psydii

Aruba IAP’s elect an IAP to be the controller, so are also highly resilient at a lower cost than the traditional controller based APs.

This is how we ended up with an Aruba wireless system. Bought a few IAPs in an emergency, and then built the rest of the network off the back of them! The 315 was the sweet spot for schools when we did it, so the 515 is probably the best long term bet right now, though if budget is tight the 315 is still a damn fine AP.

Last topology change time? If the last topology change is more recently than you'd expect, you can then hunt down which port the election was triggered from, and this helps narrow the problem down to a subset of the network. If the topology change time is unrelated to this issue, then here's a horribly manual way of troubleshooting, but try half-splitting your network when it next happens: Unplug/disable half the inter-switch uplink ports and wait a few minutes to see if it calms down, if not unplug half again, and repeat until the problem goes away - again hopefully you have then narrowed down the problem to a more manageable subset of the network.

Where is the DHCP server for your network? Is it one of your windows servers, or is it the ISP router? Either way, that is probably where the solution lies. Set the DHCP server to hand out the IP address of the DC(s) that have the DNS Server service installed. Then make sure that your DNS Servers are configured to forward DNS to the ip address of your ISP's DNS servers (using DNS mmc ->Server->properties->dns forwarders). To be clear, the DNS entry on the TCP/IP settings of your servers and clients network interfaces must be pointing to your internal DNS Servers (almost certainly one or more of your DCs). Only the DNS Server service should be configured to forward requests on to your ISP's DNS servers.

Watch out if its SIMS since it doesn't allow you to adequately secure sensitive documents (unless you encrypt them with MIP before importing them)

File structure in a Sharepoint site. If you want to be more secure, you can apply Information Protection Sensitivity Labels, and retention policies. https://docs.microsoft.com/en-us/microsoft-365/compliance/information-protection?view=o365-worldwide https://docs.microsoft.com/en-us/microsoft-365/compliance/retention?view=o365-worldwide

Ooh. What does that look like?

I'm wondering too. They get most/all of this via one of the census returns. What is changing is the frequency, and we all know that the accuracy of the live data can leave something to be desired; am/pm always get taken, but they aren't always all in the MIS by the time they *should* b etc. etc. ...and lesson by lesson accuracy is even worse. If we are going to be sending data that we know is not perfect.... linked to individuals... that is a risk that needs to be addressed/documented. Do census reports send LAC details to DfE or is it anonymised? This new arrangement it is not anonymised.... so if that is new I would say a DPIA should be completed just to show you've been through the arrangement and checked everything.

You might be able to get what they want from the data exported: https://docs.microsoft.com/en-us/microsoftteams/expand-teams-across-your-org/assignments-in-teams#bulk-export-assignment-data-outside-of-sharepoint-document-libraries

Just the standard sims client. People who want to use an ipad have to go in through Remote Desktop.

We used group policy folder redirection to a send it to a folder in their home directory. It was by far the largest folder for each user. Despite having enough space (40Tb) I was never happy with this. Now we are using OneDrive, a redirected download folder to ODfB (or any cloud folder) is an *incredibly bad idea* so we let them go to their local user profile, and have it purged when the profile ages out. We encourage the idea that downloads is ephemeral.

sims for lesson reg. For catering, an attendance report filter for those who who have opted in to a meal..? We are a large school and the kitchen team have a good feel for the number of meals they need to provide each day based on their experience. Obviously size here helps, a small cohort makes day to day variation of individuals' choice much more significant.

I'm wondering that if this was only sent to a limited (probably) small number of schools with direct contact details of a director within CMA and this isn't yet in the public domain, we should be careful about how it is talked about. Perhaps BTRD for now?

Remember to take the disks with you, not just your family.

We've been on current here and have been for years. Might be that your users are fine with that. Does mean they get the new-shiny faster. Always a fan of redefining requirements to match the available solutions.

That's good and all, but is the distance between the HDD1 and HDD2 locations greater than the emp/blast radius of a typical thermonuclear warhead targeted at your area of the country?

Veeam is excellent. We've recently started using immutable Backblaze B2 instead of tapes and are very happy with it. If were limited to your internet connection, I'd be tempted to restrict the B2 element to your DCs and your MIS. For reference our DCs use: 2.7Gb/Day and our MIS uses: 60Gb/day (though I suspect this is to do with certain limitations we have around how the transaction logs ar managed). This would take (at least) 7 hrs and saturate your line, but you could enable throttling to maintain a workable line for other systems and processes to use and still have the job complete outside of school hours. https://helpcenter.veeam.com/docs/backup/hyperv/setting_network_traffic_throttling.html?ver=110

Just to be clear, I'm not bashing LGfL. They do what is necessary to keep schools secure on the internet. As I understand it the level of security they have was (I believe) somewhat forced upon they through the procurement framework used (the PCN?) and this did hit some schools quite hard (a decade ago). But these days its its looking less and less over the top and more and more like the baseline as campaigns from NCSC raise awareness and standards. I actually quite like the spreadsheet for making firewall change requests. I have a folder which contains all of the changes we have requested, which is great for auditing and also for finding out wondering *why* something is the way it is. The ACLs on the core switch (under my our control)... less so.

25 years is a reasonable time frame for big infrastructure. Not seen it before on internet lines in schools (though I suspect some of the old RBCs may have been built similarly - but schools shielded from the gory details). Are many of the school being made this offer way, way off grid? This would be a way of levelling up access to be comparable with the metropolitan area networks build out over the last two decades. Curious though, are they really doing this in house, or are they backing off to anyone with experience of building out this sort of thing? I wonder if you might be able to call LGfl/ NGfL for advice in the background to get broad numbers on costs. Though given their current drive, there's a good chance they are the initial service provider.

Similar here but different. First I heard of it was an email from Wonde. Here's a summary of our current status: Involved: Wonde (who sent me an email about it.) Me. (becuase wonde sent me that email) Not involved: SLT MIS team LA Nobody here knows anything about it. All I know is from the email and that schoolsweek article. All very strange. Obviously I'm leaving Wonde on hold until I get some sort of nod that SLT are engaged. By the way you'll need to do a DPIA as this is a new / change to an existing service.

As a 20 year veteran, I appreciate LGFL blocking most outbound traffic. 1) it does exactly what I'd have done if the firewall rules were all down to me and 2) makes it not-my-fault when something doesn't work because of it! Though everything apart from legitimate non http/s traffic tunnelling out via 443 makes this less effective these days. Also for what it is worth, any new app that used MS365 authentication has to be reviewed and authorised by me *BECAUSE* those apps *get access to data* and therefore need a DPIA. GDPR makes the fact that things are generally blocked by default a necessity. This feels like a regression for the teachers, and is in direct conflict with my philosophy of making IT adoption friction-free, but like the port blocking before it, the balance has shifted on this one.

Went down again for us about 3pm for at least an hour. Working slowly at the moment.

That's what I said. *cough*

Assuming that anonymous access hasn't solved it (but it may well have if the address you are inviting are not part of a well established authentication federation) Are they guests from another tenant? Could it be *their* policy that is blocking? Either way, I'd raise a ticket via admin.microsoft.com

Just started loading for us. From https://status.office365.com/ : "Current status: We've reverted the update and completed the manual restarts of the affected infrastructure. We're monitoring the status to ensure impact has been fully mitigated. The service health is improving across the affected infrastructure, but the recovery process has been slower than anticipated and we're taking the necessary actions to expedite this."