psydii

...then it is time to go an add your voice. It seems a change in CEO has derailed the project

https://documentation.meraki.com/SM/Tags_and_Policies/Types_of_Tags_in_Systems_Manager See Time Based tags (and note their limitation - if the device doesn't phone home after entering the time specified by the tag, it won't get the policy linked to the tag) Then maybe drop it into single app mode: https://documentation.meraki.com/SM/Profiles_and_Settings/iOS_Single_App_Mode_in_Systems_Manager

Hi All, Where do Data Managers go for peer support? I know we have a Data Managers group, but that is very quiet. I seem to recall their may have been a forum over on the TES Communities site before they got deleted, and their might be something over on Facebook.... Where should I point our new team, advice gratefully received! P.

Fair enough. These things can be finicky. Perhaps (if you haven't already) it might help to reframe the analysis: How you would handle the same problem if it were in production?

FWIW - we moved from Meraki to Aruba and have no regrets.

Interesting. Ubiquiti being excluded because they don't meet the support level required by the procurement is quite understandable, their business model was never aligned with enterprise/government grade deployments. However requiring >1Gb/s at the wire is a surprise. Once you have a AP under load, do you really get more than 1Gb/s traffic in the air? In all previous iteration of wifi prior to ax, performance collapses after 10-15 devices. n and ac made the huge strides in improving airtime utilization so wifi remained usable at high density for most applications, but raw throughput as measured at the wire would be relatively low compared to the throughput of the AP with only a few devices. Who cares if I get 1 or 2 Gb/s with two macbook pros connected - what matters is how it handles airtime with 30 chromebooks and 30 low-end andriod phones, and a teacher on a 2x2 device streaming Teams. I've not seen any detailed analysis of 802.11ax under load. There was/is lots of analysis around ac. Can ax exceed 1Gb/s with real-world classroom environment loads?

You CSP 'overlooked' that bit. I'm sure if you push them they will charge you for it. There is a "quiet part" here that we can't say out loud.

To push the counter argument: Because a breach of their email account / access to their laptop is much more likely than a breach of the dedicated CP system. Of course mitigations exist (MFA, Screen Lock Times, Information Protection Policies etc) that can make an exchange mailbox safer, but they are not likely in place given the OP's surprise at finding this data was in systems they managed.

It's the DPO's problem. You are aware of it now, but clearly weren't previously aware of the sensitivity of the data contained in the system you manage, so you should brief them, without judgement. Observe that you a migrating to Office365 so if they wanted now might be an opportune moment to change how things are done (or some variation of that based on their response to your briefing). To be honest the DPO should already know where the sensitive data is and how it is stored and handled, so to a significant extent the school (should) have (already) evaluated and managed the risk. Doesn't hurt to review these things from time to time though.

Nothing from the couple of machines I just checked Reliabilty monitor on.... ODC v22.186.0904.0001

A Windows update/ Anti Virus update gone bad? Damaged WMI Repository? Malware giving you a merry chase? Yeah, if you are running 200 servers, they're animals on a farm, not individual pets. It's in the test environment, blow it away and start again. You can keep the vm around in a sandbox environment for when you have time to go deep with troubleshooting, but you might find there are better ways of spending your time. Just be mindful there is a chance it has malware/RAT/persistence so be careful.

It wouldn't surprise me if 802.11ax cell size is smaller and more subject to attenuation than than that of a late-gen 802.11n access point. Can you disable ax and force the APs to ac/ng only? (probably achieved by disabling the MCS 10 and 11 data rates). Pushing all the radio chains at 1024QAM draws way more power than 802.11n radios, so it follows (well kinda, in my mind anyway) that you may get reduced range. Also wasn't Ruckus' main selling point its (to paraphrase) magic aerials that allowed it use one AP when other vendors required two (or three)? That said our 802.11ac Aruba network has 25% fewer aps than our previous (first-gen) 802.11n network, so YMMV. Quick question - do you have your APs mounted on the ceiling or on a wall?

Is there an on-prem server anywhere? Is it possible they are one of the remaining users with access to a mailbox on the server, and has the server (perhaps) had its certificate expire?

We've seen this with 590's stored in trolleys. Basically it turns out the trolleys are too small and the charging cable is pushed by the doors. The department who own the trolley know this and know to put the laptops at an angle so there is no pressure on the cables. Not everybody does this though so if another department demands access via a member of SLT, we often have a number of failures a day or so later as the batteries drain and cant recharge. These laptops are supposed* to be protected, and available only to that one department, but y'know demands of teachers supersede all other priorities and agreements. *by senior management decree, but IT are the villains when we say 'no'. Getting them repaired is cheaper than another trolley full of laptops, so ::SHRUG::

It's important to note that this is a dual core machine. All low power consumption dual core machines are unusable for Windows 10. The Acer TravelMate B3 on the other hand, with a quad core CPU is a great little machine and I would recommend them to people who need a basic *Windows* device, something a little more versatile than a Chromebook, but in the same price bracket. I've even seen them run Photoshop (not particularly well, but better than not having it at all). A lot of good models got really bad reputations through the government programme, because they shipped with dual core CPUs when no IT Manager would have ever chosen that specification. I've got a shelf of HP, Lenovo, Asus devices that are next to useless. We also have some quad core variants of the same models and it is like night and day.

So these were fast low cost, cheap to run and generally reliable. I’m struggling to find a suitable replacement. Time to first print and pages per minute duplex are probably the most important needs for this particular location. But they need colour, and scanning to email capabilities too. Really would love to know what others are doing for their users with similar requirements!

Care to expand on RSAT comment? I was thinking of giving it a whirl, and don’t want to mash my Group Policies. The Hypervisor is part of the security system in Windows 10 and 11. It’s on by default in 11 because it’s needed to protect secrets and block the effectiveness of malicious drivers. These elements were optional in 10, and really the primary difference to 11, turning them on is a breaking change, and so warrants a new public/branding version number.

Has DC01 rebooted? Is it on a different host to DC02? You may have bad bios clock on one of your hosts. Upon reboot, a VM's clock is set to that of the host bios. If this has drifted far into the future, this might cause a problem for a DC because rolling back its clock can cause serious synchronisation problems in AD DS. https://blogs.vmware.com/apps/2020/09/ensuring-accurate-time-keeping-in-virtualized-active-directory-infrastructure.html https://learn.microsoft.com/en-us/windows-server/networking/windows-time-service/how-the-windows-time-service-works https://dirteam.com/sander/2021/01/25/howto-configure-accurate-time-in-active-directory/ And this one might brute-force a fix for you: https://dirteam.com/sander/2021/01/25/howto-configure-accurate-time-in-active-directory/

In my experience, the Head wants the whole school calendar presented 'just so'. Online versions just can't deliver. Also Calendars primarily designed for managing an individual's diary don't scale well when tracking whole organizational events. Online calendars are also not great for planning and coordinating the entire organization - so the data is worked on in (typically) a spreadsheet, and so presenting it in that tool makes sense. I've seen four attempts to move to Outlook/Google Calendars fizzle out - absolutely everybody uses Outlook/Google for their personal diary, and sometimes for their teams' - but planning and reference calendars are always on a wall, in excel or in a pdf for quick reference.

I shouldn't have to, as a systems administrator/operator, be anywhere near an API on a daily basis. Powershell is supposed to expose useful capabilities in commandlets, not require me to read developer documentation to get *anything* done. Of course calling the API directly is extremely powerful, and great that we *can*, but we should not *have* to. Does the Powershell Graph API team have to code their own Email Client and Server, or do they use Outlook/365? That Powershell Graph API adds no value to and admin who has managed to get the hang of calling the API directly from Powershell, really speaks volumes as to what Microsoft think of us. The problem is that it is designed by engineers building a global scale service, however their customers need to get work down at people scale.

I can't help. However I can say that the team behind this have nothing but contempt for those whom they allege to serve. Let me introduce you to a command I stumbled across today: Get-MgDeviceManagementDeviceCompliancePolicySettingStateSummaryDeviceComplianceSettingState Yes that is a 91 character command, and the first parameter name of this command is 23 characters long, and that takes a GUID. Nobody on the team behind this godforsaken monstrosity of a system have ever run a human scale system, nor do they understand why things like Bash and PowerShell exist, nor do they have any understanding of the importance of the philosophical differences between *nix and NT. The team at Microsoft get tools written by past and future colleagues, why do they feel that giving us a thinly wrapped API is sufficient for us to happy and productive? The PM behind this should be given an internet disconnected machine, a kernel, a file system and and a compiler, and told to get on with their job.

Yes. You can sync a SharePoint Document Library or a sub folder and it appears under the Organization's Name at the same level as OneDrive in File Explorer As an alternative can also make a link in your OneDrive to the Document Library so the document library appears as a folder within your OneDrive. (there is a button in the SharePoint Document Library Tool Bar to make this happen)

If you have up to date 365 apps and OneDrive and Windows you absolutely should not do this. So if you use this is a solution to a 2016 issue, as soon as you get Microsoft Apps for 365 and Windows 10 21h1 (or anything on the CB that is currently supported) you should roll this change back.

SCCM / Intune. Also old msi versions can be uninstalled by the latest 365 version: https://docs.microsoft.com/en-us/deployoffice/upgrade-from-msi-version. Strange behaviour accessing document has always been traced back to someone on office 2016 (whose machine didn't upgrade), so there is benefit to wipe and reloading machines, but don't make a fat image - go thin (vanilla WIM) and the have intune/sccm deploy the apps as needed. OneDrive is built into Windows and shouldn't need to be separately managed. We have a few machines knocking around that started life as Windows 7 SP1 with Office 2010 that via 2013 and 2016 have in-place upgraded all the way to 21h1 / 365, and a great many that haven't been reimaged since they first were installed with Windows 10 and Office 365 in late 2017.

We charge based on the class of device. For the large mfds, it’s cost of lease/length of lease/projected pages printer per period. + cost of a4 sheet + contractual per page charge. For printers it’s 1/5 of the capital cost of the fleet/projected pages printer per year + toner-ink per page cost + cost of A4 sheet. We then look at the cost of student printing based on this model, and then roll that back into the per page charges, since students have ‘free’ (but limited) printing, and we need to recover that cost and dissuade departments from encouraging students to print hundred of pages of course material. There is a special group/charging for the two departments whose student need to print large volumes of colour a3. Those departments have to cover these costs. All together this covers all printing and maintenance / replacements in the school. Any surplus is then used by the business manager to support special projects proposals from departments towards the end of the year.