psydii

Yeah, the lowest cost way for us to run a very similar set of servers was to be double licensed for Windows Client, despite have MS 365 E5.

I keep getting consent requests for an App identifying itself as "tid-azure-common-ad-app-prod" with a reply URL of "https://azure-social-federation-oidc-prod.auth.us-west-2.amazoncognito.com/oauth2/idpresponse" Anyone got any idea what app people are trying to use that is generating these? My guess is that some 3rd party app is using amazon cognito for federated identity - but that isn't much help since it doesn't make clear what app the end user is expecting to be able to use?

iPad in a rugged case seems the most sensible solution to this use case. I agree with @mavhc, if you can wait a few weeks for the new base model to move to usb-c then you will get the longest possible life from them. Likely 5-7 years based on our previous experience.

All teachers have a laptop - they use that for everything, well mostly. Certain activities have a duty rota, for these an iPad is picked up from a central location, and the duty teacher uses that to interact with Behaviour Management, Attendance and CP systems. These duties are corridor or external to the school building so a laptop would be more of a hinderance, though possible in cases where the duty colleague was running late and didn't have time to pick up the duty iPad. FWIW I used to work in a special school, and the teachers all ran their classes from laptops. But in class a Teacher's PC could easily substitute. With laptops / Desktops, care needs to be taken to not accidentally commit a data breach by displaying information from these systems on the class display.

If you suddenly start seeing unexpected behaviour when imaging/re-imaging computers on a domain, the changes in October 2022's updates may be the cause. (also, unrelated, file copy via group policy preferences is broken in common scenarios - a work around is given in the security update web page) https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-38042 https://support.microsoft.com/en-gb/topic/october-11-2022-kb5018421-os-build-20348-1129-115b1147-9568-4924-83b8-d27ab5b495be https://support.microsoft.com/en-us/topic/kb5020276-netjoin-domain-join-hardening-changes-2b65a0f3-1f4c-42ef-ac0f-1caaf421baf8

Still very happy with AMI EasyTrace / Infinity+, no biometrics. Having spare hardware on site though is essential if shipping lead times are too long for SLT's expectations.

If people ask nicely (i.e. the 3rd party refuses to use Teams) we allow that member of staff to install Zoom. Lots and Lots of members of staff can now install zoom. FWIW Teams has had almost all of the same remote code execution problems that Zoom has.

We did a full cross forest domain migration. New usernames for everyone using new automation tools. Took the opportunity to automate Class / Form / Teacher groups using Salamander. We used Robocopy and icacls to move all the files over and swap out old SIDs for the SIDs of the equivelent objects in the new AD. Mailboxes were done via exporting/importing pst - not sure why a mailbox move wasn't used (I ran the 2007->2010 Exchange migration into the CC4 network, but didn't run the Exchange part of the 2010->2013 migration away from CC4) Apps were all repackaged using InstallShield over a period of several months ahead of the migration. SCCM (now MEM CM) was used to replace the device administration component of CC4. However today with the cloud etc, we might make different decisions. (pure Intune rather than Group Policy / MEMCM, ditch the on prem email service, maybe even consider not having on prem AD at all...)

We deploy via the educationstore these days, and seem to have no complaints from the Computing team about that.

Did you set them up 'white glove' a few years ago? You will have to delete them from intune/aad/autopiloy and re-import them. https://learn.microsoft.com/en-us/mem/autopilot/pre-provision https://learn.microsoft.com/en-us/mem/autopilot/known-issues Also the DNS records for device enrollment have changed at some (?recently) https://learn.microsoft.com/en-us/mem/intune/enrollment/windows-enroll

Have faith.. just set of the move via the standard web interface to the library, leave the window open if you want, and then review it tomorrow.

On RTO's - one thing we have put in place when we last went through ours was making the cashless catering system the highest priority service to get up and running after the core infrastructure - we loose thousands a day if it is down. Your local situation may be different. Retention policy: https://www.gov.uk/government/publications/data-protection-toolkit-for-schools https://irms.org.uk/page/SchoolsToolkit Stream of consciousness follows - I'm a bit tight on time to edit this into something fully coherent: Ensure that all assets are tracked. Ensure that all support requests are logged, and ideally linked to an asset/user Ensure that all changes to configurations are tracked (probably through the same system you use for assets and requests) (reading backwards through change requests is very enlightening) Make sure you have a document that tracks the age of each asset, and outlines the replacement strategy. Make sure your manager and the finance team know what assets need replacing over the next 12, 24 and 36 months. Document how you on-board and offboard users. Tie this in with buy-in from Student admissions and HR. Develop an SLA - specially with "time to respond" and "time to fix" metrics. Don't make them aspirational, work with your manager so they understand how long things can take - e.g. if a desktop has a hardware fault, how long would it take to get an appropriately configured replacement onto the desk - We could do it in about 15 minutes after we first confirmed the nature of the fault because we have spares ready to go, but for many years we were not afforded that luxury and so a hardware failure might take a week or two to resolve (waiting for payments to be authorised so parts could be shipped etc etc). Also as a one-man-band, you need sufficient slack in the SLA to be able to attend meetings, and support users, and perform routine maintenance around the site. An SLA of 15 minutes break-fix will have you chained to the helpdesk and you will not be able to maintain the service, nor build the rapport with colleagues necessary to have them onboard for changes. Make sure there is adequate time put aside for training of staff on systems (particularly where change is involved). Make sure adequate time is put aside for your own professional development. Work with middle leaders to understand their needs, and to make sure they understand how and with what you are able to help. If a trend emerges where they require flexibility that jeopardizes the agreed SLA's work with your manager to reach a compromise position.

Its been a while since I did similar, but when I did, somehow I ended up with PFE/CE on the phone.... and this is my understanding of how it should work on Sharepoint online. When moving between libraries / site collections, the browser sends instructions back to SharePoint to begin the move, and then 'monitors' the move. The actual process runs server side. Also for jobs of a certain size (which yours undoubtedly is) the process isn't file by file, but actually similar to how the SharePoint Migration tool works, the job creates a blob in azure storage containing a copy of the original file and all their metadata, and then from there copies that data back out to the destination library, and only then removes the original. I've left jobs overnight and they completed fine. If you are finding it isn't working you should open a ticket with support, and with careful persistence they may tweak somethings to allow the move to complete.

If an OS upgrade is off the table, and you have to get to the bottom of it, make friends with this: https://learn.microsoft.com/en-us/windows-hardware/test/wpt/ It will collect enough telemetry to allow you to see exactly where the system is slowing down, and what it is likely waiting for. This might then point to what is causing the underlying problem. Also... if you don't have the problem in production, but do in the test environment check to see what the difference between settings are in both environments. This trick may help in that regard:

((ParticipantDomains="middleearth") AND (Subject:"The One Ring")) The KQL query builder is our friend.

If none of the requirement of business/education/enterprise for which Windows / AD / Group Policy (and its now long failed competitors) were designed are of concern to your organization, or they limit more than they enable, then unmanaged Windows devices accessing a Linux fileshare might be sufficient. I would suggest that if that really is the case, you don't need Windows at all and, you should go for a pure Google Workspace environment. You could even have Linux desktops then. Though you might want to consider Chromebooks if you organization wants to have mobile devices for students. FWIW I ran a small (120 seat) school on four servers back in 2002. My predecessor had it all on one but we needed to expand to two AD, one fileserver and one print server (which also doubled as the backup server) to ensure reliability and resiliency. We also ran a FreeBSD box for internet filtering email and the website. For Microsoft licences we used the equivalent of OVS back then. It worked well. About 10 years ago they moved over to pure Google, which was absolutely the right decision for them.

Sorry. Perhaps I shouldn't post when I can't give it my full attention.

Use ECP to create a new email user for the HODGE server. Tell Hodge to use these new details to authenticate when sending email. Also enable tls on Hodge.

Better I think to bring over the good stuff, so the money they bring can get better kit, not more kit. 15 years ago we got a fully redundant 10Gb backbone and 50% gig to desktop because we brought over 500 desktops, laptops and 100 Interactive Boards. We've replaced the 'top of rack' switches now, but the core switch remains the same, and the boards we replaced over the summer (20 years old some of them!) Crucially we kept investing in IT throughout the 3 year run up to the new build, so in effect we added £750,000 of value by bringing across our most recent purchases assets. However if 24 months ago we'd been offered a new build, I would have abandoned everything bar the most recent 40 laptops in favour of new kit, because at that point investment in the IT refresh cycle had been 50% below what was needed to maintain a reliable service for four years, and a complete fresh start would have bene better than the strategy we were able to persue 15 years ago. So it the great tradition, it depends But do absolutely get involved in the design stage - every room, every service shaft, every bit of the service - you have to be there when they are discusses and you have to raise suggestions and questions (lets not call them concerns unless they brush you off) with the team and the senior managers of the school - after all you will be left holding this baby once they sign it off. (speaking of which - an agreed spec to be signed of is both an art form and a science - this has to be done well by competent suitable Professionals - you definitely want to get in with them to understand where the compromises are, and also to sense check that their are actually the suitable Professionals for the IT sign off)

If the device trusts the certificate authority, then by design it should trust all certs signed by the CA.

Also this (for a user's perspective of the feature) https://support.microsoft.com/en-us/office/apply-sensitivity-labels-to-your-files-and-email-in-office-2f96e7cd-d5a4-403b-8bd7-4cc636bae0f9

We've got (almost) the whole Defender suite with 365 A5. It does the job and integrates with the rest of the security systems in 365 providing almost a "single pane of glass" for the health of the security of your estate. As well as blocking malware, if you fancy learning KQL you can pretty much find out anything that's happened like "who launched Teamviewer this week. DeviceNetworkEvents | where Timestamp < ago(7d) and InitiatingProcessFileName has ("TeamViewer") | summarize MachineCount=dcount(DeviceName), MachineNames=makeset(DeviceName, 5) by InitiatingProcessAccountName | order by MachineCount desc

True, but some of the stuff shipped was undeployable. They wouldn't autopilot, and wouldn't take a clean Window 10 install, and if left as shipped, were unusably slow just trying to use a web app, we have many of them still on the shelf, I imagine it is this stock that people are complaining about. We ended up loaning out many of our top-tier classroom photoshop-spec laptops to fill in the gaps. That said, we have not tried to claw back any DfE device shipped to a student, and a great many are still in use (with yr 11 and yr 12 mostly).

Absolutely. I ended up with an evaluation/pre-production unit very early on (B3 non-Spin), and was blown away by how good it was. We then bought as many as we could with parental fundraising. They have been the best, and from where I learned not all eMMC 5.1 storage is equal. The last batch of Lenovos have been pretty solid so far too. Anything with 2 cores is trash.

Do we need to stage an intervention, or has there been a renaissance that's past me by?