fredesq

This. We're moving forward with Microsoft 365 A3 for faculty as it works out cheaper thant the classic OVS style -DesktopEducationBundle. M363 A3 for faculty INCLUDES Azure P1 Prem, Intune, Your server CALS which is huge! and a few other neat bits for a better price. Some users will go onto just the free A1 Plus if they're someone who we wouldn't of counted in the 200 hour per annum FTE bit.

I feel like this should be challenged as the idea behind access arrangements are they provide the same enviroment to the student in the exam as they have access to all year. Why can't we have a default deny all rule and allow a certain extension that connects to one URL? It doesn't make sense. Windows 10 built in Exam mode literally has this set up - it allows access to one website to take the exam on and thats it.

I agree - I don't wanna be a block for any student getting a laptop. What I am up for though, is getting them a better laptop through their LAC grant cos these DFE ones stink

This might be where the confusion is from for us; How did you tell them apart?

Thank you. I found out the student went into care in July - so i think its a case of crossed wires.

Can anyone give guidance... A child-in-care year 11 student who left last summer and is now at a local college had one assigned to them last Spring. Obviously it came back for summer and they have not left. We now have the Virtual School asking for the laptop to be re-assigned to him at his college. My thinking is that the Virtual School think he has a laptop assigned to him as he is in care and the covid laptops were never for this?

Use F12 developer mode, go to Network tab and refresh the page. Take a look for any status numbers in the 500 range or more likely, status 403. It may be pulling HTTP sites after loading itself in HTTPS and the HTTP ones are getting auth errors (403). If thats the case, copy the URL's to Sophos' Whitelist

We're looking at this as well but the initial thoughts are if the device is being used on the school network AND the devices are being supported (hardware, software faults) by the IT team in the school, then they need to remain compliant with the config that they are handed over to the student with for the entire duration they are being used on site (even after the 3 years); so as soon as the config changes, the devices are no longer compliant and you can no longer support them. From the safeguarding point of view. If they save untoward images onto the devices when they're unrestricted and then bring them in to school - this would bypass the restrictions. TL;DR if they're accessing the schools network, they need to be compliant

I've been told by our data protection person that was told by our dedicated 3rd party DPO that because of GDPR, students aren't allowed to use their webcams if in a video chat with their class. Has anyone else heard of anything similar?

The music teacher here suggested Soundtrap, Mixcraft and Albeton if the finances allow.

I was under the impression that as a school, we had to appropriately filter and inspect all traffic on our network - be it a student, staff member or guest. Do you have information on the contrary, as i'd love to not have to deal with guests and security certs'.

https://admin.teams.microsoft.com/policies/calling Change the calling policies to be off - thats the avenue i'd check out first.

What does it call the device in the BIOS?

When you say disappears from the BIOS - do you mean from the boot device order or from any part of the bios at all?

There's a possibility the controller on the HDD is corrupted. I had something incredibly similar with an SSD where a firmware update knocked it out - all the files were still there when plugged into another computer but the BIOS just couldn't deal with the drive at all. It just couldn't boot into Windows at all, if you forced it by disabling secure boot and disabling UEFI and told it do boot to it would just hang on a black screen. Saying all that.. you changed the boot mode from UEFI to legacy? And disabled secure boot?

Written my first ever script cos i didn't want to manually upload LE certs every 3 months, didn't want to have cert errors on guest Wifi and got the po turned down for a cert. Thought i'd put this here for those of you with Aruba AP's, don't have a controller and want to use Letsencrypt. It relies on the renewal part of certbot, so you'll need to have already gone through getting LE certs already. I run this on ubuntu server 18.04 There's two parts to it, a simple shell script and then it calls an except script. Put them both together and update file locations etc in the script. Add it to crontab -e and set it to run every day (as per the letsencrypt guide for autorenew certs). # Script to push letsencrypt certifcates to aruba instant wifi controller. # Reqires TCL, Except, Certbot, tftp and OpenSSL. ## Run certificate renewal (Remove --dry-run) certbot certonly -n --standalone -d urlofserver.com --dry-run # Move certifcates to working space cp /etc/letsencrypt/live/urlofserver.com/* /home/user/cert/ ## Add passphrase to passkey openssl rsa -aes192 -in /home/user/cert/privkey.pem -out /home/user/cert/privkeypw.pem -passout pass:yourpassphrase ## Append the private key to the end of the fullchain.pem cat /home/user/cert/fullchain.pem /home/user/cert/privkeypw.pem > /home/user/cert/combinedchain.pem ## Move the new combined cert to the tftpboot location mv /home/user/cert/combinedchain.pem /var/lib/tftpboot/ ## Run the expect script which logs into the Aruba AP and copies the cert from the TFTPboot location expect /home/user/cert/push-cert-to-ap.exp and push-cert-to-ap.exp #!/usr/bin/expect -f #spawn ssh spawn ssh admin@apmaster #Catch the password prompt and send supplied password expect { "word:" {send "yourappassword\r"} } sleep 1 #run send command to pull cert from server expect { "*#" {send "copy tftp ipoftftpserver combinedchain.pem cpserver cert yourpassphrase format pem\r"} } sleep 1 #run aruba show version (i did this to get some visual feedback that the prev command finished) expect { "*#" {send "sh ver\r"} } sleep 10 #quit ssh session expect { "*#" {send "exit\r"} }

just remembered, the touch screen is also listed in dev manager as a HID Input device next to the keyboard.

Do it via the registry via a GPO HKEY_CURRENT_USER\Software\Microsoft\Wisp\Touch "TouchGate"=dword:00000000