Am I over reacting?

[Chockster]

If you've got any Cyber Insurance in place you'd also be open to them not honouring a claim if you do this without ESUs.

[synaesthesia]

I'd be making damn sure that "consultant" never works in IT/security ever again.

[PotNoodleTech]

If you've got any Cyber Insurance in place you'd also be open to them not honouring a claim if you do this without ESUs.

 

They won't have cyber insurance if they're running 12 year old PCs methinks.

[Dan2025]

It's a tricky situation unfortunately, especially considering the conflict of interest.

 

I'm guessing the Office interior design budget is more important, any carpets been purchased recently? Educated guess.

 

I'd definetly be trying to get feedback from the MSP on their thoughts on this situation. Then some articles about the risks, a few examples of ransomware hitting schools and the consequences.

 

If anyone moans about the computers to you, 'I had planned to upgrade these, I was blocked from doing so. If this is restricting your lessons/teaching, take it up with slt'

[strawberry]

No. Governors for nuclear option, resume for the fall out.

[penfold]

I will ask, what does your JD cover? Are you responsible for the budget/direction etc of IT or are you there to maintain. If you are there to maintain, it's really simple. They don't value your input enough to trust what you are saying. The consultant is just telling them what they want to hear as they have already made the decision NOT to spend the money they need to spend. This is the reason they have gone round asking for advice until they got someone who told them what they wanted to hear. Like others have said, raise your concerns in writing. I would be also tempted that an email is not enough and also print it out "just in case" and present your concerns were they have to acknowledge that you have done it.

 

But lets be honest. If this is how they are treating you, the person that knows your environment the best, the only way it see it getting better is if there is a change in senior management. If this is unlikely, you will always be fighting a loosing battle. I remember being told something a few years back which sounds simple, but can be quite hard....Focus on what you can control. And let anything else go. Raise your concerns, highlight the risks and move on. Focus on what you can make better. Soon enough they will find the money when everything starts failing at once.

[msi_school]

AKA: We went for the most expensive option and can't afford to maintain it because of all the hidden costs.

 

They are hardly hidden costs, the licenses all have their renewal dates on them.

[dmj]

They are hardly hidden costs, the licenses all have their renewal dates on them.

 

The hidden cost is the forcing TPM hardware, without the registry hacks.

We used to buy 'perpetual' licenses. £30 would do us ten years (the lifetime of the OS), so we could afford to upgrade the hardware. Now it's just a rip off.

Edited February 7, 2025 by dmj

[mavhc]

> They are currently against purchasing the ESU despite it being £1 per licence for the first year, the advice by the consultant is running windows 10 without updates is a minimal risk and a risk worth taking to save some ££ (we are only talking at about £250)

 

Might as well just buy the computers now, there's always money available, how many computers?

 

> On average our budget since 2018 has been £60K a year. This is to cover all costs in IT including MS licences, ISP, AV etc etc our finance team is definitely interesting to work with.

 

What size school? What's their total budget? https://schools-financial-benchmarking.service.gov.uk/

 

Why are you paying for AV when it's built into Windows now

 

Why are you paying for an MSP?

[PotNoodleTech]

Man that schools benchmarking site is so useful such a shame it doesnt cover Wales!

[jthompson]

Win10 LTSC will only give you another 15 months (until Jan 2027) after 22H2 goes EOL.

 

IIRC Cyber Essentials doesn't ask about whether your hardware is supported, or whether your software is supported for your specific hardware, only whether your software is supported and up to date (i.e. high and critical updates within 14 days). Running Win11 on hardware that's not on MS's list, provided it's still a current version and is receiving the latest monthlies, is arguably compliant to my mind. Correct me if I'm wrong, please.

 

RE: the OP, anyone suggesting you can just carry on without being able to keep pace with the monthlies needs to GTFO, so no, not an overreaction.

Edited February 7, 2025 by jthompson

[IT_CoffeeNeeded]

250 computers left needing to be replaced which is quite a lot considering how much they are willing to invest.

 

A decent sized school. income on the bench marking is over 10million for the year 23-24.

 

Our AV comes as part of the bundle with the ISP which saves a bit of money each year.

The MSP is a very small contract that covers escalations in case something arises. (Good to have an escalation point in the event of a disaster or cyber attack imo) which I rarely use.

[strawberry]

cyber attack imo) which I rarely use.

 

paying them to point out the 12 year old computers and moonwalk back out the door there.

[Koldov]

Win10 LTSC will only give you another 15 months (until Jan 2027) after 22H2 goes EOL.

 

Unless you are on Windows 10 Enterprise LTSC 2019 which is EOL Jan 9, 2029

 

IIRC Cyber Essentials doesn't ask about whether your hardware is supported, or whether your software is supported for your specific hardware, only whether your software is supported and up to date (i.e. high and critical updates within 14 days).

 

I also wasn't sure the comment about RPA / Cyber insurance not covering you because of the age of the machines was correct either... However, regardless of the OS being up to date, it's very doubtful 12 year old computers have had recent BIOS/UEFI updates to address any security issues and that might invalidate your cover, no?

[mavhc]

Anything that would cause a ransomeware attack to actually work would invalidate your cyber insurance, it's as if it's a fake product

[jthompson]

Unless you are on Windows 10 Enterprise LTSC 2019 which is EOL Jan 9, 2029

 

 

 

I also wasn't sure the comment about RPA / Cyber insurance not covering you because of the age of the machines was correct either... However, regardless of the OS being up to date, it's very doubtful 12 year old computers have had recent BIOS/UEFI updates to address any security issues and that might invalidate your cover, no?

 

Thanks for the reminder RE: LTSC 2019. I'd forgotten about that!

 

RE: firmware updates on older hardware, if you've got the latest version on, even if that's 7 years old, it's "up to date", no? Not arguing that it's an okay position to be in, but in terms of Cyber Essentials, is there anything to disqualify there?

[ICTDirect_Dave]

250 computers left needing to be replaced which is quite a lot considering how much they are willing to invest.

 

I rarely advocate leasing as an option, but it might be the ideal thing for you right now.

Get all 250 replaced with good quality refurb kit and split the cost over a multi-year deal.

£5-6k per term might be more palatable than a huge upfront investment.

[paulkerton]

We should manipulate the registry settings on the non windows 11 compatible machines, to install Windows 11 onto them. (The computers in question are 12+ years old)

I'd quite like to know who this consultant is, so we can avoid them in the future! OMG.

[Andrew_C]

I'd quite like to know who this consultant is, so we can avoid them in the future! OMG.

Errr... My guess? Spouse of deputy head who "does something in IT".

[mikes]

below tl;dr = of course consultants are in it for themselves, wouldn't trust a thing they say. Also if you are the ICT Tech - if it all goes wrong is it really your responsibility ultimately? I am just ICT Tech so ultimately nothing is my responsibility as I am not in a network manager position. They would have to make me a NM then I would dictate where the spending goes. Otherwise my advice is my advice and you ignore at your own peril.

 

My story

We actually had consultants advise we replace our servers and switches which were around 3 years old, to solve a slow network problem. The real problem of course we were using 6+ year old Intel Celeron laptops with rotational HDD's around the days of Windows 7. They said don't worry about the computers. Obviously their margins/levels of work are much better doing servers/switches.

 

Replacing our servers/switches would have done nothing as the load was negligible, the "network was so slow" was because the struggling laptops/desktops were stuck at 99% CPU taking 5+ minutes to even get to a stage where they'd booted up to connect to the network in the first place.

 

I said basically - if you think the switches and servers are the problem - go ahead - replace them - you will get no help from me at all, I will stay well away from it you can handle everything yourselves. Suddenly they gave in, all got new computers (decent i3's / i5's but the SSD being the important bit) and my reputation went up so much the governors sent me a letter of thanks (that I hadn't pissed £30,000k+ up the wall as we replaced everything, desktop and laptop)

Edited February 7, 2025 by mikes

[chaplic]

Well, I'm a consultant and, yes I'm in it for myself. Which is why it's baffling to issue a fundamentally flawed 'make do and mend' piece of advise as you're never going to get much repeat business from a school even if you say what they paymaster wants, and why on earth would you issue such advise that's got a real, tangible, possibility of blowing up in your face.

 

 

Of course we dont know a) why said consultant was chosen (it does feel like dave built his own gaming PC) b) what the scope/ question was asked c) what the actual advice was

[mikes]

Yeah who knows. Perhaps the guy said "yes technically you can bypass this EoL with this reg hack and continue to work but it's not something I'd advise due to the security implications" and all the school heard was "yes you can bypass the EoL" and that was that. Didn't mean to say all consultants are bad but honestly the majority of the ones I've seen have all been about - "right, what is the most cash I can get out of this school for the least amount of effort" - proper solutions never came into it.

[IT_CoffeeNeeded]

Wait, what?!

 

As for the OP...

 

There is no way any decent IT consultant should be advising registry hacks or stating no security updates is 'minimal risk', so you're certainly not over reacting to that.

 

But they're probably just telling them what they want to hear and being led by them saying they really can't afford new machines, so offering them unsupported alternatives (that's not 'professional' advice, which makes sense as you say, they're on more than just professional terms with certain members of the SLT).

 

Good call on employing an IT consultant, whilst already employing an IT professional and an MSP whose recommendations they are ignoring...

 

Apart from getting out of there where you are clearly undervalued...

 

Options (which you've already posted replies to... sorry went to get a coffee mid post)?

 

Go LTSC (Teams on the web and local installs of Office if you have OVS-ES).

Make the case for ESU (for security)

Get it in writing that you are being forced to use 'hacks' to run an OS on unsupported hardware and agree to support it on a best effort basis.

If they are willing to stretch to £180 per machine, you might be able to replace some x2 @ c£90 (like @mikes post about the "Lenovo Refurbed Tiny PC's off Amazon for around £95")

 

We too have a suite of 12 year old machines (on LTSC) and boot up times (from cold) are roughly 20s and 40s to log in (I have upgraded them over the years with SSD, more RAM and GFX card).

 

 

I fully agree, the consultant was bought in to agree with the higher ups.

They don’t wish to listen to myself or the MSP for advice as they deem it expensive.

(They are wanting to get rid of the MSP also)

The irony of all this is…. They bought in another 3^rd party consultant prior to this one who was neutral. Agreed with my viewpoints but his recommendations was also deemed too expensive.

Definitely keeping a look out for another job opportunity!

[mavhc]

Hello, I'd like to hire a consultant that will say what I want them to say, which is spend no money as we wasted it and don't want to tell anyone. You will? Excellent

[IT_CoffeeNeeded]

I rarely advocate leasing as an option, but it might be the ideal thing for you right now.

Get all 250 replaced with good quality refurb kit and split the cost over a multi-year deal.

£5-6k per term might be more palatable than a huge upfront investment.

 

I have been down the leasing route with them also.... They see this also as a waste of money.

 

The phrase between a rock and a hard place comes to mind.