OS Setting
Applies a local AppLocker policy from XML you paste in, e.g. to block the Microsoft Store or per-user apps.
What it does: Applies your AppLocker policy XML to the computer.
You'll need: An AppLocker policy exported from a reference computer (Get-AppLockerPolicy -Local -XML). A sample is included below.
Heads up:
- Applying replaces the computer's existing local AppLocker policy.
- AppLocker enforcement requires the Application Identity service to be running.
Turns off BitLocker and fully decrypts a drive (default C:), unlocking it first with a recovery password if it's locked.
What it does: If the drive isn't fully decrypted, unlocks it if needed, turns off BitLocker, waits up to 60 minutes for decryption, and reports the status. The recovery password is never shown.
You'll need: Nothing for a running Windows drive. A 48-digit recovery password only if the drive is locked.
Heads up:
- A recovery password entered here is saved with the modifier, so limit who can view it.
- Removes disk encryption. Use with caution.
Turns on BitLocker (TPM protector, XTS-AES 256 by default) and reports the recovery key ID and password.
What it does: Checks for a ready TPM, turns on BitLocker (used space only by default), adds a recovery password, waits up to 60 minutes, then reports the status and recovery password.
You'll need: A TPM 2.0 that is present and ready.
Heads up:
- The recovery password appears in the modifier report, visible to anyone who can view the asset.
Sets custom DNS servers on adapters whose DHCP DNS suffix matches your network; reverts adapters to DHCP DNS elsewhere.
What it does: At every check-in, adapters on the network with DNS suffix $DNS_SUFFIX get your DNS servers. On any other network, all adapters go back to automatic DNS.
You'll need: Your network's DHCP DNS suffix and the DNS servers to use there.
Heads up:
- Away from your network it resets adapters to automatic DNS, replacing any manually set DNS servers.
Creates or re-enables a local administrator account (default "tech") and sets its password at every check-in.
What it does: At every check-in, creates the account if needed, enables it, adds it to Administrators, sets the password and sets it to never expire.
You'll need: A strong password in $password.
Heads up:
- Password changes made on the computer are reverted at the next check-in.
Sets or clears the legal notice (logon banner) shown before Windows sign-in.
What it does: At every check-in, sets the logon banner caption and text. Set both to empty to remove the banner.
You'll need: Your district's acceptable-use banner text.
Heads up:
- The sample text names a specific district; replace it with your own.
Attempts to remove or disable Microsoft Edge and Internet Explorer.
What it does: At every check-in, attempts to uninstall or disable Edge, removes legacy Edge, and turns off the Internet Explorer feature.
Heads up:
- Microsoft doesn't support removing Edge on Windows 10 or 11. Windows updates may restore it, and some Windows features may be affected.
Hides or shows the last signed-in username on the Windows sign-in screen (good for shared labs).
What it does: At every check-in, sets whether the sign-in screen shows the last signed-in user (1 hides it, 0 shows it).
Heads up:
- Hiding it adds an extra step for Google Credential Provider (GCPW) sign-in.
- Does not remove user profiles.
Enrolls Chrome browsers into Chrome Browser Cloud Management by pushing your enrollment token.
What it does: Sets your Chrome Browser Cloud Management enrollment token on the computer.
You'll need: An enrollment token from the Google Admin console (Chrome browser > Managed browsers).
More info: https://support.google.com/chrome/a/answer/6304822
Turns the Microsoft Edge search bar desktop widget on or off.
What it does: At every check-in, applies your Edge search bar setting.
Removes all mapped network drives for the signed-in user.
What it does: At every check-in, removes all of the user's mapped network drives.
You'll need: Assign as a person-scope modifier.
Heads up:
- Drives mapped later are removed again at the next check-in.
Deletes a local Windows user account by name.
What it does: If the named local user exists, deletes the account.
You'll need: The local username.
Heads up:
- Deletes the account, not the user's profile folder.
Deletes local user profiles not used within a set number of days, with an exempt list and a report-only mode.
What it does: Lists profiles not used within $Days, except exempt users. With $ActuallyRun = $True it deletes them; otherwise the report only lists them.
You'll need: The number of days, and usernames to exempt (include your local admin account, and gaia if you use GCPW).
Heads up:
- Always set $Days.
- Keep $ActuallyRun set to $False until the report lists exactly the profiles you expect.
- Best suited to labs and kiosks, not staff computers.
Rotates a randomly named local admin account and password on a schedule.
What it does: When the current account is due, creates a new - admin account with a random password, removes the previous rotated accounts and their profiles, and reports the new sign-in details.
You'll need: A username prefix, name and password lengths, and the rotation period in days.
Heads up:
- The current admin username and password appear in the modifier report. Look there when you need to sign in.
- Old rotated accounts and their profiles are deleted at each rotation.
Points each user's proxy auto-config at your Securly SmartPAC URL with their email included, so filtering follows them off network.
What it does: Locks the Windows proxy settings and adds a sign-in script that points each user at your SmartPAC URL with their Google sign-in email (or username@domain).
You'll need: Your Securly SmartPAC URL (from your Securly sales engineer) and your email domain.
Sets the default browser (Chrome, Edge or Internet Explorer) for all users at sign-in.
What it does: Sets the chosen browser as the default each time a user signs in.
Makes Chrome the default browser for web links and .htm/.html files for each user.
What it does: At every check-in, sets Chrome as each user's default for http, https, .htm and .html.
Heads up:
- Recent Windows 10 and 11 updates can prevent default-browser changes made this way.
Sets the signed-in user's default browser (Chrome, Edge or Firefox) for http and https.
What it does: Sets your chosen browser as the user's default for web links.
You'll need: Assign as a person-scope modifier.
Heads up:
- Recent Windows 10 and 11 updates can prevent default-browser changes made this way.
Sets a Windows file-type association (extension to program) using assoc and ftype.
What it does: At every check-in, maps the file extension to your file type and sets the program that opens it.
You'll need: The extension, the file type name, and optionally the program path.
Renames the computer to match its asset name in K12Panel.
What it does: If the computer name differs from the asset name, renames the computer. The new name takes effect after a restart.
Heads up:
- Asset names must be 15 characters or fewer.
- "Windows | Rename Computer to Match Cloud Asset Name" can also restart the computer for you.
Blocks Windows from showing or connecting to a specific Wi-Fi network (SSID).
What it does: At every check-in, blocks the Wi-Fi network you name.
You'll need: The SSID to block.
Installs a certificate you paste in (Base64/PEM) into the machine Root, CA or Personal store.
What it does: Installs your certificate into the computer's Root, Intermediate (CA) or Personal store and reports its subject and thumbprint.
You'll need: The certificate's Base64 text; optionally its thumbprint or subject name.
Hides or shows individual Windows Settings pages, or blocks Settings and Control Panel entirely.
What it does: At every check-in, hides or shows the Settings pages you mark with 1, or blocks Settings and Control Panel altogether.
Heads up:
- Changes take effect at the next sign-in.
Deletes every local user profile and enabled local account except the ones you list. Destructive.
What it does: At every check-in, deletes every user profile and enabled local account not in $AccountsToKeep.
You'll need: The accounts to keep (include your local admin account, and gaia if you use GCPW).
Heads up:
- Profiles are deleted again at every check-in while assigned. Remove the modifier as soon as the cleanup is done.
- Test thoroughly before a wide rollout.
Stops Windows from turning off network adapters to save power, which can drop remote management.
What it does: At every check-in, turns off "Allow the computer to turn off this device to save power" on all physical network adapters.
Hides or shows the Screen Saver settings page so users can't change screen saver settings.
What it does: At every check-in, hides or shows the Screen Saver settings page.
Locks the computer after a set number of seconds of inactivity.
What it does: At every check-in, sets the inactivity time before the computer locks.
You'll need: The timeout in seconds (for example, 300 = 5 minutes).
Heads up:
- Takes effect after a restart.
Prevents or allows users changing their desktop wallpaper.
What it does: Sets whether users can change the desktop wallpaper.
Keeps Windows 10 on a chosen feature release and blocks the Windows 11 upgrade.
What it does: At every check-in, pins Windows 10 to the release you set, or removes the pin.
Heads up:
- Windows 10 is no longer supported by Microsoft.
Sets the signed-in user's desktop wallpaper image and style.
What it does: Sets the user's desktop wallpaper and style.
You'll need: An image path on the computer. Assign as a person-scope modifier.
Activates Windows using the product key built into the computer's firmware (UEFI).
What it does: Switches Windows from a volume (KMS) key to the key stored in the computer's firmware.
Heads up:
- Can change the Windows edition to match the firmware key.
Activates Windows 10 with the computer's digital license, falling back to your MAK key.
What it does: Uses the key built into the computer's firmware and, if that doesn't activate Windows, your MAK key.
You'll need: Optional fallback MAK key.
Heads up:
- Can change the Windows edition.
- "Windows | MAK Activation" is the simpler option if you only use MAK keys.
Removes and blocks OneDrive, new Outlook, Teams and Bing Search from Windows, each toggleable.
What it does: At every check-in, removes the apps you select for all users and blocks them from being reinstalled.
Heads up:
- Setting an option back to $false does not reinstall the app.
- Don't assign together with the Microsoft OneDrive install blueprint.
- Test on a small group first.
Configure Windows power settings
This blueprint focuses primary on power settings. Make sure that if you also use the "Baseline Registry Settings" blueprint that you do not set different power settings for power button settings there.
Applies common computer settings: fast user switching, RDP, power button, hibernate, fast startup, search suggestions, news, ping.
What it does: At every check-in, applies your fast user switching, Remote Desktop, power, hibernate, fast startup, search, news and ping settings.
Heads up:
- The defaults turn on Remote Desktop and allow it through the firewall. Set $DisableRDPConnections to "1" if you don't want that.
- Don't also set the power button in "Windows - Power Settings".
Toggles common restrictions: Control Panel, Internet Options, colors, connections tab, wallpaper, Themes tab.
What it does: At every check-in, applies each restriction you fill in; blank values are left unchanged.
Heads up:
- For page-by-page control of Settings, use the Granular blueprint.
Creates a website shortcut on the signed-in user's desktop, optionally with a custom icon.
What it does: Creates a desktop shortcut to your URL for the signed-in user.
You'll need: Assign as a person-scope modifier.
Creates a website shortcut on the All Users (Public) desktop with an optional built-in Windows icon.
What it does: Creates a shortcut to your URL on the Public Desktop, optionally with a built-in Windows icon.
Forces Windows to let apps use the camera and microphone.
What it does: At every check-in, sets camera and microphone access for apps to Allow.
Removes the computer from its Active Directory domain into a workgroup, using a delegated AD account.
What it does: If the computer is on a domain, removes it using your credentials and moves it to your workgroup.
You'll need: A domain account allowed to remove computers (use a limited, delegated account).
Heads up:
- A restart is required to finish.
- The credentials are saved with the modifier, so limit who can view it.
Creates or deletes a Windows scheduled task with schtasks.exe, with properties for every common option.
What it does: Creates or deletes a scheduled task using the options you fill in.
You'll need: At minimum: the action, task name, schedule and program.
Sets Windows time to sync from time.windows.com via NTP and forces a resync.
What it does: At every check-in, configures time.windows.com as the time source and forces a time sync.
Creates a scheduled task that installs all Windows Updates every N days, with optional restart.
What it does: Creates the "K12Panel - Install Windows Updates Schedule" task, which installs all available Windows Updates on your schedule, and starts it.
You'll need: The number of days between runs, and yes or no for restarting.
Shows or hides the Internet Connection Sharing option in network adapter properties.
What it does: At every check-in, shows or hides the Internet Connection Sharing option.
Adds a Wi-Fi network profile (SSID, password, WPA2-PSK/AES) to computers, optionally connecting automatically.
What it does: Adds the Wi-Fi network to the computer with your SSID, password, authentication and encryption settings.
You'll need: The SSID and passphrase. Computers need internet access when this runs.
Creates a standard local user (or resets its password) and sets the password to never expire.
What it does: At every check-in, creates the account or resets its password, adds it to Users, and sets the password to never expire.
Heads up:
- Password changes made on the computer are reverted at the next check-in.
Places a website shortcut with a custom icon on the Public Desktop or a specific user's desktop.
What it does: Saves your icon on the computer and creates a desktop shortcut to your URL.
You'll need: The URL, the shortcut name, and an .ico file hosted as the payload with its SHA-256.
Removes the Microsoft Store app for all users when set to disabled. Can't restore it.
What it does: If $StoreEnabled is $FALSE, removes the Microsoft Store for all users.
Heads up:
- The default ($TRUE) makes no changes.
- Apps that depend on the Store may stop working, and this blueprint can't reinstall it.
Activates Windows computers that aren't activated, using your MAK key. Skips computers already activated.
What it does: If Windows isn't activated, enters your MAK key and activates it.
You'll need: A Windows volume MAK key.
Heads up:
- Changes the Windows edition to match the MAK key.
Adds the user an asset is checked out to into local Administrators, matched through their GCPW sign-in.
What it does: Finds the Google (GCPW) account whose email matches the checked-out user and adds it to local Administrators.
You'll need: GCPW installed, and the checked-out user must have signed in to this computer at least once.
Heads up:
- Not for domain-joined computers.
Sets local account lockout and password policy with net accounts (threshold, duration, window, password age/length/history).
What it does: At every check-in, applies the account policy values you fill in; blank values are left unchanged.
Heads up:
- Password age and length settings can lock out Google Credential Provider (GCPW) users. The lockout settings are the typical use.
Renames the computer to match its asset name in K12Panel, optionally restarting with a 3-minute warning.
What it does: If the computer name differs from the asset name, renames the computer and, if $RebootComputer is set, warns users and restarts in 3 minutes.
Heads up:
- Asset names must be 15 characters or fewer.
- The new name takes effect after a restart.
Sets custom DNS servers only while connected to a specific Wi-Fi network, e.g. to send a device group to a filtering DNS.
What it does: At every check-in, if the computer is on the Wi-Fi network you name, sets its wireless DNS servers to yours.
You'll need: The target SSID and DNS server addresses.
Heads up:
- DNS isn't changed back when the computer is on other networks.
Turns on Windows location services for the computer and its users.
What it does: Allows location access for the computer and for each user profile.
Turns the Windows automatic sign-in (AutoAdminLogon) setting on or off.
What it does: Sets AutoAdminLogon to 1 (on) or 0 (off).
Heads up:
- This only turns the setting on or off. Automatic sign-in also needs the account name and password configured on the computer.
Turns Windows Network Discovery on or off.
What it does: Enables or disables the Network Discovery firewall rules.
Heads up:
- Works on English-language Windows.
Turns off Windows welcome experience, "finish setting up" and tips notifications for users.
What it does: At every check-in, applies your welcome, setup-suggestion and tips settings to every user profile on the computer.
Software Install
Enables the Windows .NET Framework 3.5 feature (includes 2.0 and 3.0) for older apps that need it.
What it does: Enables the .NET Framework 3.5 Windows feature, downloading it from Windows Update.
You'll need: Internet access to Windows Update, or a WSUS/Features on Demand source.
Enables the .NET Framework 4.x Windows feature for apps that need it.
What it does: Enables the .NET Framework 4 Windows feature. .NET Framework 4.8 is already included in Windows 10 and 11.
Installs 1Password for Windows for all users.
What it does: Installs the 1Password app machine-wide so it's available to every user.
More info: https://1password.com/
Installs 7-Zip, the free open-source file archiver (x64), silently for all users.
What it does: Installs 7-Zip silently. Optionally set a custom install folder with $alternatepath.
More info: https://www.7-zip.org
Installs AVer A+ Suite, the software for AVerVision document cameras.
What it does: Installs A+ Suite quietly.
You'll need: An AVerVision document camera.
More info: https://www.averusa.com/
Installs Adobe Acrobat Reader DC for all users with EULA accepted, no desktop shortcut, and upsell/sign-out prompts suppressed.
What it does: Installs Reader silently for all users, then turns off Adobe's upsell and sign-out prompts.
Heads up:
- Reader keeps itself updated after installation.
More info: http://adobe.com/reader https://acrobat.adobe.com/us/en/acrobat/pdf-reader.html
Installs Alice 3, the block-based 3D programming environment used to teach coding through animation and games.
What it does: Installs Alice 3 quietly.
More info: https://www.alice.org
Installs Audacity, the free multi-track audio editor and recorder, silently for all users.
What it does: Installs Audacity silently for all users with no desktop icon.
More info: http://audacityteam.org
Installs Autodesk Fusion machine-wide from your own hosted admin installer, plus a batch file for manual updates.
What it does: Installs Fusion quietly, keeps the admin installer next to the Fusion launcher, and adds FusionUpdate.bat there for manual updates.
You'll need: Your own Fusion Admin Install.exe hosted at a public URL, with its SHA-256. Autodesk doesn't allow redistribution.
Heads up:
- Fusion doesn't appear in Programs and Features. To uninstall, run "Fusion Admin Install.exe" --process uninstall.
- Fusion releases roughly every six weeks and files aren't backward compatible, so keep labs and home installs on the same version.
More info: https://damassets.autodesk.net/content/dam/autodesk/docs/pdfs/Advanced_Fusion360_Lab_Installation_Instructions_en-GB.pdf
Installs BenQ EZWrite 6, the whiteboard app for BenQ interactive displays.
What it does: Installs EZWrite quietly without restarting.
More info: https://ezwrite.benq.com/
Deploys Bitdefender GravityZone Endpoint Security Tools.
What it does: Runs a GravityZone downloader silently.
You'll need: Your own GravityZone downloader and its SHA-256. The "Bitdefender BEST" blueprint includes step-by-step setup instructions.
Deploys Bitdefender GravityZone BEST (Endpoint Security Tools) using the downloader from your own GravityZone console.
What it does: Runs your GravityZone downloader silently, which installs the agent for your company.
You'll need: Your company's Windows downloader link and its SHA-256. The payload filename must match Bitdefender's exactly, because it identifies your package.
Heads up:
- Add K12Panel exclusions in GravityZone so blueprints aren't quarantined.
More info: https://www.bitdefender.com/
Installs Blender, the free open-source 3D modeling, animation and rendering suite, for all users.
What it does: Installs Blender silently for all users.
Heads up:
- New Blender versions install alongside older ones rather than replacing them. Use an uninstall blueprint to remove old versions.
More info: https://www.blender.org/ https://docs.blender.org/manual/en/latest/getting_started/installing/windows.html
Sets up College Board Bluebook, the digital SAT testing app, to install for each user at sign-in.
What it does: Stages the Bluebook installer on the computer and installs it into each user's profile the next time they sign in.
You'll need: About 250 MB free per user profile.
Heads up:
- Users must sign out and back in. The first sign-in takes about a minute while Bluebook installs.
More info: https://bluebook.collegeboard.org/
Installs The Bridge Designer, a free engineering-education app for designing and load-testing a steel highway bridge.
What it does: Installs The Bridge Designer silently.
More info: https://bridgedesigner.org
Installs Carbide Create 7, CAD/CAM software for Carbide 3D and other CNC routers (includes VC++ runtime).
What it does: Installs Carbide Create silently.
More info: https://carbide3d.com/carbidecreate/
Installs CCleaner Free 5.74 disk cleanup utility.
What it does: Installs CCleaner silently with an optional language and install folder.
More info: https://www.ccleaner.com/ccleaner
Installs the classroom.cloud Student agent registered to your site and account.
What it does: Installs your classroom.cloud Student installer quietly with your site, account and region.
You'll need: Your own hosted installer (URL, filename and SHA-256), plus your Site ID, Account ID and Region from classroom.cloud.
Installs the Digital Watchdog DW Spectrum client for viewing and managing DW video surveillance systems.
What it does: Installs the DW Spectrum client silently without restarting.
More info: https://digital-watchdog.com/
Installs Discord for the signed-in user (Discord only supports per-user installs).
What it does: Installs Discord into the user's profile.
You'll need: Assign as a person-scope modifier.
More info: https://discord.com/
Installs Inswan Documate, the control software for Inswan document cameras.
What it does: Installs Documate quietly.
You'll need: An Inswan document camera.
Installs ELMO Interactive Toolbox, presentation software for ELMO document cameras.
What it does: Installs ELMO Interactive Toolbox quietly.
You'll need: An ELMO document camera.
More info: https://www.elmousa.com/software/
Installs the Emergent3 emergency-response/panic app, removing older 2.x versions first.
What it does: Stops Emergent3, removes any 2.x version, and installs the current release.
You'll need: Deploy "Emergent 3 Duplication Uninstall" first if computers have version 1.x.
Heads up:
- Upgrades can take two check-ins to finish.
More info: https://www.emergent3.com
Installs Epson Easy Interactive Tools 5, annotation and whiteboard software for Epson interactive projectors and document cameras.
What it does: Installs Easy Interactive Tools silently.
Installs Epson iProjection 4 for wireless projection to Epson projectors and opens its firewall rules.
What it does: Downloads iProjection from Epson, verifies the download, installs it quietly, and allows it through Windows Firewall.
More info: https://epson.com/wireless-projector-app
Installs FileZilla Client (64-bit), the free FTP/SFTP client.
What it does: Installs FileZilla silently.
More info: https://filezilla-project.org/
Installs FastStone Image Viewer, a lightweight image browser, converter and editor.
What it does: Installs FastStone Image Viewer silently.
More info: https://www.faststone.org/
Installs Google Credential Provider for Windows (GCPW) so users sign in to Windows with their Google Workspace account.
What it does: Applies your GCPW settings (allowed domains, device enrollment, multiple accounts, offline sign-in period, short profile names), then installs GCPW. If only the allowed domain changed, updates it without reinstalling.
You'll need: Google Chrome installed, and your Workspace domain(s) in $domains_allowed_to_login.
Heads up:
- Nothing happens until $domains_allowed_to_login is filled in.
More info: https://tools.google.com/dlpage/gcpw/
Installs GIMP, the free open-source image editor, silently for all users.
What it does: Installs GIMP silently for all users with no desktop icon.
More info: https://www.gimp.org/
Deploys the GoGuardian App for Windows with your license tag and policy settings (identity, proxy bypass, updates).
What it does: Installs your district's GoGuardian app if it's missing or older than $MinimumVersion, then applies your GoGuardian policy settings. The report shows the license tag (masked), service status and settings applied.
You'll need: Your district's GoGuardian MSI, zipped and hosted, plus your license tag from manage.goguardian.com. Subscribe, break the subscription, then set the payload.
Heads up:
- .NET Framework 4.7 or newer is required.
Installs Google Backup and Sync. Google has replaced it with Google Drive for desktop.
What it does: Installs Google Backup and Sync quietly.
Heads up:
- For Google Workspace, use the Google Drive File Stream blueprint instead.
More info: https://support.google.com/drive/answer/2374987
Installs 64-bit Google Chrome (enterprise MSI). Chrome then keeps itself updated.
What it does: Installs Google's 64-bit Chrome Enterprise installer. Computers that already have Chrome are skipped.
More info: http://google.com/chrome
Installs the Chrome Remote Desktop host so a computer can be controlled remotely via remotedesktop.google.com.
What it does: Installs the Chrome Remote Desktop host quietly.
You'll need: A Google account to register the computer with after install.
Installs Google Drive for desktop (formerly Drive File Stream) and makes it launch at sign-in.
What it does: Installs or updates Google Drive for desktop silently and sets it to start when users sign in.
More info: https://support.google.com/a/answer/7491144?hl=en
Installs Google Earth Pro, the free desktop globe with GIS import/export and historical imagery.
What it does: Installs Google Earth Pro silently.
More info: https://www.google.com/earth/versions/ https://support.google.com/earth/answer/168344#zippy=%2Cdownload-a-google-earth-pro-direct-installer
Installs HandBrake, the free open-source video transcoder.
What it does: Installs HandBrake silently.
More info: https://handbrake.fr
Installs HoverCam Flex 11, instruction, recording and annotation software for HoverCam document cameras.
What it does: Installs Flex 11 quietly.
You'll need: A HoverCam document camera.
More info: https://www.hovercam.com
Installs the Impero Client (classroom management) from an MSI you host.
What it does: Installs your Impero Client MSI quietly.
You'll need: Your Impero Client MSI (configured for your Impero server) hosted publicly, with its SHA-256.
Installs Inkscape, the free open-source vector graphics editor.
What it does: Installs Inkscape quietly.
Heads up:
- Inkscape 1.4.0 has a known issue: no Start menu entry, and uninstalling doesn't work cleanly.
More info: https://inkscape.org/ https://gitlab.com/inkscape/inkscape/-/issues/1617
Installs any MSI from a URL you enter as properties, with optional version and SHA-256 checks.
What it does: Downloads the MSI from $msi_url, checks its SHA-256 if you provide one, and installs it with your flags. The install log appears in the report. Upgrades when $app_version is newer than what's installed.
You'll need: The app name as it appears in Programs and Features, a public MSI URL, and ideally its version and SHA-256.
Heads up:
- Without a SHA-256 the download isn't verified.
Installs BenQ InstaShare 2 for wireless screen sharing to BenQ displays.
What it does: Installs InstaShare 2 quietly for all users.
Heads up:
- The installer restarts the computer when it finishes.
Installs IPEVO Visualizer, document camera software that works with most USB doc cams.
What it does: Installs IPEVO Visualizer quietly.
More info: https://www.ipevo.com/software/visualizer
Installs Lumens Ladibug 3, control software for Lumens document cameras.
What it does: Installs Ladibug quietly.
You'll need: A Lumens document camera.
More info: https://www.mylumens.com/en/Downloads/1?id2=1&keyword=&keyword2=&pageSize=10&ord=
Installs LanSchool Air classroom management, provisioned to your org and region, with optional browser extensions.
What it does: Installs LanSchool Air with your provisioning code, region and browser-extension choices.
You'll need: Your LanSchool Air org provisioning code.
Heads up:
- LanSchool Air updates itself after installation.
More info: https://lanschool.com/
Installs the LEGO Education SPIKE app for SPIKE Prime and SPIKE Essential.
What it does: Installs the SPIKE app quietly.
More info: https://education.lego.com/en-us/downloads/spike-app/software
Installs LEGO MINDSTORMS Education EV3 Classroom for block-coding the EV3 brick.
What it does: Installs EV3 Classroom quietly.
More info: https://education.lego.com/en-us/downloads/mindstorms-ev3/software
Installs LibreOffice 7.0, the free Office-compatible suite.
What it does: Installs LibreOffice quietly without restarting.
More info: https://www.libreoffice.org/
Installs LynxClient so a PC can trigger panic alarms and receive pop-up alerts from your LynxGuide server.
What it does: Installs your LynxClient MSI quietly with your server hostname and profile.
You'll need: Your LynxClient MSI hosted publicly with its SHA-256, your Lynx server hostname, and profile name.
More info: https://www.lynxguide.com
Installs Malwarebytes (free/consumer) anti-malware.
What it does: Installs Malwarebytes silently.
Heads up:
- This is the consumer edition; it isn't centrally managed.
More info: https://www.malwarebytes.com/
Installs Testlet Kite Student Portal for Montana's alternate (MAST) assessments.
What it does: Installs the latest Testlet Kite Student Portal quietly.
You'll need: Deploy Visual C++ Redistributable (x64) 2015-2022 and .NET Framework 4.X at default priority, and leave this blueprint at Low priority so it installs last.
Heads up:
- This is the Testlet Kite Student Portal, not the standard Kite Student Portal.
More info: https://opi.mt.gov/Leadership/Assessment-Accountability/Montana-Alternative-Student-Testing-Pilot-Program https://newmeridiancorp.org/montana-aligned-to-standards-through-year-program-portal/
Installs the Microsoft Edge WebView2 Runtime that many modern Windows apps need.
What it does: Installs the WebView2 Runtime silently.
More info: https://developer.microsoft.com/en-us/microsoft-edge/webview2/
Installs volume-licensed Office Pro Plus or Standard 2019/2021/2024 (64-bit), removes old Office first, and activates your key.
What it does: Removes existing Office, installs the edition and year you choose (without the apps you exclude), then activates it with your key.
You'll need: A matching Office volume license key.
Heads up:
- Removes every existing Office installation first, including Microsoft 365 Apps.
Installs Microsoft 365 Apps for enterprise (Current Channel, 64-bit), removing older Office first.
What it does: Removes existing Office, then installs Microsoft 365 Apps without the apps you exclude (default: Access, OneDrive, Groove).
You'll need: Microsoft 365 licenses; users activate by signing in.
Heads up:
- Removes existing Office first.
- OneDrive is excluded by default; use the Microsoft OneDrive blueprint if you want it.
More info: https://www.office.com/
Installs Microsoft OneDrive for all users.
What it does: Allows OneDrive and installs it for all users.
Heads up:
- Don't assign together with "Windows - Block Common Pushed Software", which removes OneDrive.
More info: https://www.microsoft.com/en-us/microsoft-365/onedrive/online-cloud-storage
Installs the Montana Secure Browser (Cambium) for state testing, removing old 32-bit versions first.
What it does: Removes any old 32-bit Montana Secure Browser, then installs the 64-bit version quietly.
You'll need: 64-bit Windows.
Heads up:
- Can take two check-ins to finish.
More info: https://mt.portal.cambiumast.com/secure-browsers.html
Installs Mozilla Firefox (latest, 64-bit MSI) with optional shortcut, update-service and install-path settings.
What it does: Installs the latest 64-bit Firefox quietly with the options you set.
More info: https://www.mozilla.org
Installs the NAEP secure assessment browser for the National Assessment of Educational Progress.
What it does: Installs the NAEP Assessment browser quietly.
More info: https://enaep.naep.ed.gov/
Installs Notepad++ (64-bit), the free text and source-code editor.
What it does: Installs Notepad++ silently.
More info: https://notepad-plus-plus.org/
Installs the NWEA MAP Secure Testing Browser (lockdown browser for MAP Growth).
What it does: Installs the NWEA lockdown browser silently.
More info: https://www.nwea.org/the-map-suite/
Installs Office Professional Plus 2019 (64-bit, volume) with your MAK, removing any existing Office first.
What it does: Removes existing Office, then installs Office Professional Plus 2019 with your MAK and without the apps you exclude.
You'll need: An Office 2019 Professional Plus MAK.
Heads up:
- For Office 2021 or 2024, use "Microsoft Office Installer - Multiple Versions".
Installs Office Standard 2019 (64-bit, volume) with your MAK, removing any existing Office first.
What it does: Removes existing Office, then installs Office Standard 2019 with your MAK and without the apps you exclude.
You'll need: An Office 2019 Standard MAK.
Heads up:
- For Office 2021 or 2024, use "Microsoft Office Installer - Multiple Versions".
Installs the OpenVPN community client (64-bit).
What it does: Installs the OpenVPN client quietly.
More info: https://openvpn.net/
Installs PowerShell 7.1 (x64) alongside Windows PowerShell 5.1, with optional context menu and remoting settings.
What it does: Installs PowerShell 7.1 quietly with the options you enable. Windows PowerShell 5.1 stays installed.
Heads up:
- PowerShell 7.1 is no longer supported by Microsoft; consider a current release.
More info: https://docs.microsoft.com/en-us/powershell/scripting/install/installing-powershell-core-on-windows?view=powershell-7.1
Installs the Printix Client for Printix cloud print management from your tenant's MSI.
What it does: Installs your Printix Client MSI quietly.
You'll need: Your Printix Client MSI hosted publicly, with its filename and SHA-256.
More info: https://printix.net/
Installs Promethean ActivInspire (core resources, then the main app) from a zip you build with the Network Installer.
What it does: Installs ActivInspire's core resources and then the main app quietly. If either step fails, the report shows why.
You'll need: A zip containing ActivInspireCore\ActivInspireCoreRes.msi and ActivInspire\Activinspire.msi from Promethean's Network Installer, hosted publicly with its SHA-256.
More info: https://www.prometheanworld.com/
Installs Promethean Screen Share for wirelessly casting a computer to a Promethean ActivPanel.
What it does: Installs Screen Share quietly.
More info: https://share.one.prometheanworld.com/
Installs PuTTY (64-bit), the SSH/telnet/serial client, removing versions 0.78 and older first.
What it does: Removes PuTTY 0.78 or older if present, then installs PuTTY quietly.
More info: https://www.putty.org/
Installs Python 3.12 (64-bit) for all users and adds it to PATH.
What it does: Installs Python quietly for all users and adds it to PATH.
More info: https://www.python.org/
Installs Recuva, the free file recovery tool.
What it does: Installs Recuva silently in your chosen language.
More info: https://www.ccleaner.com/recuva
Installs the Renaissance Star LockDown Browser (Respondus lab edition) for Star Assessments.
What it does: Installs the Renaissance LockDown Browser quietly.
More info: https://star-help.renaissance.com/hc/en-us/articles/12014854504091-Secure-Browsers-LockDown-Browser-for-Windows-and-Macintosh
Montana Respondus Lockdown Browser
This installs the Respondus Lockdown Browser Lab version for Montana schools that partners with Montana Digital Academy.
Uninstall other types of Respondus Lockdown browsers before pushing this if they exist since documentation says they share files and will have issues.
Installs RustDesk 1.1.9 as a service, optionally hiding shortcuts and preventing non-admins from launching it.
What it does: Installs RustDesk as a service (Manual startup by default) and, if $restrict_normal_users is on, removes its shortcuts and restricts who can launch it.
You'll need: Pair with the RustDesk Asset Connector blueprint. Start the service with a QuickCommand when needed.
Installs the Scratch 3 offline editor for all users.
What it does: Installs Scratch silently for all users.
More info: https://scratch.mit.edu
Installs Securly Classroom for Windows from an MSI you obtain from Securly and host yourself.
What it does: Installs your Securly Classroom MSI quietly.
You'll need: Securly's Windows MSI hosted publicly, with the filename Securly_Classroom.msi and its SHA-256.
Installs Securly Classroom for Windows for K12 Montana partner districts, joined to your deployment group.
What it does: Installs Securly Classroom quietly with your deployment group.
You'll need: Your DeploymentGroup GUID from the installer generated in the Securly Classroom portal (K12 Montana Helpdesk can help find it).
Heads up:
- For K12 Montana partner districts only.
Deploys the SentinelOne agent with your site token from a zipped MSI you host.
What it does: Checks your site token, installs your SentinelOne MSI quietly, and reports the reason if the install fails. Doesn't interfere with agent upgrades pushed from the SentinelOne console.
You'll need: Your SentinelOne MSI, zipped and hosted, and your site token. Subscribe, break the subscription, then set the payload.
Installs Slack for all users.
What it does: Installs the Slack app machine-wide so it's available to every user.
More info: https://slack.com/
Installs SMART Mirror, for casting a screen to SMART Board displays with iQ.
What it does: Installs SMART Mirror silently.
More info: https://support.smarttech.com/docs/software/iq/screen-share/en/downloads/mirror-apps/windows.cshtml
Installs SMART Notebook Basic (free, no subscription) for creating lessons on interactive displays.
What it does: Installs SMART Notebook Basic quietly.
Heads up:
- The installer restarts the computer when reinstalling.
More info: https://www.smarttech.com/
Installs licensed SMART Notebook / Learning Suite and activates it with your product key.
What it does: Installs SMART Learning Suite and activates it with your product key.
You'll need: A SMART Notebook product key.
Deploys Sophos Endpoint from a zip you provide containing your tenant's SophosSetup.exe.
What it does: Installs Sophos from your SophosSetup.exe quietly.
You'll need: A zip containing only SophosSetup.exe from your Sophos Central account, hosted publicly with its SHA-256.
Installs Splashtop Streamer tied to your Splashtop Business deployment code, with tray-icon and permission-prompt options.
What it does: Installs Splashtop Streamer silently with your deployment code, tray-icon and connection-permission settings.
You'll need: Your 12-digit Splashtop deployment code.
Heads up:
- Pair with the Splashtop Asset Connector blueprint.
More info: https://www.splashtop.com/
Installs the Steam client.
What it does: Installs Steam silently, optionally to a different folder.
Installs Pearson TestNav, the secure testing app used for many state assessments.
What it does: Installs TestNav quietly.
More info: https://www.pearsonassessments.com/large-scale-assessments/k-12-large-scale-assessments/solutions/testnav.html
Installs TightVNC Server with a VNC password and optional tray icon; service set to Manual by default.
What it does: Installs TightVNC Server with your password and sets the service to Manual, so you can start it with a QuickCommand when needed.
You'll need: A strong password (TightVNC uses up to 8 characters).
Heads up:
- Change the example password before assigning.
Installs Torchmate CAD 9 EDU Student for Torchmate CNC plasma tables.
What it does: Installs Torchmate CAD 9 EDU Student silently.
Heads up:
- Also installs the TeamViewer utility bundled with Torchmate.
More info: https://torchmate.com/
Installs UltiMaker Cura 5.11, the free 3D-printing slicer.
What it does: Installs Cura quietly.
Heads up:
- 5.11 is the last Cura release UltiMaker provides for silent deployment.
More info: https://ultimaker.com/software/ultimaker-cura
Installs UltraVNC Server as a service with a VNC password and hidden tray icon; Manual startup by default.
What it does: Installs UltraVNC Server with your password, hides the tray icon, and sets the service to Manual.
You'll need: A password (up to 8 characters).
Heads up:
- Change the example password before assigning.
More info: https://uvnc.com/
Installs ViewSonic vCastSender for wirelessly casting to ViewBoard displays.
What it does: Installs vCastSender.
More info: https://www.viewsonic.com/np/products/commercial-display/vCast
Installs Vernier Graphical Analysis for collecting and analyzing Vernier sensor data.
What it does: Installs the latest Graphical Analysis.
You'll need: Windows 10 21H1 or newer.
Installs the Microsoft Visual C++ 2015-2022 Redistributable (x64) runtime many apps require.
What it does: Installs the x64 Visual C++ runtime silently.
More info: https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170
Installs the Microsoft Visual C++ 2015-2022 Redistributable (x86) runtime for 32-bit apps.
What it does: Installs the x86 Visual C++ runtime silently.
More info: https://learn.microsoft.com/en-us/cpp/windows/latest-supported-vc-redist?view=msvc-170
VLC is a free and open source multimedia player that plays most multimedia files, and various streaming protocols.
Lightweight media player and DVD player software and compatible with many formats.
Learn more about this software at https://www.videolan.org/
Installs LEGO Education WeDo 2.0 for elementary coding with WeDo bricks.
What it does: Installs WeDo 2.0 silently.
Installs the DRC INSIGHT secure browser for WIDA/Montana testing and disables Xbox Game DVR as DRC requires.
What it does: Turns off Xbox Game DVR, then installs the DRC INSIGHT secure browser quietly.
Installs WizTree, the fast disk-space analyzer.
What it does: Installs WizTree silently for all users.
More info: https://wiztreefree.com/
Installs Zoom 5.4.
What it does: Installs Zoom quietly.
Heads up:
- For current Zoom versions, use the Zoom Workplace blueprint.
More info: https://zoom.us/ https://support.zoom.us/hc/en-us/article_attachments/360033082431/CleanZoom.exe
Work from anywhere with a single app that combines team chat, phone, whiteboard, meetings, and more. Communicate easily with anyone.
Modernize workflows with Zoom's trusted collaboration tools: including video meetings, team chat, VoIP phone, webinars, whiteboard, contact center...
For more information, visit their website at https://zoom.us/
Installs Zoom Workplace (64-bit) for all users.
What it does: Installs Zoom Workplace quietly.
More info: https://zoom.us/