psydii

Two intermediate certificates have expired in quick succession. Causing some knock on effects. https://twitter.com/gossithedog/status/1443348554131644420?s=21

Did you try this:

Wifi goes split-brain if parts power up while spanning tree hasn't converged. Its a feature, which is only a problem if there is no layer2/3 connectivity to the core - a very rare occurrence, but guaranteed if we have a site wide power failure of more than a couple of hours. Workstations power on in seconds. The Servers take many many minutes starting with the SAN, Core Switch, ESXI Hosts, VMS (DCs first, and only after they are up start the rest of the servers).... The trouble is that people don't wait - if they see a logon screen, they logon. a full cold restart takes a long time, and people will just start using things as soon as they look ready. I suppose we need "once the core servers and switches are all up, disable PoE across the network" and "Once PoE is disabled on all ports across the network, re-enable PoE across the network" as two steps in the playbook for this scenario.

Could be a quality control problem caused by the pandemic. I've put HP/Aruba into every school I've worked in in the last 20 years. The trouble with HP/Aruba kit is that once you've got gigabit kit in, there is no reason to ever upgrade. So many of us are running on 5, 10, even 15 year old hardware and it is just great, and so have no experience of the newest kit. In this situation I'd be tempted to reach out to an HP partner (SwitchShop were my go-to when I needed speculative help) and see if they can hook you up with an HP Rep who can dig into this for you.

The Fridges, the freezers, the servers and core switches, the alarm system, the boilders/pumps, the wifi. It depends on the scenario. short power cuts - keep the servers, wifi and phones up. Longer powercuts the fridges and freezers become more important along with the alarm system. Multi-day powercuts - if you can also power the boilers/pumps to keep the heating on then potentially you can keep the site open. If you have power for that then you probably also have power to bring the servers up. You also probably need a generator for that. As @jmak alluded to, I was however thinking more about the potential around regular extended regional power outages and IT. How do you handle the shutdown and restart of services? Last time we rebooted the servers it took the best part of a day to shake out all the long-tail problems. Basically, if endpoints boot before the core infrastructure is ready, there are problems. Given the san, the hosts and the vms take a sweet while to go from cold to running, phones, desktops etc are left in a sub-optimal state. Also switches boot at different speeds so bits of the wireless come up and assume one state, while those that power on later assume another, and they all need another reboot to bring them into line.

For those who don't know, JMS has been amongst other credits, a/the writer for Murder She Wrote, She-Ra, The Real Ghostbusters, Thor (MCU), World War Z and Sense 8, A few months ago he publicly reached out to the beeb as he was interested in the DW job. He quickly reported back that the Beeb already had a short list and it wasn't something he would be pursuing. At the time I worried that the beeb was making a mistake by turning him down. TBH I still kinda am. To speak to the topic though, I tried re-watching B5 recently, and much like STTNG I really couldn't get past the early episodes. 33 they are not. I really hope this reboot brings the benefit of the advances in story writing and production values that we've seen in Galactica, Marvel etc. over the intervening decades.

They might be available via archive.org?

Apropos of nothing, have people considered how they might handle significant levels of powercuts? I'm really aiming this question at people who run systems in places where power cuts are rare and usually short. What if they became frequent and long term? I'm not sure we've fully powered down the server room since 2009.

Linus (of LinusTechTips) complains about this most episodes of WAN Show. Never seen it happen myself.

https://www.arubanetworks.com/products/network-management-operations/instant/ looks like they are rebranding/repositioning the line to compete with meraki et al. When we bought the IAPs, Central was very much an optional extra. Probably still is if you speak with the right people. https://www.arubanetworks.com/products/wireless/access-points/indoor-access-points/510-series/ (if you scroll down to the specs under 'minimum operating systems versions' you can see InstantOS listed.

"Instant On" is a completely different platform to "Instant AP" and the old ProVision heritage kit. But yes, last time I checked IAP were limited to 125 in a cluster - but that is plenty for most schools. If you need the additional features you can always add ClearPass and/or Central (or even AirWave if that's what you want)

open the csv in excel. do to the data tab click text to column button use / as the delimitator. Then spilt again on a suitable delimitator to isolate the username.

We've got nearly 100 Aruba IAPs for nearly 2000 users (around 1000 active devices per day). Works fine. No ongoing licences. No dependency on servers, controllers or cloud. HP Limited Lifetime warranty.

Excel, split the url (text to columns) One of the columns should be the username assuming you have the samaccountname or the upn matching the 365 username / email

Looking at backblaze here. https://www.backblaze.com/business-veeam-backup.html

Well its nearly 2022 and ClassCharts still don't have the option for Students to log in via 365 / Google. Frankly ridiculous. I totally get that a pin code is great for on-boarding students from schools that haven't worked out their front from their back, but we've been through a period where pretty much every school has onboarded to one of those platforms. We had all our year 7 and 12 logged on to 365 back in August - and now have had to double that onboarding process to get them into Classcharts. We're busy. If we set up single sign on, its because we don't want to spend three weeks issuing and supporting separate authentication systems. TBF its the admin and pastoral teams that do most of the heavy lifting, but its lifting that shouldn't need doing. :grumpy:

That looks like your on premises Exchange server is bouncing it back to SWGFL's servers. You might want to check on your side what is happening.

The CLA has a new online platform for sharing excerpts of digital version of books and magazines directly into Microsoft Teams and Google Classroom. Wonde has just dropped us a note to say they can provision staff accounts automatically.

The HP 1910-48 is in fact the HPE A5120-SI with restricted UI. Should also be more than capable of handling the traffic. The only potential limitation that it is possible to hit (but only in the largest of schools) is the mac address limit of 8000. The Aruba 2920 has a 16000 mac address limit (and by the by, not that it is relevant here, so does the A5120-SI's big brother the HPE-A5120-EI). That said the 1910 is quite old now, so it might be feeling its age?

The Aruba 2920 is a beefy switch and more than capable of handling VOIP and data. Probably worth looking at the link to that other switch, both physically and have a peek at the traffic flowing over it - perhaps is becomes full momentarily? Does that switch have a 1gb+ uplink to the rest of the network? Is broadcast storm conntrol / traffic limiters configured? The ping test would be a good place to start. I would add pings to each of the switches in the chain, and also your FW and DNS servers - just to see if there are any co-incident issues.

This might help, after the first script block there is a script to remove teams for all users. https://lazyadmin.nl/powershell/microsoft-teams-uninstall-reinstall-and-cleanup-guide-scripts/

We had similar with another provider. So many variables in the mix, but the VoIP provider were confident it was a local network problem. One day I caught a switch misbehaving - packets just stopped flowing for a few minutes. Nothing in the logs and no NMS alarms to indicate there was any problem - just devices on that switch couldn't get packets in or out for a bit. Swapped out that switch and the problems went away. Swapped out other switches that had the misbehaving phones and those problems also went away. Really irritating. (but luckily we were in year where switch refresh was in the budget) I should say that when we first had problems it was also a local network problem - a link port would occasionally flap for a minute and cause spanning tree recalculations. Most devices didn't exhibit noticeable issues, but the phones in that part of the network would drop. That one was easier to spot.

Draft training materials for Server 2022: https://techcommunity.microsoft.com/t5/itops-talk-blog/az-800-study-guide-administering-windows-server-hybrid-core/ba-p/2736091?WT.mc_id=modinfra-39512-orthomas https://techcommunity.microsoft.com/t5/itops-talk-blog/az-801-study-guide-configuring-windows-server-hybrid-advanced/ba-p/2742508?WT.mc_id=modinfra-41943-orthomas

Long long ago they white-boxed Chantry Networks kit. It was awesome (third to Cisco and Aruba at the time). They had really good education pricing at that time. Siemens then Enterasys bought Chantry and Extreme went their own way. Extreme then bought Enterasys and seemed to move back to the Hi-Path/Chantry Wi-Fi platform. They now have the patents from two of the oldest wifi startups, but how that translates to the world of wifi6... who can say. The transition to 'n' did for some, aerohive struggled in the move to 'ac', and here we are at wifi6... Given their history I'd probably choose them over Fortinet, but it really depends on who is running the division and how much talent they have been able to maintain and develop over the last 10 years.

AMI/EasyTrace do a good job for us with Infinity+ I think the trick is to not expect anything fancy. We do not use any biometric options, because there lies a can of worms we don't need to open. You can build a till for less than they charge - but then its your problem, so just buy it from them. We've decommissioned all the cash loaders, so the quirks of mid-noughties IOT kit no longer haunts us. It pulls data from SIMS and Parent Pay. It writes back to both, it provides a central database of all ID Cards which we can pull (or pay AMI to automate) for other systems. It tracks what kids are buying, and reports are available to Finance. It basically never breaks - unless the admin/finance team have shirked doing their administrative house keeping tasks for a year or two. Pretty much the only problems we have had in the last five years have been self-inflicted. When we have needed support they have been pretty* responsive (*compared to how things were 7 years ago), but don't expect 15 minute response times, and at the busy points in the year (e.g. September When many school's poor house keeping has caught up with them), it can be a few hours before you can get help. I would recommend never launching near the start/end of term. I would also recommend ensuring that the staff who administer the system have the full training, and that they schedule in time to complete the administrative tasks required to keep the system operating smoothly. Year end and New academic Years particularly. As with any system that pulls data from the MIS, careful co-ordination between the teams that run end-of-year processes is required.