psydii

We've leaned into the 'virtual' one to one model. By which I mean we've gone all in on bookable laptop trolleys and have 16x 15 bay units that are booked in advance and deployed by the IT services team. Some are managed by department with demonstrated competency at managing their own expensive assets. Only students who are managed by the SEND team are allowed to pick up and drop off laptops at will. Always done through the IT office, and tracked. We've had a few periods where all devices were deployed. Because we get hands on with the devices each time they are moved we are finding that they are extremely well looked after, which was not the case when we were not so strict at collecting devices back to the IT office (they were previously returned by teachers or students, and often left with a department if they had an intermittent booking that spanned a few days). This only works because everything else (hardware and software) is sufficiently reliable that we can allocate a specific individual to manage this day to day, and the physical layout of the building/site allows for swift access from the IT Office/Store(s) to any classroom. To make the suggested model work, I would plan to have every unit checked every day. Also given that they will be in a public space, these cabinets are likely to be metal? How would wifi work inside them? For us our trolleys are laminate/chipboard and so the laptops (thanks to the intune shared-pc/education policies) are able to phone home each night and update etc as required in order to be ready first thing every morning.

That's an odd choice, it seemed to me that most Chromebook these days seem to be getting chipset/specs comparable to low-end (but on a modern hardware platform) Windows laptops, and the the Lenovo 100w has the amazing N100 SoC, which seem to have at least the performance of a 2015 i5 but at 6W rather than 15W.

We started once OneDrive Files on Demand was available with Windows 10 1709. Three departments and an handful of users went over in 17-18 Staff Home drives and Yr 7 in 18-19 Year 7, 12 and 13 at the beginning of 19-20 The rest of the shared folders and student home folders went over between 10th and 17th March 2020. Mailboxes went over 18-19.

I'm told some chat-gpt-like systems are able to take student timetables presented as unwieldy spreadsheets and accurately answer questions like "where is Bobby Tables now?"

For us, Assignments are created by teachers as they need them. We don't use Teams to performance manage the teacher's compliance with homework policy. Some departments create assignments each week (for homework), others create per term (for coursework), others just create one per academic year and then use the underlying folders ignoring the Assignments UI completely. We use a separate system designed for parental engagement for the official setting of homework. If its not on that system, then it hasn't been set. Often though the homework on that system says "Complete Assignment X in Teams". Again this is done lesson by lesson, week by week, not all at once in advance.

Use a GPO to explicitly set the ACLs on the CCTV sub folder inside the Public and Program Files folders - *Block inheritance* for the Public\CCTV and the Program Files\CCTV folders Then set permissions on that folder to mirror those of "Program Files" except instead of "Users R+X" have CCTV_USERS R+X" For the Program Files\CCTV folder have an additional ACE of CCTV_USERS (W) The inheritance block will remove the Users permissions to even enter the folder and see config files or other data that may further expose the system. Applocker not needed in this case. The other "correct" way of doing it is to exert explicit control over *EVERYTHING* installed on a machine. No blanket "Program Files - ALL USers Allow" applocker rule, but instead have rules per folder (i.e. per application installed). This is a lot of work, and slows down software deployments and trips up automatic updates when they decide to change folder names.You'd need two security groups for each application app_AppName_allow, and app_appname_deny Then for each application you deploy you have two rules: AppFolder - app_AppName_Allow (allow) App Folder - app_AppName_Deny (Deny) Typically Domain Users would be a member of app_AppName_Allow and app_AppName_Deny would be empty. In the scenario above you'd make the pastoral team group a member of app_CCTVSoftware_allow, and remove Domain Users. The deny group would only come into use if you needed to block access to only a subset of users (for example Students, or Yr12)

We use it and are happy. We did have one significant hiccup though. We gave applicants the option to self report SEN. If they selected No SEN, this was imported into SIMS, and when the CTF came through from the previous school with SEN Data (including any historic data) SIMS failed to import of the SEN record/history because the SEN Code in SIMS was already No SEN. Thankfully our SENCO is on it, and spotted the variance in the SIMS data with what she had learned through other channels.

Love that diagram, did you make that in house? If so what tools did you use? I'd love to see/make a tweaked versions to cover the Assignments Module/Student Work Doc libraries

Speaking of the before times. I found an OM1 patch lead in service yesterday, it was installed in 2009. So I replaced it with the *very* cable that should have been installed in the first place.

Ah gotcha. A privileged workstation is one way you could go - but that might not be much of a boundary if you rdp into the system. The device you RDP from is still a potential vector for privilege escalation. Mind you, DA isn't actually necessary for any of the tools you listed. https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/manage/understand-security-groups https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/delegating-administration-by-using-ou-objects (make sure that the service admin groups are out of scope, otherwise you've just re-introduced the privilege escalation path!) https://learn.microsoft.com/en-us/windows-server/virtualization/hyper-v/plan/plan-hyper-v-security-in-windows-server Of course with a bit of work an attacker with DNS Admin (or DHCP admin) could set up MITM or auth downgrade attacks, but if you use a Just-In-Time privilege model (similar to the one for local admins described above) your accounts only have access to the services while you need them to, minimizing the risks of credential theft.

Gpo that adds the group sec_%computername%_admin to the local administrator group. Give each techie a ladminUserName account. These user accounts should by default be a member of Domain Users and Protected Users only. When a techie needs admin on a local Machine, add them to the sec_ %computername%_admin group for that machine. If the machine is broken and can’t/can’t be connected to get line of site to the DC, it’s a wash, wipe it and start again.

Top tip: Reduce the lease times asap (down to a few days initially), then when its a day or so before you are ready to make wider changes, reduce the leases to a matter of hours or minutes. Otherwise you might end up waiting weeks for the clients to pick up changes. Once you've got your new scopes up and running, extend the lease times back up to something reasonable. Probably safest to change over the summer, but definitely reduce the lease times well ahead of the server/scope consolidation.

I haven't encountered any courses kS1-5 where outcomes for students would be better if they had access to Linux only research/science development tools. Your final point though is genuinely food for thought. FWIW I went to a school that had tens of millions pounds of investment in its science department over the 30 years before I was a student. About 30% of form sixth form students took a science course at A level but only a fraction of that went on to study a science at university. That said I am meeting up with some old school friends next week, two of them have Physics PhD's. One only codes on Windows platform - because when he commercializes the software it needs it to run on the desktops/laptops of customers (yeah yeah old school pre cloud thinking - but true). The other, well lets just say his stuff runs at scale and it ain't on Windows.

Given we make a point of recruiting staff with skills from outside the education sphere to deliver our very broad curriculum, its not a "schools wont pay for training" issue but that wider industry (outside of cloud-scale/devops stuff) still predominantly favours productivity/creative apps that run on Windows or macos.

There are no requirements for google to run its services on Linux either, but here we are.

The reality is that if a school bought a four core i5 since SandyBridge there is a good chance it is still a viable machine for office and web applications today. And kaby lake or newer will probably even run Creative Cloud suite without issue. (And a dirt cheap 1030 will allow even Haswell to have photoshop running without complaint) The windows 11 requirements cut off a vast number of excellent, reliable, performant machines. I completely agree that a line had to drawn (particularly around security capabilities) but where it landed cut off machines sold into education, that the education users had reasonable expectations of keeping in service for 10 years (ryzen 2400/2700g with your glorious vega gpu cores, I’m looking at you!) This change gives schools enough wiggle room to sweat out the assets. I do wonder if this announcement is six months too late though.. Schools have the assets they do to deliver the course they offer. If they can’t replace the devices they can’t run the course, and they don’t need those specific teachers or departments anymore. I imagine some institutions have already taken some hard (irreversible) decisions to deal with the August 2025 deadline.

Since you mentioned them, and they don't appear in your log of troubleshooting so far, I think its going to be the docks. Most likely either the usbc cables / usbc ports on the laptops, but it could also be the actual dock themselves. On another tack, have you taken a look at what Wireshark sees when a computer is being slow? Does the traffic look normal or are the 1000's of broadcast packets per second / lots of red and black in the pcap?

HR told me this might lead to unfair dismissal claims. So at induction I now advise the new staff that The Head Teacher Disapproves of unnecessary all staff emails and that sending them might be considered a “career limiting move”

While not in the middle of the night, we've had a spate of oddness with files being deleted. It has something to do with the teachers running with Assignments through the UI and people also directly accessing the documents in the document library. The fix was to ensure that on a per-assignment basis, they either only used the Assignment UI to open, edit, hand in and return work, or (once a dummy assignment has created the student folders) to exclusively access work in via the Student Work Document library. The date/time shown is as per the SharePoint site's timezone - this might not always be UTC so might be worth checking that - the UTC equivalent times might be something more likely to point to human interactions.

We used to have a chippy van that would come around monthly too! The local grocer's, butchers, bakers and post office all closed 86-92. Everyone shops at the "big sainsbury's" that's 15 miles away.

This. Absolutely this. And if it takes 200% effort to make them work you give 200% and talk about it later. If you/your team have KPIs and SLAs that are impacted by work supporting exams, then there should be categories/tags in your service desk to record your exam support related activities. - this will help the 'talking about it later' phase. Pretty much all of the advice in this thread is good. Exams have to work. Don't burn bridges, but do advocate for a manageable set of working practices that survive the absence of one or two key individuals. My team is the size it is because when they tried to thin us out, and one person got covid and the other got knocked of their bike things fell apart. (despite the exams team being experienced with managing the technology used - they couldn't cover the support of the dozen invigilators without at least one person from IT being available). These days we even have a person outside of the IT Services team who has the power (and specific training) to reboot the print server (because spooler only crashes at the most inconvenient moment) and manage the exam accounts. The print process is the exam team (which during exam season expands to included LSAs) collect completed scripts on USB and print them out, getting the student to counter-sign the output. The exams team and LSAs pick up and return a set of laptops that is used EXCLUSIVELY for exams. They manage the exam scripts. For exams where we need to distribute digital media we use a Team per exam/room with resources delivered through the assessments module scheduled for the start of the exam and dedicated user accounts (based on candidate number). Accounts are only enabled shortly before the start of the exam. The exams office handle the distribution of the exam account details. The exams team (and the person who also has the print server management account) have management permissions on the OU that contains the exam accounts so they *can* enable/disable them should IT be unavailable. It is better if IT do this though.

We’ve had weirdness like this. Never could get to the bottom of it, but after a few months it would just go away. Best guess is a driver/windows update related bug that got fixed in later drivers/updates. Had similar with WiFi too. That was not a fun few weeks. In both cases firmware updates were part of the troubleshooting process. In some instances a firmware update of a board (or ap) appeared to solve the problem, in others the driver or windows update was required (or just solved it).

Take a look at the Student Work document library in a Site that is part of a class Team (where at least one assignment has been set). We abuse this a lot. Prior to that we had PNP scripts that manipulated permissions. [edit found a template -- below. It uses the depreciated AAD stuff so probably needs at least a gentle reworking for graph. Not sure about PNP these days either, or whether it would work with pwsh7] $SiteName = "SITENAME" $Group = "AADSECURITYGROUPNAME" $SiteAbsoluteURL = "https://TENANTNAME.sharepoint.com/sites/" + $SiteName $SiteRelativeURL = "/sites/" + $SiteName $listname = "DOCUMENTLIBRARYNAME" $listnameAsRelativeURL = "/" + $listname $FolderServerRelativeURL = $SiteRelativeURL + $listnameAsRelativeURL connect-azuread Connect-SPOService https://TENANTNAME-admin.sharepoint.com Connect-PnPOnline -Url $SiteAbsoluteURL -UseWebLogin new-pnplist -Title $listname -Template DocumentLibrary -OnQuickLaunch $UserList = (Get-AzureADGroup -SearchString $group|Get-AzureADGroupMember) foreach ($user in $UserList) { #write-host $user.givenname $user.surname $userFolderName = $user.givenname + " " + $user.surname $targetFolder = $FolderServerRelativeURL + "/" + $userFolderName Write-Host $userFolderName Write-Host $user.UserPrincipalName Add-PnPFolder -name $userFolderName -Folder $listnameAsRelativeURL #write-host "Set-PnPFolderPermission -List"+ $listname +"-Identity " + $targetFolder +"-AddRole edit -User " + $user.UserPrincipalName "-ClearExisting" Set-PnPFolderPermission -List $listname -Identity $targetFolder -AddRole edit -User $user.UserPrincipalName -ClearExisting Set-PnPFolderPermission -List $listname -Identity $targetFolder -AddRole edit -User "SOMEOTERUSERWHOYOUWANTTOACCESSEVERYTHING"

Yes. Here is a video on how to use procmon: https://learn.microsoft.com/en-us/shows/defrag-tools/3-process-monitor Also chatgpt / MS Copilot comes up with a pretty good set of guidance if you feed it the problem you are having along with "how to I use procmon to help find the root cause of this issue"

use Promon and see what is going on? 20 minutes is a long long time. I can't even begin to speculate what might be causes that delay on a repeatable basis (as a one off, it might be an update pending?). Typically delays are caused by plugins, or the anti-malware protection system stalling but 20 minutes is longer than anything I have ever heard of. Other things are redirected AppData folders (as you have mentioned), and also web filtering getting in the way. Perhaps try fiddler if procmon does not point to anything immediately obvious.