Rogueleeder

I have a Dell Optiplex 7020 SFF (?) running a 9th gen i5 with 32GB backed up by a 4 disk Synology. Running Ubuntu Server LTS with Portainer (though going to move to Dockhand) with containers for: Media Stack Meal Planner/Recipes EBook Server Homaar for a friendly homepage Currently thinking about throwing in an old 1660S GPU for some light LLM to do OCR/Web page scanning to support the recipe container and to re-encode my media to HEVC/AV1 to save storage. Might do home assistant when I can find the resources to make it sort of Alexa like. All backed by a Unifi Cloud Gateway Max, old Unifi 8 Port POE switch and some reclaimed U6 Pros. Also thinking I might build it up again on Debian and merge the NAS and Server into one chassis to save some space in the downstairs cupboard. I did start on Windows Server but since discovering docker and how it sips resources, I can't go back. How come you run an AD Domain at home? Are all your PCs domain joined?

Around 60 Windows Laptops and Desktops all in all Yep made sure that was the case, Chrome installed with the domain set, I assumed it was a conflict with InTune. Spent most of the summer trying to get it working, the only time it worked was if I had the PC completely unmanaged

My only complaint with GCPW is I could never get it working on InTune Devices, the login box would never load properly. Google Device Management for Windows isn't quite there for me yet, I need the ability to deploy apps easily

That only works when all the software across the school is ChromeOS compatible, my IT suite won't ever move to ChromeOS due to the programmes used in the curriculum, the Maths Department staff are the same as they use resources which break in Google Sheets/Docs etc so need MS Apps so have full on desktops.

I've done it the other way round. I had Google Provisioning Entra ID, then used Web Sign In via Intune after federating Microsoft to Google. User signs in and a Google Login Box appears. I did have to use Intune Shared PC Mode on our student and shared PCs to stop Windows Hello Setup, and because its Web Sign In, I'm snookered if the Internet ever goes out. For Assigned Machines I've had issues with MFA just giving me a blank box or saying the person doesn't exist in Entra so I use TAP Codes to setup Windows Hello for people so they can use their device offline. Ironically, we're going to be doing Wonde MyLogin soon so both Microsoft and Google will point to that going forward, though the same is process will apply.

I'm starting to revamp our classrooms and I'm looking for some nice reliable USB-C Docking stations that will work with Chromebooks. I basically need the ability to run a monitor and HDMI projector and 65w charging off it. I know quite a few that work with Windows and Mac, but I'm not so familiar with ChromeOS and Linux friendly docks.

If they don't do Macs, get them to hand you JAMF access, it will make life a lot easier. https://learn.jamf.com/r/en-US/jamf-school-documentation/Active_Directory_Settings Its the Mobile Accounts here you might need, kind of like the equivalent of converting roaming profiles to local ones in Windows

Any reason you aren't on Tahoe? I just got a few M4 models myself and notice the AD Profiles do hang a bit but after about 30 seconds they go through. Are you using the mobile profiles config in your MDM?

I had this issue when I ordered some Mac Minis, first the price went up, then the 256GB Model of the M4s got discontinued. I was about to just scrap the order, but luckily the reseller managed to find me some refurbished ones which I received last week. I'm buying alot of things refurbed these days, Chromebooks are the exception due to warranties, but all my Windows Desktops and Apple stuff is refurb

I don't think you're being unreasonable, I'm going through the same motions with a different provider who has been serving us consistently below 100mbps of our Gigabit line since I got here 3 months ago, who knows how long it had actually been a problem. Our bursar and I sat down last week and reviewed everything and we have given them 2 weeks (its already a 3 month old ticket) to pull their socks up and fix it our we'll be going to a different provider. I've just put in new 10 Gig networking this summer and I want staff to see it actually working rather than seeing the same issues with call quality and bandwidth throttling. TLDR: If you're paying for a service and you aren't getting that service, that's an SLA breach in my mind (coming from an MSP background where we lived and died by SLA)

I got you first one yesterday evening and I have to say I hope there's more to come. Really well written and I appreciate the illustrations

Thats exciting! So it kind of works like the budgets in MF? If so I might have to make the jump this year

I'm using Action1's Free Tier for my Windows Stuff and that's been working pretty well. It's also handling my Patch management too

My predecessor was here for 18 years. I don't fault him for his choices, I've just found over the years that as you point out, the more you clamp down, the more people work around, then you wonder why teacher's and staff digital competency is low. Its because IT didn't trust them, so didn't teach them how to use things. I'll keep my school safe, however my current post is a SEN school, a place of accessibility and inclusion. Seems a bit backwards if the tech doesn't follow that ethos. The shared drive structure, I'll probably rebuild it to make access and ownership a staff issue rather than an IT one. I used to do the same thing with Teams and Sharepoint. It endured people to trust me as I then trusted them with bits of the IT system. The staff here all acknowledge its a mess, probably left over from when they migrated off File Servers, and want help fixing it, I made it clear it wasn't going to be just me doing it (I have no team, just me) To sum it up, its kind of like a cloud migration was attempted, but never finished and didn't have a plan. I'd have done the same Pre-Covid, early in my career, but 2 In House Posts and 2 MSPs have taught me better. I've got a NotebookLM full of notes and ideas, and the beauty of not being a contractor anymore so time is on my side again

That'll be a purchase from me, I could use a good chuckle. To answer your question, my new place I'd say at my current place, its our Google Workspace. My predecessor (I've only been here 3 months) wasn't very trusting of people and sort of Anti-Google so while the network is secure and the onsite Servers are all good, the workspace is a mess of random drives, weird permissions and a structure that isn't user friendly. Basically G-Suite, a product that is designed to be user/self service friendly, was brutalised into being like Microsoft, no balance.

I'm also playing the new Black Flag and really enjoying it on my Steam Deck. I know its multiplayer but I'm also hooked back on Star Wars The Old Republic which I'm just treating as a single player experience which happens to need internet. Love a good BioWare Story and I had only ever finished one of the classes and it runs really well on the Deck with a good control scheme.

Thanks for the suggestions guys. I got it all working. I think I found the issue was I had forgotten my Unifi Controller made a default VLAN which was then latched on my untagged Management VLAN on the Smoothwall which ended up conflicting with the seperate MGMT VLan I had made in Unifi. All working now and I have a very happy 10GB Network.

So I've got some new Unifi kit arrived and I wanted to take the oppurtunity to move from my flat network to a VLAN Structure. End Goal is I want the Smoothwall at the heart of my network with one cable to handle all connections to the Smoothwall I'm struggling to get any clients out to the internet if they are connected to the new VLANs. I have checked the Firewall rules and the VLANs are part of the internal networks. I do get a DHCP address. I wonder if its some sort of DNS issue. I've also tried putting the new networks and subnets into Routing ----> Subnets Would appreciate any advice people can give.

Just a fair warning for Starlink, as its Sat-based and depending on what plan you use, you won't have a proper fixed Public IP and be subject to CGNAT. If any of your systems require a fixed Public IP you may have trouble.

Spent an hour with Stuart this morning, turns out the Box has died so RMA it is! I'll be sleeping better tonight knowing I didn't actually misconfigure it 😀

I do have a ticket open with Smoothwall at the moment but I thought I'd ask here as well. The other evening I was prepping to move our VLANs/Routing and DHCP to our Smoothwall S9 box. During this, despite doing this on an empty NIC in isolation I lost connectivity to the Smoothwall. No worries my failover box kicked in. I gave it the classic reboot to attempt to get the master box to take back over. No luck. I managed to plug into the master box and I now see three of my 5 NICs have question marks next to them instead of numbers. They also list missing device on them instead of the Intel Driver. My failover is running fine and I have unplugged the heartbeat link to it to block any config overrides from the broken master. I have tried a reinstall of the Smoothwall image and restoring a backup to it, with no luck. I was half tempted to use my limited Linux knowledge to run APT Upgrade/Update on it to see if that worked, but thought it might invalidate any support. Anyone seen this before and managed to solve it?

I did Shared iPads at my MSP post, We did Shared iPads with Logins synced to Entra ID. We had Securly Filtering back then though so we could put a Smart Pac file on the iPads through MDM to look at the person's mail Attribute to identify them in filtering, combined with deploying the Authenticator app to act as an SSO agent. Not sure how Lightspeed works. If you have something like this: https://support.securly.com/hc/en-us/articles/360041375734-Filter-How-do-I-configure-SmartPAC-user-injection It could work.

I tried running up a new MDT instance here but it wasn't having it so I'm moving over to a combo of FOG for deployment and then Action1 Free (for 200 Endpoints) for patch management.

That's valid, however my school's staff are looking for something that stops the pupils just using the AI to do their coursework, less of a safeguarding concern here (though its always present).

So in a previous MSP world I worked with Securly Filter which had a function to redirect AI searches to Securly AI Chat for controlled AI usage and logging. I'm back in house now with a Smoothwall so I'm not wanting to overhaul the filtering solution just for AI usage. Is there any product similar to Securly AI that integrates with G-Suite to provide a bit more control on the Student's usage of AI and provides some tracking for teachers to check what students are using AI for?