psydii

Asset management is not IT's responsibility. Obviously the role with the responsibility for that (typically the Finance or Business Manager) probably delegates day to day operations to those whose budget pays for the assets (i.e. IT responsible for knowing where all the IT assets are) So be careful about taking on this responsibility - unless its is useful to your career - (there is a lot of potential overlap between an outwardly looking, upwardly intentional NM and the BM role) That said the quick and dirty option of a few air tags has the advantage of the global Find My network, but doesn't scale well for an organisation trying to track a significant number of assets. For assets moving in the building, something like this might be worth investigating: https://www.arubanetworks.com/products/location-services/ Our 2-way radios are all able to be seen by the beacon tech in our APs, and can be cross referenced against other devices a person might have upon them. However the software/integration costs parked that as "cool but no" when I (lightly) pitched it here.

If the print server goes down, my phone rings, I get a teams message and I'm paged over the radio. Pretty cool automation I call "colleagues" it's a byproduct of work done in the HR office and requires no configuration or maintenance in that regard. It is also monitored by our service desk platform, but that take a minute or two before deciding the server is really down and raising an incident in the service desk.

Indeed, from observation, SLAs in contracts are worthless, unless the client engaged a legal team who were instructed to make ensure they were enforceable as part of the contract negotiation.

Seven months between initial deployment to end of life of the previous product. That's bold. Unless its primarily just a cloud version of the console and related server components, such that the client side remains basically the same but with a bridge, I'm not sure there's enough time to adequately test a product with that sort of scope. Perhaps its just a skin on inTune, or another off the shelf MDM? But since MDMs are really bad at providing management of shared devices in the way Connect 1.x through 4 were good at it, I can't imagine they'd just re-skin one, they'd need to really dig in deep to get it to meet the needs that the needs of a CC4 school. Perhaps it will be their Progresso moment.

I'm in a BSF refurb - port numbers are similar to that document. and only 1/3 are active Over the last 15 years many many many ports have been brought into service, and then taken out of service as rooms change function and purpose. Often ports are moved from their install location. Its cheaper than getting new cables run. The location of Wifi APs was significantly different for ac than it was for pre-standard n, yet we did not need to put in more than a handful of new cable runs to accomodate the new technology. Some of those cable allocations were actually coiled in voids ready to convert classrooms to IT suites, and covert them we did. This is a trick I have encountered at four schools, and seems to be quite common practice - when you have capital funds - spend them on future proofing.

"Binary Search" the technically correct name for the half-splitting technique On doing this with GPOs, something I have seen people forget is that it takes time for a change to replicate between Domain Controllers, and your client may not load from teh DC on which the change was made. You need to force (or wait for) replication to take place between all the DCs... and then reboot/logon the computer twice to be absolutely sure the changed configuration has taken effect. You can often get away with not replicating and rebooting just once - but when you are a/b testing you need to be absolutely sure that you are observing a system that has the state you intended to set.

A useful reference point: "...it shall be assumed that for Secondary Schools 1.0 data point shall be required per pupil, for Primary Schools 0.7 data points per pupil and for Special and Alternative Provision Schools 2.0 data points per pupil. The final number and location of data points shall be finalised through the design process." https://assets.publishing.service.gov.uk/media/65803d561c0c2a000d18cf3c/GDB_GenericDesignBrief-A-C17.pdf

I've heard it alleged (*years* ago) that others in the market did things that potentially harmed Bromcom's revenue so significantly that the compensation for such actions paid for the first few years of development of the Bromcom MIS. Muttering about deals and kick-backs and unfair practices that ensured the dominant player stays dominant are as old as the hills. ...and yet when push has come to shove, government and the courts have (broadly) come down against those Bromcom accuses. The MIS market is basically a three horse race, and that is just below the bare minimum to prevent monopolistic practices harming the consumers (schools). All of them need to play with a straight bat and live or die by the merits of their products, and if one of them behaves poorly/illegally then that needs to be addressed, and redress awarded if so appropriate. We all loose if this becomes a two horse race because we'd be a decade at most from it returning to a single dominant player.

depending on what they are, that is normal. Switch ports send them out and if they receive them back (or receive a bpdu from a connected device that isn't supposed to be a switch) spanning tree blocks the port. Someone with better mastery of switching than I can probably provide a more technically accurate explanation.

Sometimes these sorts of devices have network switches in them.

Windows up to date? Apps all up to date? Drivers up to date? AV is it modern and up to date? Are you running more thatn one AV / anti-malware system? Also look at what stuff is loading at boot/logon and hooking into explorer. You can use Autoruns and the half-splitting technique to speed through the process of eliminating potential startup items causing it.

eh? how so. I don't think anyone has touched our NPS setup in 15 years (apart from a couple of OS upgrades) Somebody set up radius/NPS for wifi here 15 years ago, dropping users into appropriate vlans based on groups. There's a wifi GPO, and a certificate server set up too. Salamander handles what group users go into. Firewall / Filtering applies to VLANS (if no user auth information is available from client) It just works. We've had three wifi networks and I don't think we've had to touch the NPS or GPO configs as we've swapped out the APs. It's completely maintenance* free. *well apart from the fact we pay salamander each year, but we'd be paying that anyway. NPS/RADIUS/802.1x wifi auth once set up just works like AD. It just sits their being infrastructure. Its implementation here I am pretty sure was booked as capital investment.

Try this " If we assign the Helpdesk Administrator role to an IT administrator in the UK team, they would still be able to reset the password of a user in Canada, which violates the organization’s principle of least privilege. We can resolve this issue by using Entra ID Administrative Units. By creating separate administrative units for UK and Canada users, we can ensure that Helpdesk Administrators are restricted to managing only the users within their designated units." https://www.rebeladmin.com/restricted-management-administrative-units/ Sub out UK/Canada for Students/Staff. I think if you're provisioning through SDS these AUs might already exist but I could be confusing this with something else.

The following usually works for me when applications / windows has become confused about scaling, display resolution and window size: Completely log out of the windows on the remote desktop session. If the remote system is your personal physical desktop at work, restart it. Then on the laptop with display zoom set to 100%, start a new Remote Desktop session. Deleting the default.rdp in your Documents folder might also help (do that before you start the new Remote Desktop session). If that was a mistake you should be able to recover the file from the recycle bin on the computer / in OneDrive. Because CMIS is an old old application, it may continue to struggle as the computer from which you start the RDP session changes its output screen resolution/display zoom, so even if the above works, you might need to repeat each time you hook up / disconnect from the external monitor on you laptop. IRD / CMIS / Old apps are quirky like that.

I'd say going to wireshark is a pretty early troubleshooting technique if you've got the skills to decode it. There is lots of quirky stuff that is easily visible, and I've spotted many a config error by seeing where packets are going, not going, take an unexpetably long time to get a response or have the wrong auth settings. Never needed to do it with Papercut mind, but then we use Sharp. One thought though is are any of the new devices connected to switches that have power saving enabled? is it possible that the ports are powering down and not coming back on fast enough for the software on the MFDs liking? (might be the nic on the MFD that's powering down..?) Also going back to wireshark for a moment, I've seen intermittent loops and broadcast storms take out phones while not having any apparent effect on desktop pc's, so might be worth taking a look at what is going on in the vlan(s) hosting the printers and Papercut server. Final thought... what AV system is running on the papercut server - there is usually a network traffic inspection element, this could be going interfering?

We've seen some very slow sync's this week. Greatest impact on productivity for users who have use the "shortcut in my onedrive" feature to sync large departmental SharePoint Team site document library.

That is a very interesting set of data. I wish it were possible to apply filters so one could do a "schools like me" comparison, because for the other annual MIS study the picture moves quite dramatically when you (say) remove Primary-heavy MATs. On feelings about integrations... based on reading 3rd party integration notes/options the one people feel is worst in this survey, seems to be the one that has the least caveats in the 3rd party docs. I wonder what is going on there? (Particularly since some of the MIS's with high satisfaction in this area I was under the impression don't actually offer much in the way of integrations). I continue to suspect part of the problem is higher exceptions from customers on customisation and thus greater disappointment when they encounter the limitations.

Seating plans, Files on Demand, and a fast network/internet connection. Works fine for us. Maybe once a month student "can't find some files they uploaded last lesson" - because they are sat at a different computer. Teachers also structure their lessons to get files uploaded continuously through out the lesson rather than in one big surge at the end. We have enough media heavy subjects that even with a FC-backed NAS's we could struggle to cope if media and photography and design waited until the end of a lesson to save their work/copy over the sdcards, so teachers were already used to spreading the load.

This just caught up with me, I'd been fine all morning and suddenly intune is throwing errors "Our services aren't available right now We're working to restore all services as soon as possible. Please check back soon." Others had seen it early.

"Hundreds of pagers have exploded injuring members of a very specific political party/terrorist organisation" sound like a plot device of a third rate political/spy thriller, but in fact just happened. https://www.bbc.co.uk/news/articles/cd7xnelvpepo We live in frankly strange times.

Powershell 7 can do ssh (and thus scp) natively https://4sysops.com/archives/copying-files-between-windows-and-linux-with-scp-and-powershell/#:~:text=and%20vice%20versa-,Copying%20Between%20Windows%20and%20Linux%20with%20PowerShell,-In%20PowerShell%2C%20you I've not tried it for automation, mind. Our network management tool does the switch backup for us, but is closely tied to the switch manufacture/os platform and is ancient (but still patched).

I don't mean to be judgemental but who's letting squirrels use a strimmer?

If they at any point act as the Data Controller (by, for example, providing your users access to their data on a website) then they are required to have mechanisms to meet the "Data Portability" requirement of GDPR and a pdf is not good enough. Now the right to get at the portable data is between data subjects and data controllers, and if the are a data controller, they *must* have such mechanisms, and it would be quite unreasonable for them to refuse to export the data to yourselves (the initial data controller who contracted with them to provide the transformation/access to yourselves and the data subjects). Also since you are the data controller, and a data subject could request this of you, then the processor must be able to provide you the data in a suitable format so that you can comply with such a request. That said - we asked a company recently if they could give us a list of the unique IDs linked to student emails in their system (so we could do something clever with QR codes), and they said "no that's propitiatory" even though the UIDs are in the url of each students record. ::shrug::

In defence of a growing dislike of change. Change gets exhausting when its forced on you at a rate such that taking a week's leave puts you onto the back foot. Change is exhausting when it is forced on to you and makes things worse for the people you are supporting. Change is exhausting when too many new things happen at the same time and suddenly you are putting out seven fires across four business-critical systems, and your own project, and as a result your standing within the organisation suffers because of it. Leadership here got fed up with it and took away much of the day-to-day responsibilities from the IT service because of it (it was perceived as our failures), three years later all those middle managers who now own those systems are tearing their hair out trying to juggle their T+L, the start of term, and all the systems changes. An appreciation of how hard it is has begun to permeate, and yet I don't feel schadenfreude, just sadness.

Maybe as part of the pre-sales->customer pipeline the sales team could ask "does your school use Google or 365 for sign-on" with a fall back to "gmail or outlook for the kids?" for those who look at them blankly, from them arrange to speak with the IT team/DPO to make the on-boarding smooth. You'd get brownie points from me for asking to chat with the DPO I fear though that perhaps the experience of your company is actually representative, and the responses here not so much, because here we all know SSO is the correct answer and we are all in a position to make it happen.