psydii

Migrate to postgres first? Switch from SQL Server to PostgreSQL for Veeam

One could have sso already in place! (the initial user on-boarding t is/was painful, but once set up it's wonderful and we have CA policies in place for it) I am so very much looking forward to SSO being the default, and the onboarding being straightforward. If PPG can get that in place before classcharts remove their recommendation that we fall back to the MIS for attendance, I'll have 100 new users for them immediately.

Sorry, yes I assumed 365 sso.

Use conditional access policies to restrict the supply accounts to your wan ip and your managed devices. Ideally have a hardware MFA token that is issued with their paperwork too, since all MIS access ought to be protected by MFA. (if hybrid, you can also use AD Account login restrictions to restrict the times and pc’s to which they can logon)

Counter point, we pay for the full service with days of support, training and even emergency data manager cover. They are pretty swift and comprehensive. Not at all to the same as LA support where everybody has known each other for years and people go the extra mile for each other. But good enough while we get our ducks lined up for a full review of MIS and adjacent solutions.

I have nothing to base that on, other than they are still down while others are back online.

I'm wondering if it is worse than that, because even pre-devops sysadmin practices ought to have allowed them to patch quicker than this. Perhaps they have the technical debt of running on old frameworks that require production code to be re-worked before they will run on supported php versions? Wonde appears to be back up now. (Hadn't checked since 6am, so might even have been up by the start of the school day).

Writeback was broken yesterday, but seems to be working today. We did deploy CDPsu3, but nothing in that seems like it would have had any impact at all on sync issues. I quite enjoy it being "not my problem" It helps open SLT's eyes to reality with regard IT service/operations challenges. That said CDPsu4 is being developed "as a matter of utmost urgency... [and will be released] ...tomorrow"! Hopefully nothing messed up in SIMS - because that would be my problem (for now).

So after a good start today, it’s starting to wobble again. I’d log it but as mentioned above they don’t talk to the plebs.

I recently found some paperwork about that old in a drawer at home. One was an email threat where @roberto was sharing how his experiments with Window 2000 were going. Right next to a government briefing paper about why schools should have domain names (marked "confidential"!). But to vaguely nod to the original topic (vaguely), its not just schools that don't seem to know how much to pay IT people. Just look a the *range* on this post apple are looking to fill. That's the equivalent of a NM being 27.5k in one school and 53k in another!

You’ve mis-matched the EAP type, probably on the client. Check both the policy and the client are set to MSchapv2 (assuming that is what you are going for)

Hmm. Is that in the list of 3rd parties etc in the the data sharing agreement/privacy notice?

Anyone heard if Classcharts are expecting to have stability tomorrow? or does the "use your mis" advice stand, and I need to on board everyone to SIMS NG for tomorrow?

This is getting silly. I hereby propose that we group together and exert our power and influence to create one absolutely definitive ID number for every student. Then the rest of the industry can adopt that as The Standard going forward. This is a totally fool-proof plan that will definitely stop the proliferation of further unique identifiers.

Before anyone mentions it, the Goggle Cloud Services thing should be irrelevant, because they don't declare that as part of the platform. (though it is used for some internal analytics productivity and advertising purposes).

I've just onboarded the attendance team to SIMS NG, ready to pivot for tomorrow.

Android is as fussy/more fussy than WIndows 11 about getting it "right". Where "right" is defined by the opinion of the developer of that particular flavour of andriod, and may change between updates. We have EAP-PEAP (MSCHAPv2) for BYOD android devices, and that works well, but the renewal of the server certificate requries the end user to re-trust the NPS cert every couple of years. Personally, I don't want the boards on the network because after period of time they will stop getting updates, but the devices themselves will be good for another 5-10 years... so you'd have to pull all the network connected features to remain complaint with insurance/dfe standards.

I'm thinking double NAT vs SIP might be part of the problem, but I've not looked into it properly. One random thing I've had happen a couple of times is a weekend alert from logging suggesting a laptop is in the possession of a student. When investigated via Defender XDR and logs cross referenced, the incident detected took place on Friday morning, but only made it to the dashboard over the weekend.

Given it was sold to a business, if the asset has not not actually been booked on their accounts for 12 years, it does support a case that there was no intention by either party to transfer ownership of the school grounds. Particularly if there is any sort of paper trail where the business recently acknowledged the issue and offered to transfer it back.

Adjacent, but unrelated: Andriod and ChromeOS are getting increasingly cranky about enterprise CA server certs.

I wonder if this was known about at the time... I was tangentially involved in a proposed sale of what had been the premises managers house around the same time, and "taking care to not accidentally sell the main school building by mistake" was actually discussed.

set up a port mirror to pipe to Wireshark. Reset a phone and connect it to the port you are mirroring. look to see what a "good" provisioning and reboot sequence looks like. repeat, but on an edge-of-lan ubiquiti switch. compare the results. (there is probably a better way than 'by eye' but a phone boot sequence is simple enough that doing it by eye is quite possible) You are looking for queries that go unanswered, or responses from unexpected locations. On the Thursday specifically issue: It's a good shout re scheduled re-provisioning. That sounds like a very likely root cause. On the failures - I wonder if there is some TLS MITM impacting some of the phones - perhaps they are not excluded from filtering rules? or perhaps some phones don't care that they've been MITM'd, or perhaps they aren't even trying to download a refreshed config and are happy loading their cahced one.... or maybe when connected to the core they can retrieve them via http rather that HTTPS? Final anecdote: Long long ago, I improved our phone reliability by breaking our egress from all devices behind one IP to split across multiple IPs. i.e. each source subnet is now (more or less) NAT'd behind different public IPs. This made a huge difference for UDP based protocols. I can only assume that some table was overflowing either server-side or in the IP stack of the router and occasionally things on the phones would randomly not quite work right.

I wonder if the MVPs banging the drum about the boot certs updates got somewhat burned when it turned out that things continued to work just fine, and remain upgradable well after the deadline they had been pushing. However.... given that credential guard should have forced people over to EAP TLS two years ago, perhaps this is a deliberate strategy to get Admins to subscribe to/check regularly the news feeds where this sort of thing is published. It used to be so easy to keep on top of this sort of change - there were actual consistent rss feeds. 5-10 minutes a day skim reading those and then nothing was a surprise.

The blast radius (::groan::) of this is big enough that HPE/Aruba have issued a support advisory. ”This issue is triggered by the Microsoft KB5127648 update on Windows clients using PEAP-MSCHAPv2 and is not an HPE Networking infrastructure issue. Changes to Aruba or Juniper Mist wired or wireless 802.1x configuration will therefore not resolve the underlying authentication failure. ” “ Reference Reading: Microsoft KB article 5066470 indicates that it has long announced the deprecation of NTLMv1 protocol due to inherently weak cryptographic algorithms it uses in verifying (client) credentials exchanged between the client and the RADIUS server. While the NTLMv1 protocol was removed from Windows 11 24H2 and Windows Server 2025 and later versions, remnants of NTLMv1 cryptography are still present in some scenarios such as when using MS-CHAPv2. https://support.microsoft.com/en-us/servicing/os/windows/docs/2025/08/upcoming-changes-to-ntlmv1-in-windows-11-version-24h2-and-windows-server-2025 The October 13th Microsoft Windows KB5174628 update enforced the change in NTLMv1-derived credential usage from “Audit” mode to “Enforce” mode which disrupted automated single sign-on configurations using MS-CHAPv2.”

Machine account based PEAP definitely broke for us at one point a while ago. Maybe there was another way to fix it, but we rolled out eapTLS because we happened to have all the pieces lined up and ready to go?