pcstru

New MAT trust in charge must get another job

DPA says you must protect data by "appropriate technical and organisational measures", so if the server is hosting any personal data it should be physically secure to stop someone just unplugging and wandering off with it.

"Best" is always a dubious word in the context of technology solutions that inevitably involve both compromise (sometimes things will just not quite do what you want) and expertise (how much do you need to make it approach what you want). I'd always be wary of someone who's advice is that a product like Sharepoint is "best" unless they have done a detailed analysis of what is actually required and have then set out in detail how the product meets those. We use sharepoint in school and it can do the job. It is reasonably easy to set up different sites and control who has access to what. If you have good groups set up in AD it will make that a lot easier. On the other hand, technically it is a bit of a monster - very powerful but also huge and time consuming to master (not that you need to master it but it is easy to run into things that suck up time getting up to speed). End users seem to find it anything but the basics quite intimidating so you need someone to put in some effort to mitigate that.

Attached a python program which produces a wall chart style calendar for a given year (can be run from Sept to Sept) in .svg format. Special dates can be fed in via a .csv file specifying the date, description and a colour to use. The code is a little quick and dirty, well - it is python. Uses the svgfig library which is included for convenience in the zip.SvgCal2016b.zip

Security (another surface for someone to attack) and it is just another thing to break! Both are minimal risks if you are competent. We run it here on numerous servers and it has never been the source of a problem.

What was your last one?

Well, our focus groups didn't like the colour. For me it is about reducing workload and maximising the value we get from our data and our systems. A tool like AD bulk users only goes part of the way to meeting out requirement and since it doesn't plug into the MIS, still leaves a stage where someone would be slicing and dicing data. So we have a few powershell functions : Get-DBStudent - Retrieve student data from the MIS and supplies appropriate attributes for home folder locations, OU's etc. Can be used to retrieve one student, a group or all. Check-AD - Checks AD to see if our user exists. We store Admission Number in AD so we have a 1:1 link back where there may be name clashes. CreateStuAcc - Create the Student Account, email, shared storage, etc. NewAccNotify - Notify tutors, helpdesk, head of ICT of the new account details (on bulk runs only one email is sent per tutor, listing all their new starts). So in powershell creating any required new accounts for students and emailing details to tutors should be as simple as : Get-DBStudent | Check-AD | CreateStuAcc | NewAccNotify So no spreadsheets, no manual interventions to set OU's etc and it can easily be set to run automatically overnight. The downside is maintenance, year to year we seem to change the way we structure some pastoral information which always seems to break something. This year there were quite a lot of such changes but actually few changes in the code. Last year we changed the whole MIS system, but just had to re-write the Get-DBStudent part. I do worry about maintenance if (when!) I leave but IMO the code has already paid for itself so the school can just scrap it all and it will still have been valuable.

Why a HOT-SPARE Hard Disk is a bad idea?.

It is possible to play cripple Mr Database using only select statements and it is reasonably easily done by someone with very little experience or even by someone with a lot of experience. This is part of the reason why even SQL queries should not be developed on a production system. The problem with this is that even being good at SQL will get you nowhere until you know the database schema and knowledge of the DB schema will be almost utterly useless outside of education. I've reverse engineered CMIS and Bromcom databases and have direct experience of SIMS (and bizarrely One) but it's wouldn't even appear on my CV unless it was a job in education or a supplier to education. It can also very time consuming, so you need to get a lot of value out of it before the investment is actually worthwhile.

That wouldn't be much help to people like us who use a different MIS.

Oxford University Press provides the most abysmally awful user management features in their Kerboodle product and they obviously want to squeeze as much profit from that little baby because despite complaints, they have failed to address their issues. This script looks to avoid the situation where the entire import of students from a csv fails if any one student is already present on the system. If you find this script useful, please do not send me thanks, money or cake but DO call up OUP and spend a few minutes complaining about their inadequate management tools and persuade your schools to spend their money on better products. # --------------------------------------------------------------------------- # Script : KerboodleReconcile.ps1 # Author : P.C.Structures # Date : Sept 2016 # Notes : Reconcile MIS and Kerboodle student data and generate a file which # the idiotic, imbecillic, utterly appauling Oxford University Press # were too flumping moronic to provide. # # Input files are CSV and expected to contain header columns named # as: # # Surname # First name # Admission Number # Year # Email address (optional) # # Process: 1. Produce export from kerboodle. # 2. Produce export from MIS # 3. Run this. # 4. Upload OUT_File to kerboodle. # --------------------------------------------------------------------------- $MIS_File = "c:\tmp\bromcomkerboodle.csv" $KER_File = "C:\tmp\Kerboodle\KerbExport.csv" $OUT_file = "c:\tmp\KB_Upload.csv" #---------------------------------------------------------------------------- # Generic Multi level hash builder. Pass hash and array of node keys. Leaf # nodes are created as simple markers (integer = 1). All array elements are # created as hash keys. #---------------------------------------------------------------------------- function AddToHash { Param ($TheHash, $Keys, $level=0) $level=$level+1 $key=$Keys[0] $sle=$Keys.length - 1 if( $key ) { if( ! $TheHash.ContainsKey($key) ) { if ($Keys.length -gt 1) { $tmpHash = @{} $tmpHash = AddToHash -TheHash $tmpHash -Keys $Keys[1..$sle] -level $level $Thehash.Add($key,$tmpHash) } else { $TheHash.Add($key,1) } } else { if ($Keys.length -gt 1) { $tmpHash = $TheHash.Get_Item($key) $tmpHash = AddToHash -TheHash $tmpHash -Keys $Keys[1..$sle] -level $level } else { $TheHash.Set_Item($Key,$TheHash.Get_Item($key) + 1 ) } } } $TheHash } #---------------------------------------------------------------------------- # =========================================================================== # Main # =========================================================================== $MIS_Hash = @{} $MIS_Data = import-csv $MIS_File $KER_Data = import-csv $KER_File $OutArr = @() # Build a hash of students in Kerboodle export with Admission number as key foreach( $Student in $KER_Data ) { $MIS_Hash = AddToHash -TheHash $MIS_Hash -Keys @($Student.("Admission Number")) } # Check if student is already present in kerboodle, if not we want it for the out # file foreach( $Student in $MIS_Data ) { if( ! $MIS_Hash.ContainsKey( $Student.("Admission Number") ) ) { $OutArr += $Student } } # Spit out the CSV $OutArr | export-csv $OUT_File -notype # ===========================================================================

Objectively? (ish!)

I'd think that depends what you think a dictionary is. Most modern dictionaries are descriptive not proscriptive, so you could look at them simply as documenting how words are used rather than how words must be used.

Ah, you want the full list?. This sounds like focalism/anchoring; which can be incredible useful in everything from selling a house/car to asking for a pay rise. Exotic & outrageously expensive hi-fi exists mostly for this reason (I'll cut those nautilus speakers some slack but even so).

We put in real names (firstname, lastname), tutor group (dept) and admission number (employeeID) in as standard. Display name is the login, which for us is .[surname][initial]. Description is sometimes used for messages "check with PCS before re-enabling account", where students have ... err ... transgressed.

Just desserts, deserts BBC. Shocking!

No. Well, not a 'cheap' FDM machine. A powder sintering machine would be good for figures but the figures tend to have many overhangs which for FDM machines means printing a lot of scaffold material and post printing clean-up of the model. You would be far better investing your time learning to 3d model and then having someone else do the printing (so you model a nice Troll and then get paid every time someone asks shapeways to print it).

Well ... I ... ummm ... errr, I'd lit my little wood burner [*1] and had sat snug with a nice glass of wine and I have to admit, I felt the tears well up. Films occasionally do that to me (and I find it terribly embarrassing when they do) but always by manipulating me via the music. It's a testament to the power of the drama they got me without pulling that trick. On the other hand, as a loooong time listener, I'm glad this story line is coming to an end (assuming it is!). [*1] My 'snug' gets no sun and little enough light so is nice and cool in the summer heat but needs heating long before I turn the boiler back on.

Yes, but did you cry along?

That might depend on what is happening in front. If you brake for no reason (the kind of thing people sometimes do to deter tailgater's), you might be driving without due care or you might be driving dangerously. Police that observe that situation will likely pull the driver braking, not the tailgater. Not saying that is what happened here, but just because someone runs into the back of another car, does not automatically mean they are at fault (there are people who have been convicted of insurance fraud for effectively getting people to run into the back of them).

If you can do that, then IMO it would be the best way. I'd be reasonably confident that I could hack pfsense and a separate DB with user credentials together with fairly minimal effort (2 scripts max) so it might fit the bill as a solution but if you can use AD then you can skip such hacks altogether.

I think if I was trying to do this I'd look at pfsense's captive portal, which has a local user database option I could tap into. That way I'd just have to write a script (or two) to export from your MS SQL user tables into the pfsense tables. It would need some configuration at the network side (routing/VLANs) but I'm not at all clear how your staff and students are logging into the PC in the first place and what is authenticating that (local or if not what), so I might be barking AND up the wrong tree.

Me too. BUT, I would entirely understand why. I'd recommend a slightly different approach. At interview I'd ask about flexible working as a very general question, simply "Do you do any flexible working" [*1]. I would not go further than that. If they say no, then negotiation is not going to be possible so your decision is simple. If they said yes, then if the job is offered, you can have a conversation that does link back to an enquiry you have already made so it is less "out of the blue", more "ok, you said you could do this so would you consider". [*1] - The correct answer should always be "Yes", since DDA requires an employer to make reasonable accommodations but that may or may not help you.

Another suggestion is not to allow generic logins for generic email accounts (the logins lack the accountability you need) - the enquiries@ etc. Give permissions to those who need to access them and use Outlook or OWA to give access to that mailbox.

Set throttling so any user can only send so many emails in any given period. That will limit spammers should they get in. We also set limits on the number of attempts that can be made to login before logins are blocked. That limits the ability of hackers to brute force their way in.