k-strider

I did this in the holidays too.... i did have to update my central ADMX policies definitions folder first though to find that setting!

that did happen to mine! when i upgraded in the holidays

can you not use an azure cloud shell to run these? we run all our google gam stuff from a google cloud shell instance

thank you all.. i am in the LGPS so that was a concern as i would be leaving it early probably about 20 years in the pot. the other was holidays i get 43 days off here (inc the 8 bank holidays) which is a lot... which should mean visiting the USA from here would be easy ie 3-4 weeks most summers but the costs are so high we have only managed it a couple of times - that was my concern if living in the USA we would never get home for any period to visit family. Thanks HoyT for the information that is kinda what i was after pay pensions working for the city. Having worked the same job for 20 years i don't have any current industry qualifications just my Computer Science Bsc 2:1 from early 2000s... maybe i should concentrate on picking up a couple before we move (if we do) i think it would on balance be a better place to bring our daughter up which was the incentive to move.... especially if we ended up in a more rural county in a southern state... I do miss Missouri

Hi not sure how many edugeekers are US based but i currently am an IT manager in a small ish secondary uk school students 12-18yrs about 1,100 in total. My wife is American citizen and our daughter is a dual national only 5, we keep thinking about moving... her family is in Prescott Arizona and some in LA as well, so in all reality if we went it would be there.. though my love of the USA is more where i met her Missouri or other southern proper red states... I was curious if similar roles exist in the US working for school districts or even colleges and what the sort of salary would be? - I am fairly certain (after very briefly looking at it) if we did decide to move we can get my green card based on my wife's citizenship so i not looking for the added complication around being sponsored for a green card.. just curios what sort of jobs are there pay benefits... what would be really cool to know is anyone who has worked in this sort of Job here in the UK and the USA for a comparison...

can you whitelist where the cert is coming from so that whilst it is being pushed down to the iPad its not being inspected by the proxy?

We have 3 users in Bromcom and 3 dedicated AD accounts and 3 Dedicated laptops with PIN and Windows Hello for Business... that way negating the need to let anyone know the windows passwords for those cover users.. it also has Passkey setup in Chrome from their google account so that works as the 2nd Factor stopping google randomly throwing a 2FA prompt that cant be dealt with just asks for the windows PIN... Not saying it is CA compliant.. as much as i wanted to try and achieve this... as others have said until DfE work out what they are doing with phones its going to be hard... and we have 1:1 iPads in yrs 7-9 (maybe 11 if they look after them)

Ours is done like this and i always thought it followed the 3-2-1 Onprem (hyper-V VMs &Legacy fileshares) Daily backup to MS System Center DPM 2025. Monthly DPM data is "restored" to 6TB Hard drive i have about 8 on Rotation and the most recent one is stored off site. This will now be shrinking to fit on 4TB disks as less on prem data exists.. I also backup some VMs to Synology but that's just for extra piece of mind Google Workspace Daily backed up to a Synology NAS live on on site at school. Every 2 Weeks one of two alternative Synology NAS are powered on and the Backup is taken then powered down. so there are 3 backups and one always off line Plus the live data which should cover 2 mediums (live Google and Synlogolys) and 3 backups.. its on 3 Synlogoys + Google

That's also interesting.. do you remember what you mean by modern AD CA certs???? i do recall in the past few years changing a lot of the certificate templates on the CA server... for what reason i now cant remember but it seemed pressing ish at the time...

at least i regularly roll the KGRBT pwd and we have had AD CA in place for years mostly for 802.11x had to do a sha-1 to sha-256 update a few years back... and LDAPS is in place too... Still airing on just using 22 for DC again for now

Hi All, i was just wondering if anyone else is in the same boat, we had an Order in place with our Apple education supplier for 170 iPads ready for next year to be delivered in August cancelled on Friday, only to be told we have to re place the order on the new pricing and that anything that was ordered but not delivered would need to be re ordered at the new price, and that it was Apple distribution that has done this not the Authorized Education retailer.. we are now looking at a unit cost difference of over £70. about 30% price hike over the price we ordered at a couple of months ago.

I was just wondering about this, i have 3x 2022 DCs one of which is core, and i recently tried to remove the 2016 DPM client from it and install a newer one for the new DPM server but the old one didn't uninstall (i thought there was an issue as the 2016 client wouldn't take a minor client update for a long time, it would fail and roll back) so for two reasons its time to demote and replace the DC, 1 i really want it not to be a core server and 2 i need the DPM client back on the machine i am going to demote and remove it and then replace it.... as soon as we break up for summer... 8th July for us yeah!!! So naturally you think should I just go straight to 2025 for the replacement DC but the cautious part of me says no just put 2022 on again, and give this issue another year or two before worrying about upgrading the DCs after all 22 has a good length of support left in it... Estate wise everything is win 11 24 or 25 with maybe 1 or 2 PCs Windows 10 on LTSC.

a bit like others, i do now have ipv6 on all my DCs... 3x and it has been enabled since they were at least 2016DCs... my domain started its day in NT4... and been through 2000,2003,2008,2012 etc... and in the beginning ipv6 was either not there or i un-ticked it (turned it off) when i commissioned a new DC then at some point in the past sometime around 2012 -> 2016 i actively turned them all back on because it was recommended and now they are all 2022 with ipV6 on. nothing ever seemed broken before i turned it on or broke since... i guess because i probably turned it on a while ago I'm not sure what a mix of newer DCs would play like if it was off on some or all...

I had DPM 2016 and whilst i haven't in-place upgraded it I have built a new System center DPM 2025 on Server 2025 (with SQL 2022) - and uninstalled the DPM client agent from my servers including 2 Hyper-V 2016 Servers and put the DPM 2025 Client on them and they are all backing up just fine including the Hyper-V workloads just fine. I two was worried about 2016 not being supported in DPM 2025 (reading conflicting docs) but my Hyper-V servers are backing up just fine... every other server that i put the agent on was already 2022.

mavhc i was about to start planning the migration of all our Paxton from our old primary VLAN 10.x.x.x onto their own VLAN 192.168.x.x and i did wonder how the iPv6 gate intercoms and monitors would play.. currently ip4 trafic is routed between VLANs but i was going to prety much over one holiday whole sale move all Net2 Plus controllers intercoms and a monitros (plus windows server maybe - it is domian joined) into the Paxtons VLAN.

I keep looking at the Trend tester line... but given that now we basically have to wire anything in CAT6A i would want one that can verify any runs we do, to that standard - something like this https://www.trend-networks.com/product/signaltek-10g/ but it really isn't cheap and i think i would have to rewire a whole IT room myself to justify buying it... We want to rewire a lot of old cat5e cable that runs AP's that currently are 2.5Gbe and now our switches are 2.5 capable we have odd aps that will not PoE power on unless plugged into a 1Gbe PoE port instead of the 2.5 (until you bring the AP to the switch with a patch cable and it works of course) ... so i would love to test these... at the moment the plan is just to try and rewire them ourselves in 6A and see if it fixes it... we only have a basic tester like you that tells you you got the order right.

you have probably had enough to go on from previous posts but a while ago i UN-federated a primary school from RM o365... we federated them with google (which is not usual) but from memory the powershell script worked through a csv where we use their email address to link them and change the immutable id to (in our case i think to their email cause we were going to google) but i think you could do the same getting their AD GUID... are they the same or are they some how hashed? was the only other thought... maybe if you have a tenant that is already using AD connect you can try and look

ive been in my school for 20 years but i did have to do this about 5-8 years ago i just had to change the pwd and work out what didn't work (which would have been stuff i setup)... then i screenshot everything i hens fixed.... but as others said if too much stuff breaks just change it back until the holidays or the like when you can spend time working it out.... My guess it will mostly like you said be scheduled task stuff on servers... i was looking at my doc the other day it had Entra Sync, Google Sync, Newtrix password expiration they were the things that had the admin creds stored.

we also do this use GPO to add a user to the local administrator group (we used ladmin too) this local admin we also add to the Protected users group... this stops its credentials being stored on the machine so for our techs they can log into a workstation as a local admin but we know the hashed credentials aren't on there and we have never ran into an issue doing this.... I would say though one thing to realize is because these creds aren't cached off line sign in wont work... In fact other than the actual domain administrator account any one you give any sort of local/ domain admin privileges too you should put in the protected users group....

a long long time ago when i can still remember....... our Cert server sat on a DC that was bare metal and i wanted to get rid of... my Cert server is now a VM (started being called CERTSRV2016) now runs 2022 still called CERTSRV2016 i should have just called it certsrv or something like that... - i needed the certificates for wifi computers 802.1x radius atuh via NPS.... all i remember is i was super scared of decommission the DC and bringing the new Cert Authority online... i had worries about DCs talking to each other etc... but everything went really smoothly i think from memory (9 years ago ish) i brought the new CA on did all the GP changes so it started issuing new certs to all the clients (computer certificates DC certs) and when we came to decommission the DC we had already moved the Wifi gpos relating 802.1x over to point to the new CA and everything just continued to work... that is all we now use the CA for 802.1x computer certs for wifi and issuing internal certs for web servers but they are becoming less now that more and more services are cloud based... i think most of the internal certs are for our webmin management of Linux servers or our papercut for printer topup. Now its not on a DC and separate its been in placed upgraded from 2016 to 19 to 22... The guidance was always never install a CA on a DC but back in the day i didn't see it and ended up with that in play.. some of the info from memory about moving the CA instead of replacing it was to do with CRL which made it bad to move the CA off the DC...

Single Academy school here 5 form entery so relatively small school. Servers (2 hyper-v hosts 1 legacy file server) + Physical DPM Server DPM daily backups all vms physical servers SQL dbs - once a month these are "restored" to large HDD for offline storage (6TB is enough for us) Most of our stuff is stored in the google environment i want to say its about 11TB (not at work so cant check from my personal laptop) We backup Google via Synology https://www.synology.com/en-global/dsm/feature/active_backup_google_workspace they have the same for MS We have one NAS on all the time RS1221 backing up google and this is what we uses if we need to restore anything or investigate anything in gmail drive etc. We then have two smaller (4 drive) Synology NASs with very large drives in that on a two week rotation get switched on and manually backup google again active backup for google workspace. this way we always have a NAS with a reasonably recent backup of workspace offline. - it usually takes a couple of days to do this before it gets switched back off. Edit Cost - Synology one off the cost of the NAS plus the drives... DPM part of our OVS agreement so 1 systems center license and 1 windows server license MIS is Bromcom so Cloud based so its not a DB i need to backup... otherwise my DB backup strategy would be more frequent... our SQL only hosts trivial data that would not be a problem if lost.. - with Bromcom since the recent outage we now have scheduled reports that export critical info we may need to our gmail box

thanks Guys that makes everything much more interesting when i get my new Hyper-Visor server

Hi this one i have been thinking about for a while... we currently use Hyper-V and we have Data Center Licenses on our OVS subscription licensed as per the physical server host correctly by core count, which means we can run unlimited Windows VM on that Host. Question can we buy the Data center license for the new host we are about to buy but put Proxmox on it for example as the Hyper visor and still run the windows VMs licensed because of the data center license? or does the host have to run Windows server and Hyper-V to count?

We have a tiny amount of 7th Gen kit left in school maybe 10-15 max and we just installed LTSC on them office 365 desktop apps all work just fine... we are a google school so most work is done in google but some students still use Microsoft word/excel... within the next year we won't have any pre 8th Gen kit left on site anyway as they will all be upgraded... anything odd that is 7th gen or older by 2027 when LTSC falls out of service if we want to use still we will put another OS on it like Flex or some form of Linux, but in honesty by then they will all be WEEE. we just WEEE'd our 4th GEN NUCs last year and Donated our 5th and 6th Gen NUCs to our computer students with Linux MINT on them

so the App doesn't support SSO, you have to use the Magic Link we have ours SSO'd to google but with the App they use the magic link... put the code their email address in then in the email client on their mobile device(the same one that has the Student Portal App on) click the link in our case their school iPads for lower school or their mobile phones if in sithform then that links the Student App to their account... yes its slightly different to the web browser sign in but the informatino they can see is the same just displayed differently.