I recently started working as an embedded technician at a school through an MSP. I have about five years of experience and previously worked for another MSP, but I've found several gaps and inefficient processes. The previous technician left very little documentation, so I'm still discovering how everything works.
The biggest issues I'm trying to understand are:
- **Laptop deployment:** Devices are still being configured manually with a USB drive containing the required applications. I've heard that Windows provisioning can automate OOBE, create a local account, install software, and finish at the desktop. What would be the best way to get started with this? Would Windows Configuration Designer, Autopilot, Intune, or another deployment method be appropriate?
- **Email systems:** The school has two separate email systems: Gmail for internal communication, which is currently not working, and Microsoft 365 for external communication. Is it advisable to consolidate everything onto one platform, likely Microsoft 365?
- **File storage and collaboration:** The school uses Google's productivity tools because they are inexpensive, while licensed users also use Teams and store files there. Faculty appear to have Microsoft 365 A1/A3 licensing, and the school already uses OneDrive to back up users' Desktop and Documents folders. Would SharePoint be a better option for shared and departmental files?
- **Education-specific tools:** I'm also evaluating Clever and GoGuardian. Clever appears to provide education-focused SSO, while GoGuardian offers student monitoring and web filtering. Are these useful tools for a school environment, and how do they compare with a network firewall such as FortiGate? Is GoGuardian meant to replace a firewall, or does it serve a different purpose?
I'm mainly looking for a sensible order of operations and some practical guidance before making major changes.
5 Answers
The email situation should probably be your first priority because one of the systems is already failing. Running separate platforms for internal and external mail can create routing, identity, and support problems. Once you understand the existing domains, accounts, forwarding rules, and licensing, choosing one primary platform—likely Microsoft 365 if that is where the school already has substantial licensing—would make management much simpler. Be careful not to migrate anything until you have documented the current configuration and confirmed the school’s requirements.
For storage, OneDrive is generally the right place for an individual user’s files, while SharePoint is better for departmental, shared, and organizational content. Teams files are stored in SharePoint behind the scenes, so moving toward Microsoft 365 could give the school a more consistent structure instead of splitting collaboration between Google Drive, Teams, and other services. Check the actual A1/A3 entitlements and plan permissions, ownership, retention, migration, and backup before moving anything. A backup product may still be appropriate even when the data is stored in Microsoft 365.
For laptop setup, look into Windows Configuration Designer. You can create a provisioning package (.ppkg), place it on a USB drive, and apply it during the Windows setup process. It can automate settings, accounts, and application installation. Since the school may already have Microsoft 365 A3 licensing, also investigate Intune and Windows Autopilot. Autopilot would eventually let you provision devices without manually touching every laptop, although you’ll need to confirm the licensing and enrollment requirements first.
Thanks, that gives me a good starting point. I’ve already created a provisioning USB to begin improving the current setup while I investigate Autopilot.
Clever and GoGuardian solve different problems. Clever is primarily an education-focused identity and single sign-on portal, while GoGuardian can provide browser management, student activity visibility, classroom controls, and web filtering depending on the subscription. GoGuardian is not a replacement for a firewall. A firewall handles network perimeter security, routing, segmentation, and broader traffic control; GoGuardian generally operates closer to the user, device, browser, or classroom layer. A school would commonly use both, assuming the features fit its policies and requirements.
Before recommending either product, I’d confirm what firewall, filtering, device management, and student privacy controls the school already has. The existing architecture and local policies matter more than simply adding another tool.
Since you’re new to the environment and inherited very little documentation, avoid trying to redesign everything at once. Start with the actively broken email service, then document identities, domains, licensing, device enrollment, network equipment, backups, and file ownership. Improve laptop provisioning next because it saves time immediately. Once you understand why the current Google and Microsoft systems were separated, you can make a much safer decision about consolidation and SharePoint.
That makes sense. I’ll start by documenting the mail setup and addressing the broken service before trying to change the other systems.