What a mess!

[ilc72]

Hi

 

I am a recently appointed co-opted governor for a UK school. The School I represent outsourced its IT service provision a few years ago, recently the Service Provider changed. Unfortunately the School has no on-site IT knowledge and therefore I have been asked as a recently retired IT specialist to conduct a thorough review following a recent cyber attack.

 

The School signed a three-year licensing agreement back in February 2016 paid annually. This was purchased via the original SP and the order placed through a Distributor. However in turns out the School were never invoiced for the charges in February 2017 or February 2018. Without going too much into the situation their needed to be a complete regime change due to issues with the previous Head, Chair of Governors, the original SP, and Business Manager around conflicts of interest.

 

Obviously the School appreciates it needs to rectify the situation with Microsoft, but has not budgeted for a huge bill for previous years. The School has around 100 FTEs and 1000 students.

 

Does anyone have any experience of how to deal with this situation?

 

The new SP has quoted for Licensing under the new OV-ES agreement but I have some questions.

 

We are planning on migrating staff and teachers to a hosted Office 365 environment, I would like to ditch the local Exchange server completely but I am told this isn’t possible as it is needed for authentication?

 

I am also pushing the new SP to implement VDI where possible (starting with a pilot for the back office staff and teachers (to provide remote access) though meeting stiff resistance. Currently we have around 400 PC’s all running Windows 7 and the new SP recently installed Sophos AV on the endpoints at presented us with a bill of £5K for a three-year agreement. We are in the process of having a new Gigabit fibre connection with a Fortigate UTM solution installed.

 

We are trying to decide between Enterprise Desktop for Education E3 and E5.

 

So the questions I need to ask are:

 

Q1. Does Windows 10 Education A3: Windows Defender Antivirus, Device Guard mean that Sophos is redundant, when taken in addition to Fortigate UTM?

 

Q2. Does Enterprise Mobility Suite (EMS) A3: Intune for Education, Azure Active Directory P1 allow us to perform synchronisation between AD on premise with Office 365 AD for Single Sign On, Password Resets, and enable us to implement Two-Factor Authentication without purchasing additional products? Will there be ongoing additional CSP costs for an Azure AD tenant?

 

Q3. If the School runs a hosted SIMS solution do you still need SQL server licences to connect to AD? The SP is telling us we need two full SQL Server licenses for this purpose? Is the another alternative since new SP is saying we need two SQL Server Standard Core licenses at a cost of £700 for the primary/backup VMs that host this function? My experience is that typically cloud-based applications include a limited license for this purpose?

 

Q4. If we offer teachers remote access via a VDI portal do we need Windows Virtual Desktop licenses if using a VMware Horizon solution based on premise? If so, are licenses purchased for concurrent users or all users with remote access?

 

Q5. How does Microsoft generally handle issues where subsequent payments have not been made to multi-year agreements? We have checked and the School was never notified or invoiced by the original SP, moreover the Distributor handling the agreement never contacted the School to warn them of non-compliance as I’m being told is the normal process?

 

Q6. How can I verify the pricing is not marked up? Our new SP is not an education specialist, we have previously seen excessive markups on other products with special educational pricing from them? Can anyone recommend a good educational reseller to work with?

 

Thanks for any guidance... ilc72

[Ditto]

Welcome to Edugeek - you really have been landed a 'challenge' here! I'm also a governor at a local school that one of my children attends. I have worked all my life in IT and have for the last 4 years worked in an IT capacity in primary and secondary schools. Others will address your specific questions in a much more informed way than myself, but a couple of things strike me from the outset.

 

Firstly, it strikes me that as a governor, you are heading deep into operational matters rather than strategic. With my mix if professional IT experience and my governance role, I often have to pull back from drifting too deeply in to operational matters, whilst still finding a balance of adding value because of my experience. With no onsite IT knowledge, I can see this is particularly challenging and being signed up with a SP already, getting truly independent good advice could be hard. I wonder if you should be advising the school, via the governing body, to call in an independent third party to review and advise. I know there would be a cost, but I feel it would be a more appropriate way forward. I'm sure Edugeekers will be able to make recommendations, perhaps local to your school.

 

The second thing that strikes me is that it seems that you are only considering a broadly Microsoft based future. Whilst I don't want derail the thread in an 'x' platform versus a 'y' platform, I would strongly encourage you to look at alternatives. I've worked in a deeply committed Chromebook and GSuite for Education environment and also one that is more wedded to MS Windows and a good splattering of Apple devices. I have my preferences but each school needs to decide for itself which direction to go. What I encourage is that you take a look at alternatives if at all possoble. Whichever route a school takes, and even in mixed platform environment, there will be challenges. Absolutely key to being successful, is how capable your support staff are - and as you clearly have discovered, being entirely outsourced puts the school at great risk when things go pear shaped.

 

I'll be watching the thread with great interest - please do keep us informed as you move forward.

 

PS - Happy Christmas and a Happy New Year!

[ilc72]

Hi Ditto

 

You rightly identify the challenges we face and we have had long discussions amongst the Chair of Governors, Chair of Resources and myself about the separation of responsibilities. Governors are there to provide advice and oversight and not take day-to-day responsibility.

 

The problem we have is the Business Manager is new and has no IT knowledge, the Head won’t sanction the appointment of an IT Manager, and there have been major issues that have led us to this point. The SP basically has presented the School with a quote for a Windows 10 Upgrade for £300K, split £180K for servers and storage, with a further £120K for 100 new PC’s and to upgrade remainder of estate to 256GB SSD and 8GB RAM.

 

School’s simply don’t have the resources to manage an environment like this and you are completely right there are other strategies out there including non-Microsoft.

 

The issue is that there are things that need to happen immediately:

 

Microsoft Licensing

Internet Connection & Improved Security (currently looking at a managed service from Schools Broadband for this)

Email Migration to O365 (existing SP are quoting)

Storage (currently we are desparately moving data to alleviate pressure on our old mirrored 10TB HPE SANs and have an upcoming software licensing timebomb)

 

Collectively we have decided to establish a working party comprised of three Governors, the Business Manager, and a representative from the SLT to address the IT Strategy in the New Year. We are looking to invite third parties to provide input into that process. So far we’ve looked at the Cutter Group and CSE NET but would welcome advice from others.

 

The Governors want to see a seed change in IT Strategy whereby funds are not just spent maintaining infrastructure, but using IT as an enabler to improve Teaching & Learning as well as the Student Experience.

 

For reference we are based in Surrey and the School is a Grant Maintained Secondary School, one of the few left that hasn’t joined the local MAT.

 

I’d love to see how other Schools have addressed this conundrum and how they are innovating.

[mikeprice]

Hi - Welcome to EduGeek

 

If you feel you can let us know where in the country you are you may find that someone may offer to help you out - seems like you need all the help you can get!

 

Good luck - looks like you will need it!

[ilc72]

Hi Mike

 

For reference we are based in Surrey and the School is a Grant Maintained Secondary School, one of the few left that hasn’t joined the local MAT. We are close to the Hampshire border in about 30 miles to the West of London. We would certainly welcome any support that can be offered by anyone and am happy to come and meet people and see their environment and learn from others.

 

Happy Christmas to all!

[mikeprice]

Hi Mike

 

For reference we are based in Surrey and the School is a Grant Maintained Secondary School, one of the few left that hasn’t joined the local MAT. We are close to the Hampshire border in about 30 miles to the West of London. We would certainly welcome any support that can be offered by anyone and am happy to come and meet people and see their environment and learn from others.

 

Happy Christmas to all!

 

OK - I'm about 1 million miles away so .....

 

Maybe someone else??????

[AlanD]

Q1. Does Windows 10 Education A3: Windows Defender Antivirus, Device Guard mean that Sophos is redundant, when taken in addition to Fortigate UTM?

 

You could/can use Windows defender - BUT...it would be pretty unmanageable without centralised updates/monitoring etc which can be done through SCCM (which is neither cheap and a serious piece of kit to setup)

 

 

Q2. Does Enterprise Mobility Suite (EMS) A3: Intune for Education, Azure Active Directory P1 allow us to perform synchronisation between AD on premise with Office 365 AD for Single Sign On, Password Resets, and enable us to implement Two-Factor Authentication without purchasing additional products? Will there be ongoing additional CSP costs for an Azure AD tenant?

 

 

..well if you used Intune (which might be a sensible future...) you wouldn't want a local AD at all. Its not a well developed solution (in my view) and Microsoft has a tendency to pull the plug on such developments which are not widely adopted....

 

And yes, its now possible to synchronise and reset passwords and provide SSO with the latest versions of DirSync or Azure Connect ...or whatever Microsoft has decided to call it this week. So, no, its no longer necessary to pay for licencing Azure

 

(..But you would need Server 2016...and Windows 10....I think)

 

 

Q3. If the School runs a hosted SIMS solution do you still need SQL server licences to connect to AD? The SP is telling us we need two full SQL Server licenses for this purpose? Is the another alternative since new SP is saying we need two SQL Server Standard Core licenses at a cost of £700 for the primary/backup VMs that host this function? My experience is that typically cloud-based applications include a limited license for this purpose?

 

If its cloud based - I can't see why you'd want local SQL licences. We don't use SIMs - but Yes - to host SIMs - I'm sure you would want licences.

 

Q4. If we offer teachers remote access via a VDI portal do we need Windows Virtual Desktop licenses if using a VMware Horizon solution based on premise? If so, are licenses purchased for concurrent users or all users with remote access?

 

I've no idea...but I'm sure they will tell you...and Yes, I'm sure it will cost money - probably a lot of money. There are "free" (although that would assume you are not paying anyone to install and set them up) "Linux" based solutions that allow you to designate a block of school schools to allow staff/students to connect to remotely via a web page....which avoids running a server....and therefore avoids the issue of remote licences for desktops - because you are using the existing desktops.

 

BUT...allowing connections from outside to inside is a BIG hole to put in your network. Various RDP services are known to be hackable. You could but in a VPN layer (more licences for the clients potentially)...but you would still have a potential issue of dirty end user computers (potentially with keystroke loggers) being connected to your network. Did you say that one the whole reasons for your mess was a breach? Really you need to give your staff locked down laptops which are managed through your network...or possibly inTune.

 

 

Q5. How does Microsoft generally handle issues where subsequent payments have not been made to multi-year agreements? We have checked and the School was never notified or invoiced by the original SP, moreover the Distributor handling the agreement never contacted the School to warn them of non-compliance as I’m being told is the normal process?

 

It sounds to me that you need to pay up. You have used their stuff for two years...and not paid. That's not moral. If you don't want to pay for their stuff...you shouldn't use it. Why should the rest of us pay more to cover their losses by you not paying.

 

I suspect that the email addresses used belong to staff/users that are no longer in the school and their accounts have been deleted...so notifications will not have come though. But, not getting a notification doesn't get you out of paying!!!

 

Q6. How can I verify the pricing is not marked up? Our new SP is not an education specialist, we have previously seen excessive markups on other products with special educational pricing from them? Can anyone recommend a good educational reseller to work with?

 

Why on earth would you have chosen an SP that is not used to working in education?

 

I'm not conscious that any supplier applies higher markups to educational users - its usually the reverse. However, it is, sadly, too often the case that Educational network managers have poor ICT skills, and expect and require an extraordiary amount of support from suppliers to make up the shortfall. You can't expect suppliers to provide what is sometimes daily telephone support and onsite visits without paying for it. And yes it will run to thousands of pounds if you added it all up.

 

We work with RM computers and while I often question the costs..it works..and it works well...and in a joined up manner. It probably isnt the right solution for everyone.

 

I tend to agree with the views of others here, in that while its good to have an interest from the governing body - and their support...it would be in my view - their number one job to get a network manager in place to do this for you. And if they are any good - and experienced in these issues, they are probably going to cost you more than a senior teacher, and would need competent technicians to provide end user support.

 

:-)

Edited December 26, 2018 by AlanD

[strawberry]

willing to entertain a 300k spend but not willing to spend £25k on someone who can provide both support and day to day presence? . That's your first problem. Second is someone trying to implement fancy solutions when it sounds like the day to day isn't being done.

[flyinghaggis]

I tend to agree with the views of others here, in that while its good to have an interest from the governing body - and their support...it would be in my view - their number one job to get a network manager in place to do this for you.

 

+1 It strikes me that the primary reason the school is in the mess it is due to them placing absolute trust in a service provider and not having anyone in-house with the relevant skills/experience to manage them. Your first step as a Governor should be to rectify that issue.

 

Tip: Posting on an educational IT forum asking for (free) help and advice from a group whose jobs the school has just outsourced is likely to rub people up the wrong way......!

Edited December 26, 2018 by flyinghaggis

[ilc72]

willing to entertain a 300k spend but not willing to spend £25k on someone who can provide both support and day to day presence? . That's your first problem. Second is someone trying to implement fancy solutions when it sounds like the day to day isn't being done.

 

That’s rather unfair as I’ve recommended the School hire an IT Manager, but where we are that sort of money will get no-one. Given we are close to the old Silicon Valley of the UK you are talking double that! Part of the problem has been the new HT and their outsource everything. We have lost HR Manager, IT Manager, Facilities Manager etc.. When you do that the chickens come home to roost!

 

The RC know what a Governor’s responsibilities are and that my role is stepping into day-to-day operations, we are putting in place plans to address this but Rome wasn’t built in a day! We as a governing body are committed to developing a new IT Strategy that focuses on improving Teaching & Learning and the Student/Parent Experience.

 

It’s not about cost, though the £300K figure is ridiculous, it’s about delivering improvement. Good IT allows teachers to work more flexibly and productively and so properly focused IT system can deliver tangible savings in staff absences etc..

 

However the Licensing issue needs to be resolved immediately, hence my OP!

[ilc72]

Tip: Posting on an educational IT forum asking for (free) help and advice from a group whose jobs the school has just outsourced is likely to rub people up the wrong way......!

 

I wasn’t involved in any of this, I don’t think outsourcing delivers the long-term savings and will be recommending evaluating bringing it back in house. I know how it feels believe me, although not outsourced I was acquired and “TUPEd” into a Company that I would never of chosen to work for!

 

Also if we get agreement to hire, this forum is where I would post the job link! I fully respect the people on the forum and am not looking for free Consultancy. I did a huge amount of research before posting in the first place! That lead me to here, as there just isn’t the detailed information to answer the questions, and if you read the OP they are of rather a sensitive nature!

[ilc72]

I tend to agree with the views of others here, in that while its good to have an interest from the governing body - and their support...it would be in my view - their number one job to get a network manager in place to do this for you. And if they are any good - and experienced in these issues, they are probably going to cost you more than a senior teacher, and would need competent technicians to provide end user support.

 

:-)

 

Q1. Does Windows 10 Education A3: Windows Defender Antivirus, Device Guard mean that Sophos is redundant, when taken in addition to Fortigate UTM?

 

You could/can use Windows defender - BUT...it would be pretty unmanageable without centralised updates/monitoring etc which can be done through SCCM (which is neither cheap and a serious piece of kit to setup)

 

Thanks for the heads up, I will take a look into SCCM as even with VDI we will most likely still have many desktop PCs, any pilot of VDI would start small and work from there. It wouldn’t even touch the classroom environment in the first iteration. Whatever endpoint solution you have, it needs robust configuration/update management!

 

Q2. Does Enterprise Mobility Suite (EMS) A3: Intune for Education, Azure Active Directory P1 allow us to perform synchronisation between AD on premise with Office 365 AD for Single Sign On, Password Resets, and enable us to implement Two-Factor Authentication without purchasing additional products? Will there be ongoing additional CSP costs for an Azure AD tenant?

..well if you used Intune (which might be a sensible future...) you wouldn't want a local AD at all. Its not a well developed solution (in my view) and Microsoft has a tendency to pull the plug on such developments which are not widely adopted....

 

And yes, its now possible to synchronise and reset passwords and provide SSO with the latest versions of DirSync or Azure Connect ...or whatever Microsoft has decided to call it this week. So, no, its no longer necessary to pay for licencing Azure

 

(..But you would need Server 2016...and Windows 10....I think)

 

Given they bundle Azure Active Directory P1 or P2 I tend to agree, I’d welcome any comments on people who have gone this route. Currently we are planning to upgrade to a 1Gbps Leased Line with a EoFTTC backup through a well known provider so maintaining connectivity shouldn’t be an issue if configured correctly.

 

You raise an interesting point, do people to tend to buy Server licenses or include them in OV-ES, I have read that it’s cheaper to buy as the annual costs are steep!

 

Q3. If the School runs a hosted SIMS solution do you still need SQL server licences to connect to AD? The SP is telling us we need two full SQL Server licenses for this purpose? Is the another alternative since new SP is saying we need two SQL Server Standard Core licenses at a cost of £700 for the primary/backup VMs that host this function? My experience is that typically cloud-based applications include a limited license for this purpose?

 

If its cloud based - I can't see why you'd want local SQL licences. We don't use SIMs - but Yes - to host SIMs - I'm sure you would want licences.

 

I’m still waiting for more information from SP, I will check with Business Manager that it is in fact hosted, then if that’s the case I will check with the supplier to confirm.

 

Q4. If we offer teachers remote access via a VDI portal do we need Windows Virtual Desktop licenses if using a VMware Horizon solution based on premise? If so, are licenses purchased for concurrent users or all users with remote access?

 

I've no idea...but I'm sure they will tell you...and Yes, I'm sure it will cost money - probably a lot of money. There are "free" (although that would assume you are not paying anyone to install and set them up) "Linux" based solutions that allow you to designate a block of school schools to allow staff/students to connect to remotely via a web page....which avoids running a server....and therefore avoids the issue of remote licences for desktops - because you are using the existing desktops.

 

BUT...allowing connections from outside to inside is a BIG hole to put in your network. Various RDP services are known to be hackable. You could but in a VPN layer (more licences for the clients potentially)...but you would still have a potential issue of dirty end user computers (potentially with keystroke loggers) being connected to your network. Did you say that one the whole reasons for your mess was a breach? Really you need to give your staff locked down laptops which are managed through your network...or possibly inTune.

 

Sadly InTune doesn’t work with Windows 7 and attack vector was a spearfishing email attack responded to by a senior member of staff. As I understand it there was no AV installed, only Windows Defender and not Security Esssentials, I don’t think there is any Config Management either!

 

My background involves considerable work in the Defence sector, I don’t believe in giving users laptops, any remote access should be zero or thin client to a persistent VDI image so that they get the same experience outside School inside! We are fortunate not to have many laptops that leave the premises.

 

That said security is always a balance with cost and usability, therefore we are involving a member of the SLT in the Strategy Team and will consult Department Heads and those teachers with an interest as widely as possible.

 

Q5. How does Microsoft generally handle issues where subsequent payments have not been made to multi-year agreements? We have checked and the School was never notified or invoiced by the original SP, moreover the Distributor handling the agreement never contacted the School to warn them of non-compliance as I’m being told is the normal process?

 

It sounds to me that you need to pay up. You have used their stuff for two years...and not paid. That's not moral. If you don't want to pay for their stuff...you shouldn't use it. Why should the rest of us pay more to cover their losses by you not paying.

 

I suspect that the email addresses used belong to staff/users that are no longer in the school and their accounts have been deleted...so notifications will not have come though. But, not getting a notification doesn't get you out of paying!!!

 

We have checked with previous Business Manager and trawled old accounts to no avail. We should pay absolutely, but in my past experience (working for another large Software company), those that came forward we’re offered more leniency and flexibility in resolving issue. The numbers are not trivial and are not included in the budget for this year.

 

One thought I had was whether they’d roll the costs into a new multi-year OV-ES agreement?

 

Q6. How can I verify the pricing is not marked up? Our new SP is not an education specialist, we have previously seen excessive markups on other products with special educational pricing from them? Can anyone recommend a good educational reseller to work with?

 

Why on earth would you have chosen an SP that is not used to working in education?

 

I'm not conscious that any supplier applies higher markups to educational users - its usually the reverse. However, it is, sadly, too often the case that Educational network managers have poor ICT skills, and expect and require an extraordiary amount of support from suppliers to make up the shortfall. You can't expect suppliers to provide what is sometimes daily telephone support and onsite visits without paying for it. And yes it will run to thousands of pounds if you added it all up.

 

We work with RM computers and while I often question the costs..it works..and it works well...and in a joined up manner. It probably isnt the right solution for everyone.

 

I never chose any of this, it’s a mess that I’ve inherited, extremely reluctantly, it’s not about who is the cheapest but ensuring they are close enough. The existing SP quoted £170K for new Servers and Storage that I have found to be available elsewhere through an accredited education partner for about 50% of the cost.

 

Thanks for your responses Alan, I take on board what you are saying.

Edited December 26, 2018 by ilc72

[Steve21]

To be frank, and I'll apologise in advance as it will sound frank, this entire plan sounds like a terrible idea...

 

As others have said, the first point of call here is to get someone in to have a proper look at the setup and what you currently have. It really sounds like no-one has that information currently, whether in-house "or" the new SP.

 

When phrases are being thrown around about gigabit internet, VDI farms etc, and yet no-one can even seem to work out what's licensed it's not going to end well at all...

 

First have a proper discussion in-house about what the school actually wants, most of these "fancy" licenses being talked about aren't needed at all if you're not going to use them for what they're designed for (intunes/A3 etc etc). Does anyone actually have a reason for cloud MIS?

 

You don't need VDI or horizon to do any kind of remote access that's just wasting money left right and centre. Despite your background and your personal thoughts, this is not needed at all for a school, especially one without their own IT to manage any of it...

 

Get three companies in (if the school reallllllly won't hire someone to run it) and get three comparisons to quote for the project. Ensure all stakeholders agree with what they want, and one person isn't trying to design a network that won't give people anything they want at a huge cost.

 

Steve

[Steven_Cleaver]

I would look at a Network audit to try and get a clear picture of your setup as regards to infrastructure gather as much information as possible, from you SP and get an external audit from someone else.

Would also draft up the changes you are interested in making and add key points to these as regards to how these are going to improve students education, reduce costs etc so what benefit they bring

 

Q1. Does Windows 10 Education A3: Windows Defender Antivirus, Device Guard mean that Sophos is redundant, when taken in addition to Fortigate UTM?

 

I would use something else as Alan D has suggested for Central Management of Defender such as SCCM, I removed Sophos a few years ago for Windows Defender\Security essentials but we had something else in central management tools that sort of managed Defender\Security Essential updates and if a an issue occurred and was cleaned or what state so emails any issues and central management console to view state of PC’s. So yes if went the Defender route Sophos would be redundant.

 

Q2. Does Enterprise Mobility Suite (EMS) A3: Intune for Education, Azure Active Directory P1 allow us to perform synchronisation between AD on premise with Office 365 AD for Single Sign On, Password Resets, and enable us to implement Two-Factor Authentication without purchasing additional products? Will there be ongoing additional CSP costs for an Azure AD tenant?

This would be some work to setup going from on premise to cloud as Alan D not 100% confident in Intune as either in Education or private as far as I can see is not massively used. I did look at Intune in Education and Private sector but found I could more easily do some of the things I required with other tools. I work for MSP now and one of our clients has gone cloud based so Office 365 and Azure AD and just pay for Microsoft licencing and Azure Licence per user. So can implement Password resets, two factor through this route.

 

 

Q3. If the School runs a hosted SIMS solution do you still need SQL server licences to connect to AD? The SP is telling us we need two full SQL Server licenses for this purpose? Is the another alternative since new SP is saying we need two SQL Server Standard Core licenses at a cost of £700 for the primary/backup VMs that host this function? My experience is that typically cloud-based applications include a limited license for this purpose?

 

If hosted internally would need SQL licence jf hosted externally think you would have to pay for the SQL licence somewhere might just be hidden in costs. £700 seems high though but I always included mine in our Microsoft Agreement and paid for these yearly which made it easy to upgrade, without paying off extra one off upgrade costs and seemed quite cheap to me.

 

Q4. If we offer teachers remote access via a VDI portal do we need Windows Virtual Desktop licenses if using a VMware Horizon solution based on premise? If so, are licenses purchased for concurrent users or all users with remote access?

It depends how you do this we used a solution based around RDP but with a added encrypted security and could enforce dual factor authentication and this used PC’s in school, Evening, Weekends and Holiday so didn’t incur extra licencing costs. Just depends on solution you go for or how you look at doing this.

 

 

Q5. How does Microsoft generally handle issues where subsequent payments have not been made to multi-year agreements? We have checked and the School was never notified or invoiced by the original SP, moreover the Distributor handling the agreement never contacted the School to warn them of non-compliance as I’m being told is the normal process?

Think you would need to speak Microsoft whether this is through third party or directly, they may as you suggest by coming forward allow this to be paid over longer period rather than up front but just think this needs o be dealt with because if it is found you haven’t paid the situation could become more difficult.

 

 

Q6. How can I verify the pricing is not marked up? Our new SP is not an education specialist, we have previously seen excessive markups on other products with special educational pricing from them? Can anyone recommend a good educational reseller to work with?

 

The figure of 330k for what you are after seems absolutely ridiculous and is way over spec’d\priced or possibly both.

I would get three quotes from educational resellers suppliers for comparison.

You mention speaking to CSE used these a few years back and were good also as Alan mentions could look at RM could also try Stone Computers and Burconix as have used these in the past as well and have been very good.

CSE Education Systems | Technology for Education

https://www.rm.com/

https://www.stonegroup.co.uk/

Burconix Ltd Network Solutions

[mavhc]

> a recent cyber attack.

 

SRP or AppLocker stops that pretty much dead. Can't run malware if you can't run any code that's not installed by root user.

 

> 100 FTEs and 1000 students.

 

Licencing based on staff numbers looks like a good idea then

 

> hosted Office 365 environment, I would like to ditch the local Exchange server completely but I am told this isn’t possible as it is needed for authentication?

 

That's rubbish, Authenticate via AD, Azure AD Connect syncs local AD to Azure AD, which is used for free (for schools) Office 365. Easy enough to migrate local Exchange to O365.

 

> I am also pushing the new SP to implement VDI where possible

 

Wouldn't bother, just doubles your costs.

 

> Currently we have around 400 PC’s all running Windows 7 and the new SP recently installed Sophos AV on the endpoints at presented us with a bill of £5K for a three-year agreement. We are in the process of having a new Gigabit fibre connection with a Fortigate UTM solution installed.

 

https://swgfl.org.uk/products-services/software-and-licensing/sophos-software/ has it for £1380 for 3 years for 400 devices

 

We are trying to decide between Enterprise Desktop for Education E3 and E5.

 

So the questions I need to ask are:

 

> Q1. Does Windows 10 Education A3: Windows Defender Antivirus, Device Guard mean that Sophos is redundant, when taken in addition to Fortigate UTM?

 

Sort of, as others have said, Win 10 comes with AV anyway, can just buy Win 10 Pro devices (or upgrade from Win 7 Pro maybe) and not bother with yearly costs if you want to save money.

 

> Q6. How can I verify the pricing is not marked up? Our new SP is not an education specialist, we have previously seen excessive markups on other products with special educational pricing from them? Can anyone recommend a good educational reseller to work with?

 

Just looking for prices I'd ask any of them https://www.phoenixs.co.uk/microsoft-ovs-es-agreement-for-schools/ etc

[deano3693]

120k for 100 PC's and upgrades to 256GB/8GB RAM - You are being massively ripped off this is nearly £1000 per PC!

 

The first thing i would be looking is to ditch the Support Provider who are clearly not doing anything in the schools best interest. Why haven't they picked up on the lack of licensing?

 

Has someone got access to the VLSC and actually confirmed that you still have access?

 

If you don't any Volume Licensing would be a new agreement which would come at a higher cost anyway as you are not an exisiting volume licensing customer.

 

I agree with the other comments you need to get someone in to write a full report and suggested direction. It sounds like there are far too many people involved - some who have IT Knowledge and others who have none so just say yes/agree to things for an easy life and this isn't going to get you anywhere and also cost you a fortune.

[southhamster]

Could your local authority IT support be of any help? Assuming they have any in-house expertise and haven't been outsourced themselves!

Here in Devon we have SCoMIS who offer a full range of support.

[Ditto]

I was thinking the same, but presumably the school having gone to an external SP, that it would be a fresh start. Being Surrey LA, I guess any service would be provided by Babcock 4S?

[Ditto]

Given we are close to the old Silicon Valley of the UK you are talking double that!

Recruitment is tricky and the area makes it more so, but my previous school had a large number of staff from non-education backgrounds and work for a fraction of what they could earn elsewhere. Circumstances vary, but many are parents who have make a lifestyle choice of part time work. Term time only, part time hours and the flexibility has led to some outstandingly good value appointments, so I think there is some hope. It does require a degree of luck because it's a relatively small pool of people in this position and you do need specialist skills, but I think it is worth a try. Additionally, I wonder if you'd be better offering a 3 or 6 month contract. You'll pay more in the short term, but as you've clearly stated, you need to resolve some significant challenges quickly.

[Ditto]

Q3. If the School runs a hosted SIMS solution do you still need SQL server licences to connect to AD? The SP is telling us we need two full SQL Server licenses for this purpose? Is the another alternative since new SP is saying we need two SQL Server Standard Core licenses at a cost of £700 for the primary/backup VMs that host this function? My experience is that typically cloud-based applications include a limited license for this purpose?

Can you say who is providing this hosted service? I agree you would expect licensing costs to be included, let alone separately paying for 2 more.

[mavhc]

HP Elite 8200 SFF - Core i5 Refurbished, ICT Direct - ICT Direct £137 for an 8GB ram, 256GB SSD PC with 24 months warranty, if you want >20 apparently there's discounts.

[elsiegee40]

Looking at warrantied refurb kit can save you a fortune. ICT Direct is a forum sponsor and there are plenty of our members who have managed to get what they need from there for a vastly reduced price and will vouch for the service from @ICTDirect_Dave and his crew.

[ilc72]

I would like to thank everyone for their contributions.

 

I appreciate the honest feedback, it has been taken on board and much was already in our plans.

 

Nothing will happen, or money be spent, that’s not critical without a full root and branch review of the existing infrastructure and a full Needs Analysis involving those people that actually use the systems.

 

Too often money is spent on infrastructure that is over specified. I’m no fool and won’t allow the School to be ripped off on my watch, there are plenty of options and using refurbished kit is definitely one.

 

To be honest until recently there hasn’t been a great deal of Desktop innovation since Intel’s Sandy Bridge architecture.

 

I don’t want the thread to be hijacked, and have had a couple of very helpful PMs! I’ll ask a Mod to lock the thread

[elsiegee40]

At the OP’s request this thread is being locked