now for the bizarre part ... the e-mail logs show that the invites went out normally. Someone have the right voodoo doll for this one??

My classrooms have Viewsonic IFPs with a Windows VPC. Admin has asked about Document cameras for the teachers to use. Any recommendations on brand or special features? I believe that the myViewboard software will allow document camera use within the software, so teachers do not have to change inputs

We just started with Ubiquiti and I set up our guest network to use vouchers. I was able to create 10 vouchers that last 8hrs. However, I have a dumb question. Where do we go to actually print the vouchers?

I work for a k12 private school and we have come across a recent ish issue on our campus. We have a program our school provides called Flex where kids k through 12 can take all their classes online (+ have 1 or 2 in person ie. art, band etc). The program is completely BYOD. Our full time in person students get iPads. The other cool thing about this Flex program is that it allows the students to spend up to 21 hours on campus a week, so they can have friends, go to lunches, assemblies, etc. If they are on campus during a regular period, they are expected to do their work on campus, but on their BYOD device. So, Flex has 4 classrooms meant for them where they can have a total of almost 120 student (k-12) across the 4 rooms.

Long story short, the issue is that our WiFi cannot seem to keep up. Every room has a FortiAP 431F. We have a special 5 ghz SSID for those 4 rooms called Flex. We get calls and tickets all the time about the Wifi not working in there, and when I go in, 1 to almost all the kids will not be able to load anything. All they are doing for context is Canvas and Zoom.

I have tried changing channels, Wifi settings like fast roaming, updating AP firmware to beta. I have basically tried what feels like everything. I am starting to think it is the student devices, as the BYOD devices they bring range from an HP Stream 14 to MacBook pros. And I think kids with the much cheaper and crappier devices are slowing the wifi for everyone else on that radio or AP. Anyone have any pointers or ideas on how to resolve this? Any help would be appreciated!

I am in the process of purchasing a 2-in-1 Chromebook for staff to trial as we look at replacements for their desktop + touchscreen monitor. I was debating between the Acer Chromebook Plus 714 Spin or the Lenovo Chromebook Plus 2-in-1 14". I plan to also purchase a pen for the device.

My problem is trying to find a reseller for the consumer version, as it is half the price of the enterprise version. Our superintendent cannot fathom spending more than $800 on any device, even though staff machines are between 6-8 years old and many still run a 20 year old Smart ID350 screen. But we can spend plenty on a new gym floor, cameras, and tables in the office that can raise and lower.

Is there really that much of a difference between consumer and enterprise versions of those Chromebooks? Internals and everything seems the same. I can purchase a Google OS license to add them to the admin console. What am I missing? Resellers are only able to quote the enterprise versions.

Does anyone purchase consumer grade Chromebooks for staff? We mostly buy the Lenovo or Dell 11" education Chromebooks for students. I will never convince them to buy a $1K+ laptop for a teacher. Even if I get the consumer price, they will probably only be willing to replace 5-10 a year (730 student school).

Starting to feel very frustrated with our school admin honestly. Every other school around us buys IFPs or has a 5-year replacement cycle. Our strategy is use it until it dies. So, we have no uniformity between rooms. Hell, we stock K-4 carts with 4 year old 1:1 Chromebooks since they get a new device in 5th and 9th grade. Even avoided a big server bill by moving us to Intune/Google Drive. I am at a loss on trying to tell them shit aint cheap lol.

Sorry for the last paragraph rant. Frustrated for the teachers.

Looking for some advice since this is out of my wheel house....

We are a google school, on prem-AD that syncs to Google. We have P1 accounts for SSPR and Writeback, so every student has an Entra account. The typical work flow is they set their SSPR account online, that writes back to on-prem AD, which then syncs with Google. It's been working well, everyone is happy.

I just learned about the MyStaff.microsoft.com feature where I can delegate access (like a librarian) to be able to reset passwords, too. I set up the Administrative Unit, added a test user, gave it Password Reset permissions, gave it a group to manage, but when I login and try to reset a random student in that group as that user the "Reset Password" option is greyed out.

There must be some security setting somewhere I'm missing. Any ideas?

Edit: I think I figured out most of the issue - the AU that I made has no members. I put the student I was trying to reset as a User in that group and now I can reset that password. But I had added the "Students" group as a group in that AU so I'm not sure why it's not reading the users in that group?

How do y'all go about testing dual credit class requirements from different colleges to make sure there classes, testing software and video links all go through your filter.

---> MacOS 1:1

---> Intune MDM

----> lightspeed filter

More curious about methodology, diagnostics and the course you take since sometimes not having access to what the student has access too can be cumbersome.

We wrote this to answer "how bad is it" on day one of a new client. One Python file, drives GAM7, every command a read, out comes a self-contained HTML report plus CSVs for the raw data.

Ran it on our own clients for about six months before putting it on GitHub. Then the google-apps-manager group got hold of it and started pointing it at tenants shaped nothing like ours, and the bugs turned up. Three fixes in the nine days since it went public. It was telling super admins off for app passwords they didn't have. It filed modules it had already checked under "not checked". And it read Google's default password policy as the tenant's own, so a tenant that had hardened its password rules came back flagged as weak. That last one took two of the GAM maintainers to explain (the Policy API hands back every policy that could apply to an OU, not the one that actually wins).

Nobody has run it against a school that I know of. Student OUs, thousands of Chromebooks, shared kiosk accounts, guardians sitting in groups: those are the shapes I'd expect it to get wrong, and I have no tenant of this size to test them on.

What it looks for: files public on the web, mailboxes forwarding off-domain, super admins without 2SV, shared drives with no manager, groups anyone can join or post to, licensed accounts nobody has ever signed into, OUs where policy blocks 2SV enrolment, domains with no DMARC. Anything it couldn't check gets printed as not checked, so a missing finding never reads as clean.

Read-only, standard library only, runs on Windows, macOS and Linux, no install beyond having GAM7 already working.

https://github.com/PaulOgier/GAMScripts/tree/main/Tenant%20Scoping%20Audit

If it falls over or says something daft about your tenant, a GitHub issue or a comment here both reach me.

Thanks for your time.

We are setting up our Ricoh IM 8000 (and eventually Rioch IM C6000) with Microsoft Universal Print and have run into an issue with the Ricoh App for Universal Print. We currently have an on-prem print server that we would like to retire and just depend on Microsoft Universal Print instead.

Our current authentication configuration is:

• User Authentication Management: User Code Authentication
• Copier Function: Restrict
• Printer Function: Do Not Restrict
• Document Server: Do Not Restrict
• Scanner Function: Do Not Restrict
• Browser Function: Do Not Restrict

For the copier, we intentionally use a shared 4-digit User Code for staff. Our primary goal is simply to prevent students from walking up to the machine and wasting paper/toner by making unauthorized copies. We are not trying to use the code for individual staff accountability.

When we launch the Ricoh App for Universal Print from the Ricoh Application Site, we receive:

“This function is not available because user authentication has been set. Please contact the administrator. The application will be closed.”

Our Printer Function was originally set to “PC Control” but we changed it to “Do Not Restrict” and rebooted the machine, but we receive the same error.

From what we've found, it appears the Ricoh Universal Print app requires MFP User Authentication Management to be disabled, which would unfortunately remove the authentication barrier on the copier as well.

Our desired setup is:

1. Staff should still have to enter the shared 4-digit code when using the Copy function, primarily to prevent students from using the copier and consuming paper/toner.
2. We do not want to require staff to type their Microsoft Entra email address/password at the copier, and we are not interested in introducing badges/NFC cards.
3. We want to use Microsoft Universal Print as our print manager

Any suggestions on how to solve this issue?

Best of luck y'all. Now it gets real. Five full days, full learning, testing, and curriculum tech use.

May your resolutions be swift and effortless!

Hello, everyone. I recently posted about needing help deploying AutoCAD on Intune and quite a few of you had the same problem. I tried and failed using quite a few methods and kept looking around until I found: https://www.shernet.com/intune/deploying-autodesk-autocad-2023-with-intune/

I had already attempted something similar to this that kept failing until I fixed the install and uninstall commands as well as the detection method. I successfully deployed AutoCAD and Revit 2026 to a test machine’s Company Portal and installed from there. A couple of other people were also able to install from their portals.

I’m not sure if this was the right way to post it or if I should have commented on my original post. I just wanted to get it out there for others who were also having this problem. Thanks to the people that helped me in the other post! I’m documenting this for my team and am happy to help others with this issue.

Our school district refuses to purchase smartboards for classrooms due to cost of the hardware and mounting. We still have most rooms with the super old Smart ID350 screens. I have been replacing those as they die with either a Surface Pro with mirroring to the projector or an ELO 24" touchscreen. Teachers really like the ELO screens. They love the Surface for a couple of years until they realize battery life is bad after that.

Surface Pros are getting very expensive, especially after adding the keyboard and pen, and the ELO screens are still well within budget. I am looking at some alternatives. As it stands, each teacher has a computer at their desk and a computer at the front of the room with the touchscreen. We also issue them a standard 11" Chromebook like the students.

So, most teachers have 3 computers, which I think is absurd. I was thinking maybe we can do an Idea Tab or something like that and have them use the Annotate extension to be able to write on the screen with a pen. The ELO screens are very well build and work very nice, but I am hoping knock them back down to 2 computers so we aren't wasting resources.

If you don't use a smartboard, what do you use? Any opinions on different tablets that allow the teacher to be more mobile in the classroom?

How does everyone deal with users having the same names when creating email accounts?

We had been using the middle initial, but what happens when someone doesn’t have one? What do you do then?

My boss said just put an 01 on the end, but that looks like it would be hard to keep track of too.

We are trying to get onesync setup, but she asked me the same thing.