MDM for Surface RT/Surface 2 tablets

[Matt]

Hi guys,

My company supplied IT equipment to schools. Recently we have been supplying tablets on demand and have experience with large scale android and iPad deployments.

We also have a few customers with surfaces. We have just received an order for 60x Surface 2 tablets. These will be shared by the pupils and stored at the school and charged in cabinets.

We have used MDM software Maraki to manage and deploy apps to iPads and androids. Any one had any experience with something similar for RT? The idea is to end up with 60 identical tablets that are used for apps and web browsing. I think the plan is to create the same MS account on all devices then setup child accounts on them to provision approved apps. There will be a linked AD user account for the student account allowing them to save files on the file server.

Is there a volume license purchase scheme for RT apps? (Apple have the VPP which gives discount on purchase of 20 apps or more). I know that in this environment each tablet needs is own purchase of the apps. Just cant seem to find the right platform. InTune apparently has some management features but I think the customer has to pay for that....

Any tips, tricks or advice?

 

[jnjroach]

I would recommend Intune, if the customer has an EA and is using System Center they can manage these using Intune/Config Manager Integration.

Their EA should allow side loading.

Here are some resources:

Deploying Windows RT 8.1 in Schools:
http://www.microsoft.com/download/details.aspx?id=41643

Windows Store Apps in Education:
http://www.microsoft.com/download/details.aspx?id=39685

 

[Matt]

Thanks! That will help. Most of the schools we deal with are primarys though and relatively small so don't have EA or system centre as they are mainly single server environments.

We may have to change this if intune provides the needed functionality

 

[jnjroach]

Intune gives full MDM cross platform....it is very cost effective...

 

[Matt]

Cool I will give it a look. Thanks for the info

 

[Matt]

Sorry to resurrect an old thread but I have run into a few speed bumps.

One is that InTune, while great, seems to be hard to get educational pricing for. For example I am having to redo a surface RT configuration setup by someone else, they have 87 Surface RTs in a shared scenario. To use Windows Intune at £3 per device per month is an unacceptable level of cost (this is a primary school and once deployed only the occasional app will need to be added).

The second is that while following the guide listed http://www.microsoft.com/download/details.aspx?id=41643 for RT in education. The crucial points refer to needing a Sideloading licence. Namely the configuration and enforcement of the Start Screen (Currently the children have all moved the tiles around on all the devices so no 2 are a like, this makes teaching very difficult). I can see how it is done but it fails to apply with out the sideloading licence (at least on the test model I have in front of me).

No one seems to be able to tell me where an educational establishment can get or even apply for one of these.

2 Microsoft reps via online chat didnt know what I was talking about and the 2 MS Distribution Partners I contacted either dont know or cant help.

The RT platform has tons going for it in primary education but the lack of affordable (read free) deployment scenario isnt helping. Apple at least provide the Configurator and allow basic cloning functionality. The Surface RT method is highly user intensive, obtuse or all but impossible.

Here are some typical snippets from the instructions:

"NOTE Sideloading apps on Windows RT devices requires that you first install a sideloading product key.
Contact your account team about acquiring sideloading product keys if you must sideload apps"

Helpful.... What account team?? These devices were bought direct from MS though an education sale deal.

Also:

"
Notice that Listing 6 does not import the Start screen layout. Instead, the layout file is stored within
the local GPO, and you must define the policy setting named Start Screen Layout using the path
to the layout file (i.e., %SystemRoot%\System32\GroupPolicy\layout.xml). Windows RT 8.1 does
support this policy, but it works only if sideloading is enabled on the device"

The "Guide" also explains how you can sideload Windows Updates. However, once again, in order to get the update files you need to contact your account manager.

Who is the mythical account manager and how do I get one lol!

It takes about 2 days to build and deploy a new windows desktop image, about 1 day to build and deploy a bank of iPads and about a week or more to set up a bank of RT devices at present.

Its such as shame as I love the RT platform and think it is ideal for primary school use but the configuration and management put off any but the most fervent fan.

Any tips here would be greatly appreciated.

Matt

 

[GreyFox7]

Wondering if you looked at AirWatch? Although I understand limitations with school environments this is where Management as a Service (provided by you) would come in with Federated Trust model it would seem doable.

 

[jnjroach]

You will need at least an Open Agreement (Volume License) to get the Side Loading Key, info here:
http://www.microsoft.com/licensing/activation/existing-customers/product-activation.aspx
http://www.microsoft.com/licensing/about-licensing/briefs/windows_intune.aspx

Technical write up here:
http://technet.microsoft.com/en-us/windows/jj874388.aspx

Possible workarounds here:
http://blogs.msdn.com/b/mvpawardpro...s-store-apps-in-enterprises-step-by-step.aspx

A few additional blog posts:
http://blogs.msdn.com/b/education/archive/2012/07/24/windows-intune-in-education.aspx
http://blogs.msdn.com/b/education/a...tep-by-step-guide-to-implementing-intune.aspx

 

[Matt]

Wondering if you looked at AirWatch? Although I understand limitations with school environments this is where Management as a Service (provided by you) would come in with Federated Trust model it would seem doable.

At $51 a year per device (unless there is a far cheaper option) this is simply out of the question.

 

[Matt]

You will need at least an Open Agreement (Volume License) to get the Side Loading Key, info here:
http://www.microsoft.com/licensing/activation/existing-customers/product-activation.aspx
http://www.microsoft.com/licensing/about-licensing/briefs/windows_intune.aspx

Technical write up here:
http://technet.microsoft.com/en-us/windows/jj874388.aspx

Possible workarounds here:
http://blogs.msdn.com/b/mvpawardpro...s-store-apps-in-enterprises-step-by-step.aspx

A few additional blog posts:
http://blogs.msdn.com/b/education/archive/2012/07/24/windows-intune-in-education.aspx
http://blogs.msdn.com/b/education/a...tep-by-step-guide-to-implementing-intune.aspx

Thanks for the info. I will have a read through.

Managed to acquire the side load key via the schools vlsc. Although it's not easy to find and the implementation has to be per device and is a command line utility.

At least once it was installed and activated the local group policy for the start screen was applied.

Microsoft need to make a major improvement to this system if they want the tablets to compete with apple and android.

No primary school os going to pay for an mdm to manage windows rt devices when android and is can be managed by meraki for free and apple provide the configurator for free.

 

[Matt]

MDMs with subscription just don't make sense for a primary school shared scenario. The devices won't leave site nor will there be a huge amount of app changes. A free one like Meraki would help but it's the initial configuration which is the major head ache.

For the love of god Microsoft release the winPE and WDS tools for arm. And while your at it sort out the wsus for RT. It's listed as a product on wsus it just doesn't get any updates.

Once I have finished my process ill post it here and see if you guys think I've missed anything.