djm968

Not resolving, the other 2 addresses are pinging.

I must be tired too, I didn't realise it was you that posted the same error last year! 😂

Have a look at this -

Bottom line is it comes down to risk. Microsoft only passes the bare minimum data, usually the name and email address which means you will still be adhering to the UK GDPR principle of Data Minimisation.

This is sensible risk mitigation. I've not looked into user accounts for Code.org, but you might be able create student accounts using generic identifiers. For example, Name: Student 01, Email: [email protected]. Then you can tell your DPO: "We are pseudonymising the data and Code.org will only hold abstract strings. This will drastically lower the DPIA risk score.

Code.org isn't registered on the official Data Privacy Framework List for the UK-US Data Bridge and Code.org operates as a non-profit educational organisation, so it doesn't fall under the jurisdiction of the U.S. Federal Trade Commission (FTC), making it ineligible to participate in the data bridge program. UK schools cannot therefore rely on the simplified data bridge and must use alternative safeguards. Your DPO will need to Complete a Transfer Risk Assessment (TRA) as part of the DPIA.

The key question isn't "Is the data going to the US?" It's: - "Is the transfer lawful, proportionate, necessary for the educational purpose, and low-risk given the nature of the data involved?" The ICO does not prohibit transfers to the US. UK GDPR allows them provided the transfer mechanism is appropriate and the risks have been assessed From a privacy perspective, Code.org is considerably better than many commercial EdTech platforms: It is a nonprofit educational organisation. It states it does not sell personal information. It does not run advertising. Much of the content can be used without creating accounts. Student accounts can be configured with very limited information. When schools provide student records, it says it will retain them as directed by the school. Get your DPO to do a DPIA - If your DPIA confirms that only minimal student data is being transferred and you can use pseudonymous accounts, I would be comfortable signing this off with documented mitigation measures rather than blocking

Actually, if you read the guidance properly, it isn’t just “the same old advice reworded to take into account AI.” It’s been shaped by a real case where a school was threatened with the release of inappropriate AI‑generated images created using photos of pupils taken from the school website and social media. As Jobos pointed out, applying the guidance strictly could mean removing a large proportion of website photos. But the key difference here is the risk landscape has changed — this isn’t just about general privacy concerns anymore, it’s about how easily images can now be scraped and misused with AI tools. I do understand the frustration, and the comparison with parents being more relaxed about photos in local newspapers is a fair one. However, digital images on publicly accessible websites are far more exposed, easier to collect at scale, and far more vulnerable to manipulation than a one-off print publication. So while some of the advice may feel familiar, the context and potential consequences are very different now. https://saferinternet.org.uk/blog/schools-given-advice-on-image-safety-to-keep-ahead-of-threat-from-ai-blackmailers

My initial thought is that 41 switches is quite a large number for a site. How big is the physical site? Before focusing purely on the switch brand or model, it might be worth reviewing the overall network layout. There may be an opportunity to rationalise the cabling and centralise some of the switching, which could potentially reduce the number of cabinets and switches required. A design review could help determine whether parts of the network could be consolidated into fewer distribution points, which may reduce hardware costs, simplify management, and improve resilience. If you can reduce the total switch count, it may also make it easier to justify investing in a higher-quality platform that will meet DfE standards and provide longer-term reliability.

This has been grabbed straight from ChatGPT - No idea if it will do what you need, but does possibly contain some useful info on how to capture and import Hardware Hashes Into Intune. 1. Prepare Your Windows 11 Image in MDT You can use: A clean ISO from Microsoft A custom WIM (optional) In MDT: Import the OS under Operating Systems Create/modify a Task Sequence to install Windows 11 Add drivers, applications, updates as needed Ensure the Task Sequence ends before OOBE begins (standard MDT behavior) No Autopilot enrollment happens during imaging—this is expected. 2. Deploy the Image to Windows 10 Machines Boot the Windows 10 devices using: MDT PXE MDT USB boot media LiteTouchPE_x64.iso Run the Task Sequence to install Windows 11. After the deployment is complete, let the computer reboot to the Windows 11 OOBE screen, but DO NOT complete the OOBE yet if you need to harvest the hardware hash manually. 3. Capture Autopilot Hardware Hash You must register each device with Autopilot. There are 3 options: 🅰 Recommended: Capture hardware hash during MDT Task Sequence Add a Task Sequence step after OS installation but before reboot: Add PowerShell script: Use: mdt\scripts\Get-WindowsAutoPilotInfo.ps1 -OutputFile \\YOURSERVER\SHARE\AutopilotHashes\%SerialNumber%.csv You can download the script from Microsoft: Get-WindowsAutoPilotInfo.ps1 This automatically gathers the device hash and places it on a network share. 🅱 Alternative: Capture hash manually at OOBE (Shift+F10 command prompt) Run: powershell -executionpolicy bypass -file Get-WindowsAutoPilotInfo.ps1 -OutputFile AutopilotHWID.csv Copy the CSV to a USB drive. 4. Import Hardware Hashes Into Intune In the Intune portal: Navigate to Intune Admin Center → Devices → Windows → Windows enrollment → Devices (Autopilot) Click Import Upload the CSV hardware hash file(s) After ~10–30 minutes the devices appear in the Autopilot device list. 5. Assign an Autopilot Deployment Profile Still in Autopilot: Go to Deployment Profiles Create a new profile for Windows 11 Assign it to the imported devices (You can use a device group + dynamic membership if preferred) Recommended settings: Join type: Azure AD Join MDM Enrollment: Intune Skip privacy settings, EULA, etc: Yes User-driven or Pre-provisioned (White Glove) depending on your scenario 6. Complete OOBE on the MDT-deployed Windows 11 machine Now the device is known to Autopilot. When the Windows 11 device boots into OOBE: Connect to Wi-Fi or Ethernet Device contacts Autopilot service Autopilot profile is applied Device automatically: Azure AD joins Enrolls into Intune Applies policies and apps

This will export to a CSV file: $Computers = Get-ADComputer -SearchBase "OU=School,DC=domain,DC=uk" -Filter * | Select-Object -ExpandProperty Name $User = "Test" $Results = foreach ($Computer in $Computers) { Invoke-Command -ComputerName $Computer -ScriptBlock { $acct = Get-LocalUser -Name $using:User -ErrorAction SilentlyContinue [PSCustomObject]@{ ComputerName = $env:COMPUTERNAME UserName = $using:User Exists = if ($acct) { $true } else { $false } } } } $Results | Export-Csv -Path ".\LocalUserReport.csv" -NoTypeInformation

Another option is a Dell Micro mounted to one of these, it offers a bit more flexibility with monitors etc. https://www.dell.com/en-uk/shop/dell-pro-micro-all-in-one-stand-mfs22/apd/482-bbeo/pc-accessories

https://security.microsoft.com/tenantAllowBlockList

You can do this using powershell. Something similar to this? $parentPath = "C:\Users\user\Desktop\test" # Loop through each folder Get-ChildItem -Path $parentPath -Directory | ForEach-Object { $folder = $_.FullName # Full path, e.g., C:\Users\user\Desktop\test\25Joe $user = $_.Name # Folder name, e.g., 25Joe Write-Host "Setting permissions for $user on $folder" # Grant Modify rights to the user icacls $folder /grant "$user:(OI)(CI)M" /T }

You can do it free and in-house, if you have the technical knowledge, have a look at this: https://learn.microsoft.com/en-us/sharepointmigration/mm-get-started There are also (paid for) solutions that can simplify the process. https://sharegate.com/microsoft-migration

https://ww3.gloucestershire.gov.uk/schoolvacancies/details.aspx?ID=32931&page=0

At home reading this while recovering from another TIA, they called me a cat as I seem to have nine lives, and I've used 3 of them. Thanks for sharing Andrew, life is too short.... (posting on Edugeek isn't working is it?.... don't tell the wife!)

Have a look at this. https://learn.microsoft.com/en-us/sharepointmigration/how-to-format-your-csv-file-for-data-content-migration The lines in the CSV file will look something like this, and all lines will follow the same structure, with the exception of the %username% variables, these will be unique for each user. \\sharedfolder\homedrives\%username%,,,https://yourdomain-my.sharepoint.com/personal/%username%_yourdomain_com/,DocLibraryName,DocLibraryName_subfolder

Where are the accounts? For AD accounts, you should be able to use a script run as a scheduled task. Take a look at this. /forums/scripts/233031-password-reset-via-csv.html

Have a look at this. https://support.apple.com/en-gb/guide/apple-school-manager/axm200a54d59/web If these are new iPads, the reseller should able to assign them to Apple School Manager for you, you just need to provide your apple Org ID. Hope that helps.

Does your School have a policy that covers School Data on personal devices?

Sharepoint just moves the same problem to the cloud, except it's now a DfE Digital Standards Compliant mess!

Need a bit more information, can you run a message trace to establish where the email actually originated from?

It might be a good opportunity to look into cloud options? You will probably still need a server, but I would be looking at moving data storage and other services to a cloud platform.

Look at it as a good opportunity to have a spring clean.... instruct staff/students to move anything they want to keep from their downloads folder into their documents folder(s) and only migrate that folder. Keep a copy of all existing files shares on-site but make them read-only or only accessible to you, just in case staff realise they've forgot to move something they need, then migrate those files on a individual basis.