psydii

Just checking but in your earlier example you used x.x.x.65 and x.x.x.218 as the MFD and computer IPs. These are different to the IPs in the wireshark capture. ALso just checking whether the server and the mfd are on the same or different subnets? In the wireshark capture, the computer appears to have the address 10.2.104.1 While this could be perfectly valid for your server on your network, I always get a little suspicious when problems are occouring and the last octet is 0, 1, or 254. Finally though, that appears to be a HTTP connection attempt and perhaps the MFD is expecting TLS?

Could it be the Entra side of things? What roles does the account have for Entra? Which version of the script are you using to do this? I'd have thought this one (example 4) would offer the best chance of success in a reasonably configured 365 environment: https://learn.microsoft.com/en-us/entra/identity/authentication/howto-authentication-passwordless-security-key-on-premises#example-4-prompt-for-cloud-credentials-using-modern-authentication

I am surprised that such a device is even available new in 2025. Agree with the above suggesting to check TLS version support and Certificate Trust.

I feel the firewall on device might be involved. Device default configs have tended to be increasingly secure over the last five years, some installation engineers have kept up and know what needs tweaking, some haven't and punt the problem back to head office after a "day of trying" and some just turn off all the security and have done with it. Making sure the device is accepting traffic from the Papercut (and print) servers on the appropriate ports would be one place to start looking. Server side equivalent firewall rules would be another. If you can get a packet capture of the traffic at the printer side (port mirror into an appropriately configured Wireshark) and at the server side (tcpdump / wireshark / netsh (at a push) you should see some clues. (such as no traffic at all when you were expecting at least some in one direction, or connection refused messages, or cipher errors on tls connections etc etc.) To be honest (and I've never deployed Papercut, only used it) I wonder if there is a service/config on the MFD that hasn't been enabled - having watched a Riso engineer (who knew what they were doing) correct a config once, the some of the device-side options did not strike me as obvious!

Except when it doesn't behave like this. From time to time. Randomly.

I've seen a couple of devices today exhibiting that behaviour.

The work-around I refereed to is indeed disabling VBS. You should move Heaven and Earth to avoid turning off VBS - its a pretty fundamental part of Win11 security and its absence will hold you back with regard to modern security best practice - and could conceivably put you out of compliance with your Cyber Insurance policy. If your computers each have a valid certificate from your Enterprise CA, then that should work. FWIW we found out the hard way that a load of our computers for some reason* didn't have a valid certificate, and the only way to get them back on the network was to hard-wire them to pick up a recovery GPO! So do check before pushing over the authentication method! I'd recommend doing small batches of machines and checking the CA has a record of them having a valid certificate. Also until you are confident things are going well, might be worth checking a sample of each batch before applying the change to confirm they also believe they have a valid certificate. * probably due to some bad practice (aka "received wisdom" on how to do windows admin) by a tech several years ago that broke Windows on those machines just enough to cause it to stop working - on closer inspection, lots of little things were also broken with the same root cause, so after a wipe-reload of the affected machines, we're in a better place.

PEAP or EAP? PEAP (account/password based auth) isn't supported by Win11 anymore, is it possible you had a work-around in place that has stopped working with the upgrade? We had to (finally, nearly 20 years after I first flirted with the idea) move to EAP-TLS (client/user certificate based auth) just last year to support Win 11 without forcing it to rollback the security settings that are the whole point of the Win10/11 demarcation.

One needs to consider the lease/capital cost of the devices. Vendors can wiggle things around to suite budgets or priorities. At our last refresh we now pay quite a lot more per click, but 75% less on leasing for the devices that are around the building. Since these devices only do about 10% of printing their per copy charges (while very high) amount to very little in the scheme of things. Our big units remain at per-click charges similar to most of those mentioned above, but on an older contract. (It is not financially justifiable to have *any* of the units around the building, based on the volumes those individual units print, however the operational (and wellbeing) benefit of having these units available as backup for when luck takes out two of the central units on the same day, or those 30-seconds-before-the-lesson emergency prints is considerable and wins the day, for now.)

Sorry to hear that. I shall remain with hope as our symptoms are different, so perhaps so is the root cause. I will never get over the (I think) Intel Wifi Link 5100 in early Dell E series, a product so bad it took nearly 6 years for me to restore SLT's faith in the wireless network, and I haven't touched Dell laptops since. ..it was also a product so bad it made mid-patent-lawsuit Meru products look good. (for those who weren't there, Meru had an unusual take on wifi congestion/traffic management using a single channel architecture" which in the abg years was (apparently) second to none. But when n came along there were some things in the standard that negated some of that advantage and also presented new challenges for SCA. About the same time a patent troll sued and stopped them from some of the techniques they were employing to bring SCA into the n era. The result was n Meru was awful (for about 3 years) until the day the suit was settled. That very day, I saw the news pop up in my feed, a Meru engineer called me with a new firmware, and suddenly it was all fine again. It was never good, but we could live with fine) Anyway, remind again me why we trust wifi to be our most critical infrastructure layer?

Just checked Lenovo support. They've been releasing an updated version across various laptop models over the last week. "[Problem fixes] -Fixed Realtek RTL8852BE WLAN disconnection issue"

We're seeing the latest batch suffer from connectivity issues. (I previously mis-spoke on another thread and referenced Atheros, but no they are 8852BE's) . For us it *seems* as though the problems stared in 6001.15.123.330 as they had been fine until this driver started getting installed. We have had some success rolling back to an earlier version (on machines that still have those available.

See also this thread:

Rooms containing printers and photocopiers in substantial use (greater than 30 minutes per hour): Air extract rate of 20 l/s per machine during use is required to eliminate pollutants. Air must be exhausted outside the building. If located in a separate room, it must be ventilated at the rate of 10 l/s/person when occupied as for an office. These rates are those given in AD F. Cooling is required to larger reprographics machinery often found in schools, (eg with heat loads of around 2 kW in use) where its use is intensive and it is located in a small room. This is due to the high heat loads produced which cannot be dealt with by extract ventilation. An alternative is to locate the machines in a circulation space, if there are no noise sensitive activities taking place in the circulation area, where the heat can dissipate. Photocopiers are often fitted with active carbon filters which limit ozone emissions. Some of these are sealed for life and others require maintenance. Information about the maintenance of photocopiers can be found in Local Authority Circular: LAC 90/2 54.

Overview - Ventilation in the workplace BB 101: Ventilation, thermal comfort and indoor air quality 2018 - GOV.UK

I seem to recall seeing talk of edu-specialist vendors getting customised firmware to increase the chances that their higher end kit would gracefully and swiftly fail back to 1080p in more scenarios than would be accecptable to someone who'd purchased a 4k screen would normally want. It might be worth reaching out to the vendor to see if they have something available to encourage stability by sacrificing resolution/refresh rates. We went the other way, and now for 10m and over we use Bluestream 48GBps 8K AOC cables. Which seem to connect reliably first time every time.

Trust -> LA who cover the area in which the Trust Head Office is registered.

Pupil records including SEND and Safeguarding should go to the new school as per the regulations The Education (Pupil Information) (England) Regulations 2005 From what I have seen, the LA steps in to support closing schools since there maybe a gap between a school closing and the everybody getting a new school place. They also ensure the data is retained appropriately. Finance and HR records should go to the LA. (unless there is some transfer of employment between institutions in which case HR records flow as TUPE regs) That's even what happens when a Trust closes. Record keeping and retention information for academies and academy trusts - GOV.UK Pupil records For pupils who are transferring to a new educational setting, academies should follow the statutory guidance on keeping and maintaining records and transfer the records to the new school or academy. If pupils transfer to a college or sixth-form, the pupil records must be retained by the academy. Pupil records that are not following the pupil to a new educational setting should be transferred to the relevant local authority for that area where the records will remain accessible. This can include when a pupil has reached the end of compulsory education. Safeguarding and SEND records Safeguarding information should be shared with a new school or college in line with Keeping children safe in education (KCSIE) 2021 paragraphs 105 to 113. Transition arrangements for pupils with SEND should be managed in line with paragraphs 6.42 and 6.57 of the SEND code of practice. Staff, building and governance records Staff and building records are to be retained by the local authority of the area in which the trust head office is located. If staff are transferring to a new educational setting, the ICO guidance on disclosure of employee information under TUPE should be followed. The records of staff from the academy who are continuing their employment with the trust should be retained by the trust. Governance and ‘school history’ records should be offered to the local authority’s archive service or local record office for permanent preservation. Finance records Finance records should be retained by the trust as per His Majesty’s Revenue and Custome (HMRC) and Companies House retention periods. The Department for Education (DfE) are entitled to request and receive financial information to enable the final accounting of how the trust spent the public money it received. Details can be found in the Academy Trust Handbook.

SIMS Connected? Call ESS/ParentPay support. @SIMS_Customer_Support might be around, but I suspect they're focusing on following up with the emergency patching everyone had to do yesterday.

Given the info relating to your migration 55 days ago, you might well have a USN rollback. Take a look at this article https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/detect-and-recover-from-usn-rollback Are you really standing up a new forest in 2025 when the cloud is just there **waves arms in the direction of 365** ? If so, you might be able to limp along until the summer rebuild without addressing it. If, on the other hand, your plan was in fact to just start again with the OU/GPOs but keep the computer and user accounts, you will need to fix this problem; I’d be looking to open a £300 support ticket with Microsoft to troubleshoot the issue before changing anyhing, some of the steps in these articles are one-way changes that cannot be undone, and having a product expert on the phone is invaluable for learning and managing stress and providing assurance upwards for senior management.

as per @NegativeKillDeath ...and yet also @Chockster. Its a very rare occurrence where the need to get their phone working outweighs the risk of having their phone confiscated *and* the pastoral office is closed *and* the school office isn't staffed by someone sympathetic to their plight.

Some avenues to dig into / fix that error here: Troubleshoot replication error 8606 - Windows Server | Microsoft Learn Some of the more concerning causes are reverting a dc snapshot or introducing an improperly restored one from backup? (it can take months before that comes back to bite you) and this one caused by a *default* setting in Windows Server: Secure Time Seeding Recommendations for Windows Server - Windows Server | Microsoft Learn

FWIW, and not Unifi, we've been seeing increasing numbers of random wifi problems over the last month, it seems likely there have been a windows / driver update that may be complicit. (mostly Atheros chipsets). Nothing of a scale to cause wailing or nashing of teeth, but definitely something we're keeping an eye on. Part of our problem is/was some of the Atheros chipset drivers have "randomise mac" flag (which overrides the Windows setting), and this exhausted a DHCP scope recently.

It was ages ago, but we ended up getting a repeater and had our handsets reprogrammed to solve this. I think it did indeed move us from using 1 channel to using two, but the details were all in the implementation, and I haven't thought about it since (other than to periodically check the battery-backup on the repeater is still good). I recall we talked with both these companies to understand the issue, and ended up choosing one because they already knew the site. Capcom | Handheld Radio | Radio Communications Professional Communication Solutions - Two Way Radio - Telecoms - Radio Links - Purchase Hire and Service

I used to do this for 16+ years, but then it got to the point where new features didn't seem to honour the settings, and the documentation didn't even acknowledge the new features, so we bit the bullet and moved to EWP and no-one in the IT office has touched the config since. A real "It just works" product.