psydii

maybe, but since it is machine password related, then it will take up to 30 days after you have upgraded/re-imaged a machine to 24h2 to be sure that 24H2 is a fix. Most of the observations that it is fine with 24h2 are from people who have just tried it as a fix, and are still inside the 30 day lifetime of the initial machine password. For those whose 23H2 and older devices were dropping off every few days, it seems likely that there is also some other setting/bug in play causing a more rapid machine password reset timeline, tripping them into the 2025 bug more swiftly than one would expect with the standard 30 day cadence.

The Windows Authentication team have confirmed it as a bug in how AD on Server 2025 handles machine account password changes. Since the (server) bug also impacts linux (and probably macos) based kerberos integrations, it is unlikely a fix will come in the form of a client-side update. Until the bug is fixed in Server 2025, all deployments of 2025 as DCs should be on hold.

Ah, that issue opens with a comment from Ned "NTLMv2 must die" Pyle (until very recently part of the Windows Authentication team), has a (reposted) comment from Steve Syfuhs (still of the Microsoft Auth team) and ends with Ned "unofficially" advising of the timeline for a fix. I can't help but feel that this really would have got to the product team faster if one of the early adopters in this thread had opened a ticket with MS Support.

Not that I am aware of. But *if* they all consistently use 365 for authentication, you should see that in the logs in Entra, and that does capture the IP.

We have ours set up so that it requires MFA. We also have Password Hash Sync and Pass through authentication enabled. (pass through allows us to use the expiry and disabled account setting in AD and have have it work immediately - though you still have to force expire web based tokens too; PHS gives us leaked credential alerts, and a back-up if on-prem ever goes down/offline for more than a few hours, which has happened only once in the last 8 years and we had it back up before needing to ask MS to pivot us over)

OneDrive syncing / Class Teams ( Student Work Document Library) Seating plans (so in general only files changed that lesson need to sync). About 30TB of files across 2000ish users. 365 A5 1Gbit/sec symmetric internet typically in any given 5 minute period during the school day we see 60-70% utilisation down, 10-30% up.

Exactly where I was coming from. *but* the cost/complexity of a wifi network is pretty predictable, so the DfE policy might be something along the lines of "have a chat with suppliers on the framework to get you a ball park to put into a proposal" so then the cost of the survey and associated technical assurance becomes embedded into the cost of the awarded contract rather than being up front.

That is pretty much the only thing I've ever missed since ditching RM Connect some time in the 1990's. For a while a bit of creativity with a report from our Managed Service Desk software could get us that too. These days I might be looking at starting here: https://theposhwolf.com/howtos/Get-LoginEvents/ and smacking it a bit with stackexchange, guesswork, copilot or chatgpt until it did what I needed. (you'll want to look out for device unlock vs interactive logon - if the device has seen the user recently, it seems to pick it up as an unlock event rather than an interactive logon event) Probably easier if your devices are all on-prem.

I cannot recommend the BlueStream kit highly enough. https://www.blustream.co.uk/hdbaset-transmitters with their HDMI cables at either end and you will have no* problems. They do AOCs to, but for along long run where you will be regularly connecting/disconnecting, the HDBaseT will be more robust/lower cost to mainatin, as you only have to replace the relatively short laptop-HDBaseT cable as and when it gets damaged. *laptops be laptops, firmware, drivers, and cheap HDMI ports can all still give you a headache, but with bluestream cabling at either end, if the laptop and projector are ok, you will be blown away by the speed the image pops up when devices are connected. If problems persist after putting in known good cabling, then you will need to consider that it might be a projector fault.

Sorry I miss remembered the name should have said "Review Set" https://learn.microsoft.com/en-us/purview/ediscovery-analyzing-data-in-review-set Use the condition builder, and the "none of" condition.

Do DfE fund the pre-tender feasibility/planning stages of capital refurb/build projects? If yes, then they ought to fund an independent survey that helps you correctly scope the project and develop the "customer requirements" fully. If no, then its either got to come from LA/Trust/School funds, if you want it a very detailed spec to go to tender with. From the DfE's perspective a wifi (and even a switch+wifi) project is very simple, and the cost of customising a solution to a given school is minimal, so having that work happening at tender (for "free") while the actual cost (x3 to cover cost of tenders lost) baked into the delivery is likely the accepted approach. From experience 1 3x3 or 4x4 AP to every 200 people is a financially prudent assumption, with caveats. But if I was working in an old victorian building, or an a multi-site school these numbers might be off. How do the DfE suggest you estimate the cost of the project if you can't pay for a professional to survey the technical challenges provided by the building and local requirements?

filter the result set

5Gb/s off a USB using the VLSC ISO image, let Autopilot/Intune do the rest. Quicker than PXE booting and pulling the image down over 1Gb/s ethernet. Once imaged, provided they get switched on periodically so they can update (including certificates), we've not needed to reset any configured since 2022. FWIW we don't re-image our systems deployed via SCCM either. We've got a small number of machines that were last imaged to Windows 7 and have in-place upgraded (mostly via WSUS/SCCM deployed feature updates) all the way to the final (?) version of Windows 10.

As an aside, this game seems pointless to me. All governments will mandate rules for ISPs and they will block the ECH and DoH endpoints outside of their jurisdiction, forcing cloudflare, google et al to host where said governments can mandate the retention and access to the logs. Meanwhile smaller institutions who don't have the clout to get the Cloudflare/Google logs, but still have legal requirements to control what is accessed by staff/users on their networks are forced to close of access to BYOD and close off modern protocols, further breaking the inovation and enhancements that they should be enabling. (did squid ever make it to even http 1.1 support?)

Filtered as per students here, but without MITM. WPA passphrase rotated weekly. If the guest is going to be here for more than a week, we encourage their host to get them cleared through HR and into the MIS, from where they get an account - and we get more specific control and oversight of what they can and can't see. Typically we issue a school device to them if they are spending significant time in the building. Sometimes they need more access than the default student access (for example to social media), we require them to register with HR for this. With DoH and ECH becoming more prevalent, we probably need to revisit allowing any BYoD onto the wifi.

There is a tendency for groups / cliques to form around mutual self-interest. They look out for each other on the basis "There but for the grace of god go I" and "what goes around comes around". This is balanced in some fields by mandated membership of professional standards bodies (solicitors, doctors, electricians, etc), who can prosecute/expel those who fall short of the standards. (this is why the Architects walked off the project(s) and made a public statement). But even then these groups are themselves vulnerable, it only takes a couple of powerful people looking the other way on occasion for the principle of mutually assured destruction (should the truth come out) to take over and standards slide.

Those sort of protections are also known as "red tape" and "bureaucracy" and the argument against them is that they make everything expensive and slow, as well as acting as a barrier for new providers or innovation.

We deployed it with the automatic updates feature enabled. Seems to have been working fine for the last five years or so with are no noticeable bandwidth issues. (2000-ish users, 1200-ish computers, 700 have the full Creative Cloud suite, 1Gb/1Gb internet connection)

https://www.jisc.ac.uk/guides/getting-started-with-e-portfolios

"HLM Architects walked away from work on two schools that have since been closed due to structural issues, after becoming concerned about the main contractor’s approach to technical delivery... ... HLM head of design Philip Watson told the AJ: ‘As these projects progressed, we began to have a number of concerns with Caledonian’s approach to the technical delivery of the design to meet the DfE’s high-quality output specification. ‘Unable to resolve our differences, we parted company with Caledonian and the projects were delivered by others.’ He added: ‘It’s a great shame that these schools have not been realised in the way that the DfE intended, and we hope the impact on staff, pupils and the communities in which these schools sit, can be minimised.’ " It was my understanding that under prior funding arrangements/frameworks the Architects owned the responsibility for the entire delivery for a new build. If they had a problem with how the building contractor was delivering, it was the architect who called the shots, with the contractor being pushed out if necessary. This arrangement was expensive, but ensured there was a single neck to strangle from the 'employers' perspective. That the architects could walk away suggests very strongly to me that there was a problem with the procurement framework that allowed a sub contractor too much freedom/power in the value engineering and construction stages of the process.

A folder with the PDFs in it?

Compliance and assurance are expensive. I seem to recall there was was pressure/incentive from central government for innovative (lower costs) construction/project management methods for new build schools around the time this particular building was approved. Perhaps the funding was coming from the over-all developer rather than DfE, allowing for the bypassing/short circuiting some of the bureaucracy designed to prevent this kind of mess.

Let's hope the risk of using unproven construction techniques was fully underwritten by the Treasury.

Is this based on the book by Mark Russonovich? (That book being authored about the same Stuxnet was troubling the Iranians, is of course nothing but a coincidence).

....not that I am stalking your posts now for helpful insights... and sorry for the late reply. I believe we just removed the option for applicants to share this information automatically, instead using a face-to-face process to cross check with what was received and processed in the ctf student file. With your MIS change, are you sticking with Applicaa or using built in functionality of your new MIS?