Moving all our data into Office 365

[free780]

Or you try and move away from file explorer entirely. However this means if you use anything other than Office your stuck with a slow webdav connection. The OneDrive client can run setup with a GUI so the user can see it's setting up. Until a laptop per staff/student is purchased you can't really get around the issue.

[mukz]

I believe MS are making the client per computer install which will be deployable. But MS might change there mind as always

[free780]

If it follows the teams client it updates in the user context. Even though it's a MSI on machine level.

[Bob_the_Goon]

How are you guys going backing this data up? Are you relying on the default Microsoft backup settings for SharePoint Online?

[synaesthesia]

Yes; it may have it's shortfalls and the "what happens if it goes wrong" what-if scenario, however it's easier to comply with GDPR with that due to MS's compliance tools than the vast majority of backup solutions available.

[mavhc]

Seems like a lot of pain, what the advantage of moving to O365/GSuite?

[mjk]

Seems like a lot of pain, what the advantage of moving to O365/GSuite?

I don't think the problem is with gsuite, that all worked smoothly for us. It looks like O365 is just a lot more behind Google as usual. The advantage is that staff and students can work from anywhere on any device the same as if they were in school, it all gets backup up automatically, and we don't need to buy servers.

[ITGURU]

All I can say is Brave move!

[mrbios]

I'm currently using this nifty little product: https://www.layer2solutions.com/products/layer2-cloud-connector to do bidirectional syncronisation of student home folders to their one drive accounts. It's not instant, it is a scheduled service, but as we're an Office 365 school with no intent of using Gsuite, it makes chromebooks much more usable, as they now SSO straight into the office 365 portal, and each user can click on onedrive and see the contents of their home folder. Then normally, by the time they get to another computer after using the chromebooks, the data in their onedrive has synced back to their home folder.

 

Obviously there's quite a bit of flexibility with it, you can use it in a whole bunch of other ways, and i've not go round to automating adding new users to it yet but im sure that's possible with the right scripts. It will also largely depend on the state of your on site folder structure as to how well it would achieve syncing everything, but i guess that's the same for any product to achieve this.

 

I'm doing bidirectional, but you can choose to just do the transfer in one direction if you prefer, personally i don't see onsite storage going anywhere any time soon!

[RobFuller]

Does it recognize user home directories and matches up with there O365 accounts or is it that a script?

 

I'm currently using this nifty little product: https://www.layer2solutions.com/products/layer2-cloud-connector to do bidirectional syncronisation of student home folders to their one drive accounts. It's not instant, it is a scheduled service, but as we're an Office 365 school with no intent of using Gsuite, it makes chromebooks much more usable, as they now SSO straight into the office 365 portal, and each user can click on onedrive and see the contents of their home folder. Then normally, by the time they get to another computer after using the chromebooks, the data in their onedrive has synced back to their home folder.

 

Obviously there's quite a bit of flexibility with it, you can use it in a whole bunch of other ways, and i've not go round to automating adding new users to it yet but im sure that's possible with the right scripts. It will also largely depend on the state of your on site folder structure as to how well it would achieve syncing everything, but i guess that's the same for any product to achieve this.

 

I'm doing bidirectional, but you can choose to just do the transfer in one direction if you prefer, personally i don't see onsite storage going anywhere any time soon!

[leegcvcc]

I'm currently using this nifty little product: https://www.layer2solutions.com/products/layer2-cloud-connector to do bidirectional syncronisation of student home folders to their one drive accounts. It's not instant, it is a scheduled service, but as we're an Office 365 school with no intent of using Gsuite, it makes chromebooks much more usable, as they now SSO straight into the office 365 portal, and each user can click on onedrive and see the contents of their home folder. Then normally, by the time they get to another computer after using the chromebooks, the data in their onedrive has synced back to their home folder.

 

Obviously there's quite a bit of flexibility with it, you can use it in a whole bunch of other ways, and i've not go round to automating adding new users to it yet but im sure that's possible with the right scripts. It will also largely depend on the state of your on site folder structure as to how well it would achieve syncing everything, but i guess that's the same for any product to achieve this.

 

I'm doing bidirectional, but you can choose to just do the transfer in one direction if you prefer, personally i don't see onsite storage going anywhere any time soon!

 

thanks @mrbios. What happens if your users have quotas set on their on-premise home drive (500mb), and then uploads a file to OneDrive (50gb) that puts them over the home folder quota? Does it deny the user the upload with any sort of message? I'm thinking of the scenario where OneDrive accepts the upload then fails to sync to the on-premise home drive without anyone knowing it's not fully synced. Cheers

[mrbios]

thanks @mrbios. What happens if your users have quotas set on their on-premise home drive (500mb), and then uploads a file to OneDrive (50gb) that puts them over the home folder quota? Does it deny the user the upload with any sort of message? I'm thinking of the scenario where OneDrive accepts the upload then fails to sync to the on-premise home drive without anyone knowing it's not fully synced. Cheers

 

Not sure is my answer there

 

I'm still testing things at the moment, but it seems fairly granular in terms of what you can do. I've only gone as far as syncing one user on a proof of concept basis so far, but i've got the scripts and connection files ready to be able to sync all students if i decide to go for it.

 

I'm pretty sure you could take it down a notch too, sync one folder within all students home folders or sync them to or from an individual folder within OneDrive (I don't yet know if the process can create the folder within OneDrive for you, i presume it can seeing as it can do everything else) So you could sync say have a folder tree such as:

User - Home folder - OneDrive Sync Folder

Onedrive - Home Folder - OneDrive Sync folder

 

and sync those two folders together rather than syncing the folders above etc.

 

I'm thinking of syncing a users home folder to a folder within their onedrive, so that if they upload something to the root of their onedrive it doesn't upload, that way it can still be a standalone storage space in that respect, and they only put things in the folder that they want to be synced.

 

We've got FSRM file screens with various file type restrictions on, i think in the layer2 app you can specify file type restrictions, you can also do that in OneDrive. Ideally you'd want them to match i think to avoid sync errors. We also use quotas, so i'll have to have a think about how that's going to work. I think there's going to be a lot of scripting and log output emails needed at least in the first instance to get everything working flawlessly.

 

Does it recognize user home directories and matches up with there O365 accounts or is it that a script?

 

It's all scripted unfortunately, but highly customisable. With the right programs to export your AD data you can have the connections files built in a matter of minutes, it's just keeping it updated over time as students and staff come and go that will need a bit more work.

Edited June 27, 2018 by mrbios

[TwistedHelixis]

How are you guys going backing this data up?

 

I would take a look at Spanning its also GDPR complaint and offer school discounts. For G Suite it backs up all mails, calendars, Sites, Drives files, team drive files etc.

 

Seems like a lot of pain, what the advantage of moving to O365/GSuite?

Cant speak for Office365 but we now have unlimited space / backups and when Sims / FMS go online next year we will not need the server and all the sh*t that goes with that. Staff can access their work simply from anywhere, its a no brainier. Migrating all the files using file stream / team drive / backup & sync was much easier than I had expected.

The speed of the Google mapped drive (File Stream) is great and nobody even seems to realise none of the docs are actually on their laptops.

[DrCheese]

Staff can access their work simply from anywhere, its a no brainier. Migrating all the files using file stream / team drive / backup & sync was much easier than I had expected.

 

I get this, but what's to stop staff from simply loading up google drive file stream at home & then en mass pulling down tons of data to their home computers?

[TwistedHelixis]

I get this, but what's to stop staff from simply loading up google drive file stream at home & then en mass pulling down tons of data to their home computers?

You can make files none downloadable, none printable etc, or you can get the staff to sign a policy saying they will not download files. Our staff have been told they can only use file stream on school supplied laptops, as always there does need to be some trust.

[TwistedHelixis]

You can make files none downloadable, none printable etc, or you can get the staff to sign a policy saying they will not download files. Our staff have been told they can only use file stream on school supplied laptops, as always there does need to be some trust.

Also everything is monitored and audited to within an inch of its life, so if anyone did break our policy rules we would be able to see who, how and when. Edited June 28, 2018 by TwistedHelixis

[free780]

On the Office 365 side you can lock down files even via a sync via WIP. You can do it via SCCM as well if your not on office 365 though it won't work on personal devices.

[mjk]

Also everything is monitored and audited to within an inch of its life, so if anyone did break our policy rules we would be able to see who, how and when.

 

And you get an instant alert when it happens !

[DrCheese]

So you get alerts if someone say, pulls down an entire share to their home computer?

[mjk]

So you get alerts if someone say, pulls down an entire share to their home computer?

 

no, you only get an alert if it detects confidential information (defined by you, or there are some templates). Gsuite will then automatically prevent it being shared outside the domain but once the confidential information is determined you can specify the files can't be downloaded, printed etc.

[free780]

A lot of faith in indexing then. What happens if it's an encrypted office file. Then I guess it's secure as long as the password isn't letmein.

[TwistedHelixis]

In g suite / drive / team drives you can also block all downloading.

[TwistedHelixis]

A lot of faith in indexing then. What happens if it's an encrypted office file. Then I guess it's secure as long as the password isn't letmein.

 

Although I have not played I am pretty sure you can create alerts for almost anything including reporting on downloaded files from specific areas.

[DrCheese]

In g suite / drive / team drives you can also block all downloading.

 

Aye, but in school you'd want to allow that - It's a shame you can't set on either of them "Allow downloading from these IPs" but deny the rest. I just don't trust someone not to exfil tons of data, either staff or an attacker who has the user/password (Which is why I'm pushing 2fa before we even start on this route!)

[mavhc]

Aye, but in school you'd want to allow that - It's a shame you can't set on either of them "Allow downloading from these IPs" but deny the rest. I just don't trust someone not to exfil tons of data, either staff or an attacker who has the user/password (Which is why I'm pushing 2fa before we even start on this route!)

 

 

I'm sure I saw a google help document about restricting what computers Drive would work on, with a registry key or json file or something, but can't find it now.

 

Was something like "Only work if this thing was set to your G Suite domain name"