Installing SIMS

[PhilNeal]

An appeal to engineers that are installing SIMS on behalf of schools.

 

A number of cases have come through to our support desk complaining about data protection issues because SIMS has not been installed correctly. In the latest complaint from a head all staff had access to the SIMS folder so they could see BACS files, the census etc. We also get a lot of performance problems reported because someone has virtualised the servers and given insufficient resources to SQL.

 

Please do not assume that you can install SIMS simply by asking a few questions on EduGeek.

 

Thanks

[Steve21]

Out of curiosity what is the official Capita guidelines on the S Drive access then? All the primarys that have had SIMs installed by Capita engineers have had staff access to S.

 

Thanks,

Steve

[Tricky_Dicky]

Our's was installed by Link2ICT and it's the same as Steve21.

[hardtailstar]

Ours links to a drive too where things are accessible.

 

If the the drive isnt there then SIMS does not work

[smithson83]

if you change your sims.ini file to point at the UNC path instead of the drive letter, then it works fine without a drive map

 

These two lines

SIMSDirectory=\\SIMs-Server\Share\sims

SIMSSetupsDirectory=\\SIMS-Server\Share\sims\Setups

Edited December 11, 2014 by smithson83

[hardtailstar]

if you change your sims.ini file to point at the UNC path instead of the drive letter, then it works fine without a drive map

 

not here as our sim server is on a different site.

[smithson83]

then how to you map the drive?

 

you create a hidden drive map. our kids have an Apps drive for certain software, but its hidden via GPP. Not a big step up, but at least staff can't see the S: drive and think, oooh, whats that...

[forkies]

Out of interest on Data Protection front, schools are obligated under the DPA to remove records once no longer necessary such as a standard guideline being when the student is 25 years old the student files be destroyed. However talking to Capita support it appears there is no way of bulk removing/deleting this data from sims? Surely this should be a feature to cover Data Protection on Sims?

[vikpaw]

I agree but the problems come when some of the people asking are approved SIMS support companies!

 

Seriously though, .ICT used to set up the S drive with full rights for everyone and insist on local admin rights. I took info from here and locked it down.

 

I would make S (sims share) read only for SIMS users, block inheritance on sensitive folders and then add specific read and if required edit on those and any others that might need it such as Nova, Exams etc.

[Steve21]

I agree but the problems come when some of the people asking are approved SIMS support companies!

 

Seriously though, .ICT used to set up the S drive with full rights for everyone and insist on local admin rights. I took info from here and locked it down.

 

I would make S (sims share) read only for SIMS users, block inheritance on sensitive folders and then add specific read and if required edit on those and any others that might need it such as Nova, Exams etc.

 

That's the "right" way to do it I guess, but in relation to the thread I've never once seen that setup on SIMs installs whether Capita engineers or XYZ.

 

Steve

[PhilNeal]

@forkies a school can keep data for as long as it feels that it has a need. Most heads I come across do not want to destroy old pupil records as they sometimes get asked for references.

[Seb1780]

@forkies a school can keep data for as long as it feels that it has a need. Most heads I come across do not want to destroy old pupil records as they sometimes get asked for references.

 

Yet another example of Capita's aloof attitude to the DPA

[forkies]

@forkies a school can keep data for as long as it feels that it has a need. Most heads I come across do not want to destroy old pupil records as they sometimes get asked for references.

 

I understand some heads might want this but we have been advised as DPA states as long as necessary which for us is only up to the age of 25, let's say they reach the age of 50 we are not going to get a reference request. It would surely be better to put this feature in then not have it at all, as I understand there is a housekeeping feature but it only deletes documents. At this time we have to either dedicated someone's time for a week or so a year to remove this data or put it into our data protection policy that there is insufficient means to remove this data from the MIS. Just hoping that this feature request would get some attention as would be useful!

[synaesthesia]

Our SIMS drive is only accessible by those that need it, which is about 5 people, and then permissions are locked down tight.

[matt40k]

I think people are missing Phil's point. Saying whats the S Drive permissions is like saying, what do I set my page file\swap to. It isn't a set number, it's based on a number of factors. Each setup will be different, phone that damm support team you pay all that money you moan about and get them to help you figure it out. Don't assume because its what someone else has is correct, even if it works - like Phil has send, it's just caused someone to leak BACS files, you know, those things that get you paid - ps: feel free to add a few rows to pay me a xmas bonus

@forkies - Yup, with you on this one.

[Steve21]

I think people are missing Phil's point. Saying whats the S Drive permissions is like saying, what do I set my page file\swap to. It isn't a set number, it's based on a number of factors.

 

But that is my point Not once have I seen any Capita engineer do anything different on the setups. It's always been S drive open to all staff, thus the question as to what are Capita engineers supposed to be doing by default? Hard to compare what schools are setup to if Capita tell us one way is right, then it's wrong

 

Steve

[localzuk]

It came as some surprise to me when our local support unit emailed out a guide with advice to lock things down. The sims drive has remained in the state it was originally created in ever since I started (it was created before I started, 8+ years ago). That way was "all staff have full access". The new guidelines have it much more locked down - to the extent that most of our users actually don't need any access to the S: drive at all.

 

So, come the next break when I have time, I will be removing it from them and doing some testing. I've already locked down the most sensitive aspects though.

 

So, Phil, you might have these instructions now, but that has not always been the case.

 

Also, as others have said, it is rather surprising that there is no bulk removal option, as we do legally have to get rid of data we no longer need under the DPA - regardless of whether it is nice to have or not.

[matt40k]

Well I can't comment on Capita Engineers - I think LA provide far superior support, of course I'm gonna say that. Few comments however, there is "Capita" as in Bedford who create and support the software, and then "Capita" who are basically just a helpdesk - like any other LA - which can be good or bad. Also you said you're basing it on a primary school - ie a morning work, maybe 2 or so workstations vs a secondary school which is a lot more of a complex beast. Also, define all staff have access? Does all staff just mean office staff or include teachers?

[Steve21]

Well primary/junior/secondary. (Just lot more primary/juniors supported in past so most engineers) Not one of the Capita Engineers (on site who installed the server etc) set it different, whether it's single admin office, or entire teaching staff using SIMs for registers etc.

 

Just mean it seems random comment from Phil to basically tell people to stop setting stuff wrong when the exact setup mentioned is being done by Capita engineers too.

 

Steve

[matt40k]

I wouldn't say it's random, it's based on feedback. And again, it's hard to judge the setup based on the limited information you've posted. Is this Bedford or Chelmsford? Was this yesterday, or 3 years ago - is the information out-of-date? Did they use FMS? Is the Census folder on a drive other then S:? Is it any number of questions about the setup? Has the person who set it up getting told off right now for not following procedure? The point is, you can't use "well they do it like that" as a reason to bypass security. Microsoft has spent millions of dollars and man hours creating a secure system and it seems ridicious for logical people to override those security measures because it perceived as easier. Why is this even a thread beyond the initial post (except @forkies point)? Surely people can understand why a topic about security specifics doesn't want to occur in a public arena where "hackers" are lucking - especially when we need to accept we have legacy requirements that may require additional permissions beyond what we should except nowadays. I could understand this topic occuring in SupportNet where members are at least vetted first, but EduGeek. Mind boggled to say the least.

[beany1]

Can I ask, what data is it in the SIMS drive that I need to check isn't accessible?

 

Our SIMS is supported by an external company I don't have much to do with it...but our SIMS drive is accessible to staff. We are a Primary - with all class teachers and all admin staff having SIMS access. (So not all primaries are 1 or 2 workstations!).

[Steve21]

I could understand this topic occuring in SupportNet where members are at least vetted first, but EduGeek. Mind boggled to say the least.

 

And the same question would be on there too. Capita installed setups that we're now being told are wrong. So what is the recommended setup? As I asked in my first post.

 

But as this seems to be getting heated now, I'll wait to see if Capita will give an answer. *shrugs*

 

Steve

[localzuk]

Why is this even a thread beyond the initial post (except @forkies point)?

 

The thread exists because Phil is wrongly attacking people by saying Capita wouldn't have set things up that way...

[matt40k]

I'll wait to see if Capita will give an answer. *shrugs*

 

Wonder where it is on the pile, hopefully not under Nova-T7

 

The thread exists because Phil is wrongly attacking people by saying Capita wouldn't have set things up that way...

 

SHOULDN'T. Capita is a company made up of people. People make mistakes.

[clockend25]

Poor judged thread IMO. Doesn't come across particularly well even before taking into account Capita's own practices.