psydii

Try the authentication logs in Entra? Users->All Users ->Sign in logs. I think everybody gets those. Also, https://learn.microsoft.com/en-us/office/office-365-management-api/office-365-management-activity-api-reference and https://learn.microsoft.com/en-us/purview/audit-log-enable-disable?tabs=microsoft-purview-portal seem to suggest with a bit of (probably tricky) fiddling around you can access this data with custom scripts. "Audit logging is turned on by default for Microsoft 365 organizations" I know there was a bit of a bruhaha a while back because this data is required for basic forensic analysis, and the general view from the community was the 'raw' data should be available even without E3 / E5. I think the upshot was that with work (scripting) you can get to the data without a Purview/Compliance addon or E5. But I could be misremembering where this all landed in the end.

you can do this from cloud app activity log in defender.

From the link : "All users signing in to the Azure portal, CLI, powershell or Terraform to ADMINISTER Azure resources are within scope of this enforcement" "Token-based accounts used for automation are excluded" (which is how Salamander talks to AzureAD as I recall) Also, SDS is not an Azure resource (it might be built on Azure, but the service is not part of the Azure offering) so as per the above will be out of scope.

@RobFuller is correct.

The enrol in AAD GP I think exist these days to give DA's a way to *prevent* the default behaviour of an AD Domain Computer joining AAD. More info on how to enrol to Intune via GPO: https://learn.microsoft.com/en-us/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy This should get your existing devices onto Intune without a re-image or having to touch them.

Yes. Not the fault of the technology per-se, but a leadership / management failing. Its probably worth noting that they did make several bad bets on the future early on: Sharepoint web parts being the first dead-end, shortly followed by silverlight and the Metro/UWP. Back in the mid '00s their leadership should have understood that computers get faster, cheaper and easier to maintain, so running a second server to host an on-prem basic web app would be viable for many/most schools within a few years (just as Bromcom did). As you allude once you are on the right path, you just need to keep iterating to improve, and at some point you iterate from on-prem servers to cloud based ones with minimal disruption to the customers/users.

Hmm. While it is clear that SIMS has not successfully made the transition, it is not the fault of its architecture or the tech used, which fundamentally is the the same as Bromcom and StackExchange (i.e. dotnet + SQLServer). SIMS has in no large part the problem of all dominant companies/products of any era... inertia of the majority of its customer base and its leadership and management focus on balancing flat revenue against expected profits while maintaining the legacy of a product that meets esoteric needs of a very wide customer base. Crucially, it can't launch a "minimum viable product" because it wont meet many requirements of 99.9% of its customer base, whereas the competition only needed to start by getting just 0.1% of the dominant providers customers and building up from there.

Clipchamp might be worth a look? It's available in A3 from later in June. https://techcommunity.microsoft.com/t5/education-blog/what-s-new-in-microsoft-edu-may-2024/ba-p/4132818#clipchamp

So, same as it ever was.

A current Microsoft documentation page lists Microsoft LAN Manager Client version 2.2c for MS-DOS as an example of a DHCP client.

The LAC Officer and the DSL should check their notes and decide what level of responsibility the school is to have over this device and its use going forward (hopefully: none). This should be communicated to you in writing. If none, just get a halfway decent Chromebook from Dell 13-15" 8Gb ram 128Gb storage. Make it a current model so they get the full life out of it. They will of course need their own Google account (not a school one) to get it set up. If you know what school they are going to, it might be worth the LAC officer reaching out to them to find out whether a chromebook or a windows device would fit best with their new environment. The default should be Chromebook because you get the best bang per buck, and malware/ransomware is less likely to be encountered. But if your environment was, and their next environment is, Windows then you ought to try to provide them with that (particularly if their next environment has 365 student benefits - they'll get uplifted to the full suite). Just make sure they sign up with a personal account rather than a school one. I'd try to get a laptop built around the Intel N100 or N305.

Take a look in the windows\system32\csc folder. You might need to be NT System to go splunking there. What version and build of Windows was running on the server(s) and client when the folder redirection policy took effect?

Ransomware up 170% https://www.bbc.co.uk/news/articles/c2vwz4exq4xo

Transcribe in 365 is a "Connected Experience" https://learn.microsoft.com/en-gb/deployoffice/privacy/connected-experiences Data Privacy of Connected Experiences is explained here: https://learn.microsoft.com/en-gb/deployoffice/privacy/connected-experiences-content Very few connected experiences retain customer data for longer than the time it is used to produce the response back to the client. Transcription is not one of those listed in this section. Connected Experiences store data as per the Data Residency settings https://learn.microsoft.com/en-us/microsoft-365/enterprise/o365-data-locations?view=o365-worldwide So for UK schools this should be all on UK servers, but if you didn't click the migration button a few years ago, then it will (should be) in EU with some in the UK 'geography'.

This is built into Microsoft Word these days! https://support.microsoft.com/en-us/office/transcribe-your-recordings-7fc2efec-245e-45f0-b053-2a97531ecf57 Probably pretty basic compared to bolt-on products, and it seems to struggle a bit with technobabble (or what ever the teacher-lingo-tla word-salad is called) but it gets you quite a long way there.

Somewhere earlier in the thread I wrote "Assuming LGFL is presenting 3 networks" to which I expanded to mean on three separate ethernet ports. Subsequently you have corrected my assumption, stating the lgfl<->coreswitch is a single cable between a port on the lgfl side and your core switch. Do LGfL know about the subnets you have chopped up from the your IP allocation? i.e. does the lgfl router know that 10.251.180.210 is to be used as the gateway for 10.25.182.0/24 and 10.251.184.0/24? or was I also wrong about the default gateways set for each DHCP scope/VLAN? Also I note you appear to have jumbo frames enabled. Every time I've looked at this the consensus view is that this is not a good idea (except maybe between servers that only talk to each other e.g. vmotion, veeam backup, iscsi). I would be very tempted to try turning this off, and check that your client devices are not trying to send jumbo frames either! (Get-NetAdapter |Get-NetAdapterAdvancedProperty |Where-Object {$_."DisplayName" -eq "Jumbo Packet"}) But I am not sure how this could explain the symptoms you describe. That all being said, the ARP Cache error seems to me to be the key to unlocking this. As PotNoodleTech suggests, it might even be a fault in the switch itself.

..so in my experience, each lgfl school ip subnet is presented via separate ports on their router, so only having one port connected between the LGfL router and your core makes me think either the lgfl config is not as I believe they are, or things are not as they should be.* I can't see from your screen shots which port on 10.251.180.0/23 your core switch is connected to the lgfl router, nor which vlans are presented on those port(s) on the core switch. Can you try to attach somethign that shows this? From the additional info you have presented, I will highlight/query the number of devices on the paxton vlan. This seems high given the number of end user devices you appear to have. (unless you have most doors in the building on the paxton system?) Do you have a wireless network that presents a separate IP range to wireless clients? If so are there a lot of devices on that? *So from experience, each lgfl subnet is on a separate port on the lgfl router. On the school core switch you should have 1 port and 1 vlan per LGfL subnet connected between the school core and the lgfl router. e.g. LGFL Port 1 (10.251.180.1) -> Core Switch Port 1 (VLAN 1 untagged, 10.251.180.210) LGfL Port 2 (10.251.182.1) -> Core Switch Port 2 (VLAN 2 untagged, 10.251.182.210) LGfL Port 3 (10.251.183.1) -> Core Switch Port 3 (VLAN 3 untagged, 10.251.183.210) (Core Switch port numbers are examples, since I can't see what you've got plugged where. Also the .210 ip addresses might be associated with the VLANs themselves rather than the specific interface, its been over ten years since I last looked at comware) Again I should stress that this is how I have done it, but I know LGfL have to deal with a lot of variations at schools, so they may have a different config at your site to enable it all to flow through one port, for example VLANs or routing, or maybe just all IP interfaces presented on that port?. I would have thought one port per subnet/vlan is the best way of handling this though. Can you show us the configuration of the port / vlan for on the core for the connection to LGfL? Also the potential elephant in the room is your opening sentance "I am at a split site school and at one of the sites....". How are the sites connected? Are these vlans/subnets present at both sites? Is/are their only one DC/DHCP/DNS server? Or is there one or more at both sites? Is there an equivalent 'core' switch at the other site?

… how is the lgfl router connected to the core? How are the vlans on these physical port(s) on the core switch configured? The fact this happens only when the network is busy points to arp or dhcp lease exhaustion. I’m wondering if some/any/all devices have the same physical interfaces configured across multiple vlans. How many devices do you typically see during a school day? How long are your dhcp leases? It still could be just a loop that the network copes with when idle, but struggles when ‘busy’.

That's quite a surprise given the LAN ip ranges only appears to support 256*4 Hosts, I vaguely recall that the 1910 (earlier version of this class of switch) could support 4000, or was it 2000 hosts? Anyway that's way more than you likely have devices connected. A quick skim of the latest firmware release notes for this model of switch suggests that older versions (pre 2019) had lots of arp related bugs. If you aren't on the latest firmware release, try updating. The 19x0 series of switches are/were *amazing* pieces of kit. If you had a small lan and weren't trying throw multiple gigabits per second of sustained traffice across mulitple ports, they really were extremely good value. Particularly if you know the secret incantation to bring up the full Comware CLI. If you had a bigger lan, then they made perfectly fine edge switches., and (at least for a time) they came with a procurve-like warranty. Looking at the fragment of config you've been able to share, is it possible that some devices have the core switch as gateway and others have the lgfl router (180.1)? You would get extremely inconsistent experiece with devices trying to speak from VLAN 2/3 to the DC (in VLAN1) if, say, the vlan 3 device had the router as its default gateway, but the DNS Server (your DC) had 180.1 as its gateway. The DHCP relays seem to be configured correctly, assuming your DC/DNS/DHCP server has a single network interface and it is configured as 10.251.180.3 / 255.255.252.0 gw 10.251.180.210 I would need to run this past someone familiar with the lgfl router configs (Its friday evening, so I shan't @Mention him just now)... but this is how *i* *think* the end points should be configured Assuming LGFL is presenting 3 networks 10.251.180.0/23 10.251.182.0/24 10.251.183.0/24 There should be three DHCP scopes on your DHCP server: Vlan 1 devices Gateway 10.251.180.210 subnet mask 255.255.252.0 dns 10.251.180.3 vlan 2 devices gatweay 10.251.182.210 subnet mask 255.255.255.0 dns 10.251.180.3 Vlan 3 devices gateway 10.251.183.210 subnet mask 255.255.255.0 dns 10.251.180.3 This would/should allow all devices on all vlans to contact the DC/DNS/DHCP service on 180.3..... but things are going to get messy for traffic destined for the internet. That traffic will hit the core switch xxx.210 and then be routed to the lgfl gateway in vlan 1 (10.251.180.1), however returning/inbound traffic to that host will (probably) egress the lfgl router on the ip interface corresponding to the vlan of the host and bypass the core switch. So I'm not sure this is the best way to have things set up.. but I can't see how else hosts in vlans 2 and 3 would be able to communicate with the DC/DNS/DHCP server, unless it was multihomed (a trick I haven't done since about 2003, and I think you aren't supposed to multihome DCs) or instead the LGfL router was passing the traffic between your subnets. Hopefully though there is something in the above that helps you hone in on the problem and find a solution.

I'm also suspecting a DHCP issue, probably not enough IP addresses available in the pool. Butipconfig is showing everthing is ok... so it can't be. Lets start at the vlans.. Traffic can't pass between vlans without some special configuration. That is the purpose of the vlan concept. Typically you have an IP network (subnet or CIDR) allocated to each VLAN. There is usually a router (typically the core switch) that has an IP interface in each of the VLANs and the router handles passing packets between the subnets (check the core switch, does it have IP interfaces in each VLAN/Network, is routing enabled) Typically you don't want all traffic to be able to pass between subnets (do you really need students to be able to ping Paxton?). So on the router there may also be Access Control Lists which limit traffic flows (you might consider these to be like firewall rules, though they typically are not as flexible as rules on a dedicated firewall). Are there such rules in play here? Also there need to be a DHCP / UDP Helper / Forwarder /Proxy that takes DHCP request on one VLAN and passes them to the server specified in the router config. Is this present? Does it point to the expected DHCP Server? If the DC is on a different vlan? What it the output of ipconfig /all on the Domain Controller? (in vlan2???) What is the output of ipconfig /all on a typical PC (Vlan 1?) What is the output of ipconfig of a device on vlan 3 Also... as you suggest intermittent faults could be loop related. Does your core have spanning tree enabled? If so when does it show it last altered/recalculated the topology?

UPDATE: Funnily enough their reporting service just completely stalled because everyone is trying to export their licence reports on the advertised deadline: So they seem to have extended it.

The Assignment App creates a "Student Work" Document Library. Inside this document library it creates two folders "Working Files" and "Submitted Files" Inside these folders there is one folder per student member (as per Team membership t the time the last assignment was set) Inside each student folder there is a folder with the name of every assignment set so far. Students can work in the appropriate assignment folder in the "Working Files" folder and the teacher can view these files directly through SharePoint (or OneDrive/SharePoint Sync) Students cannot view each other's work. It is necessary for the Teacher to show the students how to get to their Working Files folders through SharePoint and how to use OneDrive to Sync them. Smart students will often "add this folder to my OneDrive" so that they can subsequently access it easily without having to worry about navigating the SharePoint Site(s) in future. This also means their course /assignments folders are sync'd automatically by OneDrive, again making it simpler to setup and move between machines. Because I think about how this scales, our official guidance is that they should opt to sync their Working Files folder on each machine on which they need it, rather than the onedrive-shortcut trick. This way they don't end up with their onedrive full of links to course folders. I am uncertain whether my method or the students' method is the best in the long term. On the use for Media etc. The most recent guidance I have seen still suggests that using a sync folder for Premier / Logic / Final Cut project files is not a good idea (it used to ensure data loss, but I haven't tested to see if its got any better in the last five years). The departments that use these products have their own workflows for ensuring students don't loose work. They have recently begun to ensure students primarily use the sync'd Working Files folders for storing their assets. How they manage their project files is a bit of a mystery, but I think they just copy to a OneDrive/SharePoint folder each lesson. Working Files vs Submitted Files. The Assignment app moves work between the "Working Files" folder and the "Submitted Files" folder when work is "handed in". This is why for courses that want to make use of shared folders for their course work we recommend a single assignment at the beginning of the year and then to leave the Assignment App well alone after that. Departments with a significant degree of competency in their staffing and students might also set more traditional assignments as well, because they are able to trust their staff/students to save their ongoing coursework in the folder structure, and use the assignment app for the week-by-week coursework reports.

Not sure, but since Windows 7, the default set up with redirected folders / SMB shares would have files cached locally and lazy-sync'd back to the server at the computer's leisure. It all happened deep in the filesystem/redirector, and on fast enough networks/servers you should never have noticed, but, catastrophic data loss bugs aside (hello kb2775511 et al), unless you were uploading gigs of data suddenly (like a class full dumping video/photography camera footage from memory cards) you'd never notice. We've found the same to basically be true for OneDrive, as long as you don't leave saving to the last second, its fast enough. Also we've found almost everyone is working in webapps/teams these days, so the data/change exists in the cloud first. For behaviour management reasons we have seating plans. This is extremely helpful since students use the same computer each lesson, which overcomes (almost) any issue where a file didn't make it to the cloud last time. Finally, (and we've not done this in a while so it might have changed) If you invoke a profile delete through WMI and the profile contains Onedrive files that are marked as having a sync pending, the delete leaves them on disk.

Heh. We've got one machine/ship-of-Theseus that started life on XP. Its been through vista, 7 and 10. It's been on three domains, its on its third motherboard/cpu and but only its second system disk and somehow in the middle managed to dodge the CC4 client. Right now I'm pondering how to get it to Windows 11. I know they are cattle, not pets, but sometimes...