psydii

The SFIA framework used to be good. It's gone a bit over the top in more recent versions, moving further and further away from something any small org could implement, but might be worth a look. https://sfia-online.org/en/about-sfia/sfia-professional-skills

Absolute legend. RIP.

We should all have contact (and medical) details available outside the MIS in the event the MIS is unavailable. And having it in two separate cloud based systems (say the MIS and Classcharts) may not be enough either - the MIS and the other 3rd party may depend upon other mutual 3rd parties (AWS, Google, Azure) where failures are already demonstrated to impact multiple providers. You need this stuff on disk locally, and in a physical file (for when the power is out too). We have ours in our MIS, GroupCall, Wonde and Teams. With a hardcopy in a secure cupboard in the main office, and an excel sheet sync'd to at least half a dozen staff laptops.

We have a site/team for each department, which limits the scope of potential damage. We have several communication sites for sharing documents read only with all staff (HR, Safe Guarding, IT Helpdesk, general school documents and stuff). Owners of the information are the Owners of these sites, All Staff are visitors. The PA / Office Manager / Business manager owns the general school documents site, and manages access therein at a folder level. When a document needs to be shared outside of the owners/members group of the site, then it is done limited to the specific file/folder to a suitable azuread/local ad group. Mostly these documents are transitory and end up being shared directly from the member of staff who needs to collect the data's OneDrive.

Absolutely. 86" image at 1080p is the sweet spot for most classrooms. If the classroom is 70m2+ even bigger would be better. 4K native just starts to making things complex with various chipset supportability issues with docks/second screens HDMI reliability. For us there was no re-usability on the legacy IWB wiring as it was pre-HDMI, so that was not a factor. If redecoration is important, then sync up the work with classroom lifecycle work (carpets and painting etc), this was my preference, but not possible so the nice "new" classrooms are a bit scruffy where the last paint job and the new aspect ratio of the boards does not line up. You have to pick your battles.

game keeping pays better, so valid move if you’ve got the personal integrity to make it. But not one SAR in the last five years has involved a conflict of interest from within my team. The complex/sensitive SARs are all HR and SEN matters, and so on several occasions the member of SLT overseeing my DP role has had to recuse themselves from the process. Most of our SAR’s are actually straightforward Education Record Requests… but depending on the specifics these sometime need to be treated as SARs, so the bulk of my work on the is really checking whether SAR rules or ERR rules need to be applied and signing off on the admin teams’ export of basic MIS data.

Warhammer/GW got five minutes of air time on the business section of the Today programme this morning. They seem to be having a bit of a moment in the sun, even if the were talking to SJ rather than current management.

Apropos of nothing, Classcharts had a wobble yesterday and was sluggish this morning.

We've seen it all already :-/ But I refer to my previous response - it would be run by either the PA or other member of SLT and the search would be carried out by a different member of the team.

The return of interactivity after a ten year absence has been welcomed here. Those pushing for non-interactive solutions "because nobody is using interactivity" have either admitted they were wrong or left. The argument, though, we used was similar to the above... warranty and life time of the boards. I could point to cheap TV screens which failed after three/four years that had already been used in some locations instead of professional display screens (14 year and still running) around the school to help make a case. Once you are looking at screens designed to be on 8/5 or 24/7 with 5 year next business day de/re-install warranties (because the classroom tech *must* be reliable), the interactivity basically is free.

Same here, but we are quite big so we get a few SAR's a month.

Our (external) DPO audits our work and is available to answer any queries and provide guidance. For big complex matters they review the work in progress and the final "package" before it gets sent off. I have day to day responsibility for Data Protection and manage the processes. A nominated member of SLT has oversight and is made aware of any requests and the progress thereof. I complete the validating and scoping of the request (ensuring we have a good audit trail), and the communication with the Data Subject. eDiscovery is performed by IT Services, (which is self auditing), run the SAR export from the MIS, and they reach out to system owners (safeguarding, SEN etc) for other data in scope. Review and redaction depends on the nature of the request. In all cases we have two members of the admin team who specifically have supporting me fulfilling our obligations under the Data Protection Act as part of the their job description. Usually I do the initial filter of the data from eDiscovery and other services then bundle the output into work packages for the admin team who complete the redaction. I review their work and pull the completed bundles together, and again depending on the nature of the request run it past the DPO and/or the nominated member of SLT with oversight. Often though the requests are trivial and are sent through with no further review. Other times we bring in the individuals who are most familiar with the data. The more complex and sensitive the matter the more involvement from SLT / The Head and our solicitors and DPO. Initially we did not have specific members of the admin staff for data protection activities, but it became clear that the review and redaction work could take significant amounts of time and it was not a good use of the school's resources for that to be my time or that of a member of SLT. In my absence the member of SLT would run the process, and in the absence of both of us the PA would co-ordinate with the IT team, the admin staff and the DPO to shepherd the request through.

I can't find any info about a new version of OneDrive Sync Client. https://support.microsoft.com/en-us/office/onedrive-release-notes-845dcf18-f921-435e-bf28-4e24b95e5fc0 We're on v 23.nnn.nnn.nnn I expect the next version will be 24.nnn.nnn.nnn no major re-writes or functionality for the OneDrive sync client for Windows or Mac appears to be on the roadmap: https://www.microsoft.com/en-us/microsoft-365/roadmap?filters=OneDrive&searchterms=onedrive#owRoadmapMainContent There is it seems a lot going on with the in-browser/PWA version though I can't imagine that version replacing the native client any time soon. But its been a couple of years since I was keeping a close eye on OneDrive improvements... perhaps along with the PWA version of OutLook (and with Teams always having been that way) the PWA version is to eventually replace the native one? I did however, (for those who also might have not been paying attention recently) discover this new (?) management portal https://config.office.com/officeSettings/settings which has a section for monitoring OneDrive Sync client issues in your fleet. It needs setting up, but I can certainly see this giving my team greater peace of mind that syncing is working before wiping devices in future.

Then you have to be acutely aware of the capabilities of the various graphics subsystems (formerly Graphics Adapters/Driver) of your fleet. Not all past and future laptop chipsets support the combinations of display tech you will have deployed. For us the biggest win for reliability was the installation of high quality USB and HDMI cabling. We have found docks and USB C cables go bad far more frequently than you might suppose. Teachers are actually ok with plugging in an HDMI and USB A cable for the board and a USB-C(typically from a dock) for power. So yes we have docks in most rooms, but these days they mostly provide power only. Some drive a webcam/visualizer/interactivity. We label cables teachers need to touch with a sticker ("no sticker - do not plug in to laptop"). Works really well. Not as pleasing as a single usb-c but literally 1000% more reliable.

Pretty sure this guy came to our site while we were running a beta around the Connect 1 / 2 transition. He may have been more focused on a colleagues re-write of the app deployment manager (which was quite the hit on the RM BBS). Ian Mathias-Baker

We have removed the ace for the group that grants all staff permission to read the census folders.

In general all staff get read only here. Timetabler, admissions, and data team have full control.

FWIW We don't currently have unique accounts for each student, the exams teams just clean things up between sessions, so authentication failure is not an issue. However we have not had an unplanned outage (during school hours) of the authentication system in the last 3400 days or so, and our APs are distributed across switches and comms rooms, and every switch has at least two diverse paths back to the core, which has ensured 100% wireless coverage even with the occasional hardware failure takes out a switch and cluster of aps. Now we are talking about supporting no more than 20 devices under exam conditions. If we had a hall full of laptops and a switch failure, we might not be able to provide coverage. Printing, the exams team collect the scripts onto USB and print them on behalf of the students, who counter-sign them. If we needed to scale up, we would have a dedicated network printer, but the fall back would be the USB copy, and the exam team hooking one of their laptops directly to a printer printer (as mentioned previously this has happened).

I think the Salamander team can't bend the rules in this way because they are all wfh. Also they may well not be prepared to take the risk - I would imagine a compromised salamander account in most schools is a fast track to getting the Domain *and* the 365 tenant comprehensively 0wn3d.

where is appdata? are any office settings (templates etc) pointing to network shares? might there be images (watermarks, headers, footers etc) in the docs that originally started life on the network, it might even be printer/driver related where altering the page layout calls the driver, which in turn tries to make a network call the the printer/server (though I would have thought the symptoms would be way more commonly seen globally if this is the case) perhaps their default printer (or the printer selected for this document) is unusual. Are their any special templates, plugins or macros loading? do any of these have dependencies on your servers - perhaps they are trying doing a repair install or reading a config file? Do you have any monitoring software installed? Could this be trying to phone home or read configuration data and interfering with Office Antivirus software - perhaps the offline files are all fine, but the AV software is getting confused and trying to bypass the cache and reach out to the servers? Might be worth getting a trace from procmon and seeing what word is trying to access?

No? We have MIPs but I don't recall any being used for Salamander. (I've got ADSync on a dedicated IP for historical reasons, but otherwise nothing to do with user account provisioning is on its own MIP). We did have to get remote access authorized though otherwise TeamViewer / logmein etc were all blocked. I suspect that might be the underlying mechanism that enables Salamander to do remote work for us. I have heard others have issues USO accounts and keep the MFA token in the IT office, providing auth only when the support company are specifically engaged (coordinating over the phone / email). I also think/recall that it is possible for 3rd parties to get a special 3rd party account from LGfL and that account be given remote access via the LGfL VPN service - but I don't think I've ever seen that in practice so it may never have made it past the drawing board.

Is that Unique ID a verbatim copy of what you are seeing or merely a representation...? I ask because it begins with the 313373, which is a very suspicious string (it's a variant of 3l33t3). (oops OP was from 2011 - one hell of a thread necro!)

Yonks ago I gave them local AD accounts that allowed them in through our remote desktop gateway. More recently they just use their built-in tools direct to the server, we haven't had to enable their RD/AD accounts for a long while now.

Yep. It just works? We have got Head Teach approval for remote access though.

Much the same as every one else: laptops, examwrite pad, saving locally. We'd shrug off a power outage with no interruption to the candidates, as long as we got power back to charge the laptops overnight. We had a print system failure during one exam. The exams team didn't blink, they just hooked up a spare laptop to a printer, collected the scripts on USB from each candidate (still under exam conditions) and printed them out. Obviously with no power there are no printers, however the scripts would still be collected, and we move to the final paragraph of this post. However, a power failure would take out the air handling units in the sports halls. In the summer months this could make them unbearable within a few hours - so the non-computer based students would be the ones with cancelled exams! Web/online based tests/exams though come with their own guidance for technical failures. In general, as long as the rooms had good daylight, we'd have about half an hour before there would be any technical interruption. Anything much longer than half and hour we'd start to loose wifi/internet/virtual infrastructure and since the technical cold restart can take up to 1/2 hr (assuming no additional failures) it then would be for the exam's officer to make the call. Where an exam is significantly disrupted (for example the students can't complete the exam or the are not able to sign their completed scripts) The we turn to section 25 of ICE. Of specific relevance is paragraph 25.6 "As each incident will be different, advice must be sought from the relevant awarding body as soon as it is safe to do so. For example, where the centre is concerned about the security of the examination(s) or where candidates are unable to return to the building to complete the examination." https://www.jcq.org.uk/wp-content/uploads/2023/09/ICE23-24-Sept23revision_FINAL.pdf