psydii

If your SIMS Support company usually handle patching of the database, I'd liaise with your SIMS support company explaining that you are using SAMpeople and they (SAMPeople) have advised that SIMS Patch 26825 is needed, ask them (your sims support company) to check it, and if they report that no problems are foreseen, have them install it.

Depending on the size of school and the availability of your Global Administrator, there are two options 1) If you are a small site and don't have any 3rd party automation in place to create users etc, then use a powershell script to grant your "all teachers" group read-only access to each student's onedrive. 2) If you do have automation (e.g. Salamander) have that set permissions on student onedrives so the form tutor has read-only access to each student's onedrive. If you want a centralised approach, and you have automation, you might have the automation provision each student a folder in a shareopint site with appropriate permissions, and then create a link to that folder, placing it in the Desktop folder in each student's Onedrive. They could then navigate to it in the usual (Windows File Explorer) way in non 365-aware applications, and OneDrive->Desktop->StudentFolder in 365 Apps. Based on how I understand primary's to work, I would suggest option 2 and the centralised approach, so if a student saves it somewhere else the teacher can still find it.

can't speak to primary specifically, but hopefully some of this will help: "just save in the user's OneDrive" is the default behaviour of office apps. If the user is a member of a small umber of SharePoint sites, these will appear as optional locations to save in the standard save dialogue boxes. (that bit gets messy when people are members of a lot, but infrequent users of computers, but primary kids probably just need to be a member of one site, that of their class) Properly configured OneDrive client signs in automatically and the users documents etc folders are redirected into it - so any non-365 App that has a traditional file-save mechanism should be well catered for by just saving into the user's documents folder. Whether you need some policies in place to manage local disk space is a function of the size of the school and the age of the computers. But we get away with 256gb disks in many locations with 1800+ users.

128Gb works if you are using the share-pc policy in Intune. 256Gb works if you don't use Teams locally (actually I might need to check how Windows 11 handles teams updates these days), and have OneDrive running from an machine wide installer, and you don't mind running a script to remove profiles fairly regularly. 512Gb allows you not to worry about anything (so far) 512Gb has been our standard for desktops or 'desktop-class' laptops since we got back from lock-down. For devices you might describe as netbook/chromebook-like, 128Gb and the SharedPC profile seem to be just fine.

Its not quite as straightforward as reversing the numbers. One curve ball is where the *decimal* presentation is reversed. scenarios I have encountered are for example: 1234567891 = 49 96 02 d2, but recorded as d2 02 96 49, which might be presented as 3523384905 (or 5094833253 if one of the programmers were insane). But 1987654321 = 76 79 32 b1, but recorded as b1 32 79 76 would be 2972875126 (or 6215782792 if both programmers were insane) It can get way more challenging. This page seems to be the best I've found for getting to the bottom which way round things are recorded. Note it doesn't consider the "what if they read/recorded the decimal value reversed". Probably because it's is somewhat insane to treat the values as a strings. ... and then even worse, some systems cut off bits (or even digits) before recording the number. If this happens on the original system, but not on the secondary you cannot take the data from that first system and use it in the second system, unless the second system can also be configured to throw away those same bits before using the number.

Fair point. I was coming at it from perhaps the wrong starting assumption.

If leadership wanted their own unfiltered connection, I would be wondering what they want to be able to get up to outside of the oversight required of the rest of the organisation. Besides, why wouldn't you have the same quality of service as the schools? There is a lot to be said for Leadership having all the same operational/technical restrictions as their teams. It allows them to appreciate that somethings are awkward.

Here everything is bitlockered. We do a TPM reset and hand it over to an ICO Registered, ISO 27001, ISO 14001, ISO 9001 and ADISA certified recycler who use guarentees data security through the whole process, and shred any that the software fails to wipe. They provide certificates assuring each step has been completed for each piece of storage handed over. Not every recycler is robust in asserting there behaviours around data. In my experience when pushed, those that are a bit wish-washy on it, suddenly add £700 to the price and then outsource that part of the process off to a recycler who does adhere to those standards. The other thing you could do (if you have a boot/imaging process you can co-opt) is have a boot image that wipes and re-partitions the disk then uses cipher.exe to fill the disk with random data a few times, followed by bitlockering with the "encrypt current data" option enabled. The trouble is modern drives lie a lot about what data is where, and you have to trust that when the software tells the drive firmware that is being wiped/reset/encrypted that the firmware does some work to execute the intent of the operator against its default behaviour. This is why many top-tier data wiping tools report they failed to wipe a drive, and why many companies that guarantee to wipe data increasingly shred storage rather that recycle it.

...which is insane if you consider the hardware that NovaT6 and Timetabler first started on.

I've seen a "you'll take NOVA-T over my dead body" Timetabler (who has genuinely tried a couple of alternatives named earlier in this thread over the last 15 years), be genuinely impressed with EDVAL to the extent they went all-in this year. The only complaints from teachers about this year's timetable are artifacts of staffing/budget cuts, (fewer teachers ergo some balance of larger classes/more contact time/reduced curriculum choice, all decisions taken prior to the switch). Edval is a bit of a beast and needs about 4Gb of ram per model its resolving, and a bit of GPU grunt. If you don't feed it, it gets hangry. If trying complex stuff (i.e. needing to try out more than three models a day) I could well believe that an 5GHz+ 12 core with a modern IGPU with 32GB RAM might be needed to get the initial models done swiftly. That said a xen 3+ mobile ryzen 7 with 16GB was enough to get things done here.

I'm more bothered by staff logging on to student devices. "Well, no you can't log on to the MIS from there, oh and by the way senso tells me what you are typing, so maybe don't."

Yeah. They’ve got another four years to fix it though. But unless they decide to move DC’s to the SE model they’re trying with exchange, I think there is a chance that AD might be gone in 2035.

Oct 09, 2025 “do not use a Windows Server 2025 as your schema master FSMO role holder before installing an Exchange Server CU (including Exchange SE RTM)” Note that SE RTM = Exchange 2019 CU15 “Windows Server 2025 schema master FSMO role holder might create duplicate schema attribute values after Exchange Server CU update is installed. After this happens, your AD replication might start failing” “Environments where you might use Windows Server 2025 as domain controller with other roles are not impacted.” “Windows Server team is working on a permanent fix for this issue (scheduled to be released in the following months).” https://techcommunity.microsoft.com/blog/exchange/active-directory-schema-extension-issue-if-you-use-a-windows-server-2025-schema-/4460459

...and the portals are down for us again.

I think only Administrator and the Creator Owner have permission to modify computer accounts now... and the default passwords for computers I think has also been changed/hardened which might also cause problems depending on how you manage accounts. [...skim reading the page at the link below, I now think I slightly wrong... but things have changed and this is probably the cause of the issue, and point to how your should update your processes] KB5020276—Netjoin: Domain join hardening changes - Microsoft Support

Yeah, yesterday morning's outage was preceded by similar in the US eight hours earlier, and there was another about 8 hours after the european/africa one. Not sure if its just the admins across the world getting into work and finding it broken, or actually an every-eight-hours a bug is triggered. Apparently its not the api/gateways themselves, but the underlying kubernetes infrastructure that is flaking out. Moot really as from where we're sitting its all just a black box labelled "Microsoft"

"We identified a loss of capacity within the Azure Front Door (AFD) service causing impact to the Microsoft 365 service. We're restoring the service by bringing the AFD instances back online. " So basically their ISA/TMG server farm crashed.

Isn't at least some of Bromcom on Azure? Azure/Entra is having a bad 24hrs.

I recon either in the next hour, or as you say, sometime around close of business. The vibe I'm getting is they either know whats wrong and the fix is rolling out now, or they don't, they have no idea and the top people are getting woken up to come in and look at it.

MO1168665 for those still able to get to the 365 admin portal. See also @MSFT365Status on twitter.

I skim read that yesterday, but but missed the "can be excepted as long as..." paragraph. So right now the main issue is that some MIS's are generating ISO-8859-1 files but tagging them UTF-8, and when parsed as UTF-8 the file contains invalid characters. When I get a moment (lol) I'll have a poke at a fresh download of one of the files and change that value to see if a file that actually declares itself iso-8859-1 is accepted by SIMS. Though maybe @SIMS_Customer_Support might know/be able to point me to a KB where that sort of thing is documented? My mind is being awakened to a new layer of possible horrors and errors. Bad enough that so many imported names have trailing spaces, but characters that render the same but are in fact different in a system that at least on some level demonstrates an inability to handle that as a human would need it to... oh gods.

We've had an interesting issue recently. Some CTFs contain characters that are coded differently between UTF-8 and ISO8859-1. When opened they are treated as UTF-8 by say, VS Code or SIMS 7, but the special characters (being coded for ISO8859-1) don't render and cause the import to SIMS to fail. If I tell Code to reopen the file as ISO8859-1 the characters render correctly. So, my guess is that either there is an MIS out there exporting things with the wrong encoding, or something is happening when Secure Transfer is offering us the file. Anyone got thoughts on / experience with this?

I've found when trying to explain why things should be on a risk register and managed as such, items so completely outside of SLT/Governor's comprehension and influence/control (like say, the shifting sands at the intersection of technology, education, the whims of a multinational corporation and implementation of UK legislation) the result is for the item to get scrubbed, and those raising it released from responsibilities where they might be required to raise such matters again. So bypassing that nonsense, we're going on a class by class basis. If a teacher wants it, then they have to do all the leg work to get permission. The admin then flags the parental consent in the MIS and the automation drops the users into the "consented" group for that service.

Are you signing into the workstations with an account that has the same UPN/EmailAddress you are using to authenticate to 365? Do you have AD with Entra ID Connect/Sync? They you should not get this inside 365 apps or Edge, unless.... 1) You have AzureAD Join (or Entra ID Join) disabled in a group policy. or 2) The computers have some how lost their association to EntraID/AzureAD what is the output of "dsregcmd /status"?

Yeah, if they set the definition so wide that 60% of schools report being a victim, then another way of looking at it is 40% of schools don't know they were attacked.