Blue_Cookeh

Windows 10 Education 64bit with the latest insider build, and then we have Windows 10 Education 64bit CB on our school machines. To take it a bit further... we've got a couple of Server 2012R2 installs left, most of ours are on Server 2016 now. LTSB is a big no-no in my book

If you're looking into all that (minus Helpdesk) take a look at Microsoft System Center Configuration Manager too. A bit of a beast to setup and get going but it's so good at what it does.

Our DNS forwarders are set to our two AD DNS servers ('Use forwarders assigned by ISP' is unchecked) and we don't have any forwarders set since we want everything to hit our AD DNS specifically. Have you tried removing the Sophos from your AD and readding it now that you've added the new UPN to AD? Also, it might be worth trying to sync all your AD users/group into Sophos on a schedule. Definitions & Users > Client Authentication > Advanced tab > at the bottom 'Prefetch directory users'. Obviously this is a stab in the dark since neither of us actually know how Sophos works under the hood!

That's an odd one - we don't specify a UPN anywhere in Sophos (I'm guessing it finds the user by LDAP address or username), and in fact I did exactly what you have done regarding Office365 a few years ago now with no ill effect. Definitely one for Sophos support!

Thanks guys, those are some great ideas to think about! Power is secondary here, my first concern is finding one that will fit in a standard wall mount comms cab without it falling off the wall

There's dozens of us I tell you! +1 for it though, it's so god damn helpful.

Hey guys, I'm looking for a UPS that will fit into a standard comms cab (weight/depth) and wondering what makes/models you guys are using, if any? Or maybe you're mounting them underneath? Just looking for ideas at the moment since we need some for a couple of cabs of ours. Cheers

+1, they've sold us all our Ubiquiti APs/cabling/switches/antennas, couldn't be happier. We use Ubiquiti and have an AP per classroom, which is vastly overdoing it in our school but it provides a great service for our Netbook and iPad trolleys, just make sure you turn the power right down in the Ubiquiti management software.

If you're looking at doing this widespread, you're best off just doing a full reinstall otherwise you're going to waste a lot of time going round doing Windows repairs after enabling UEFI boot (Windows will have to remake the boot partition and associated files). As far as BitLocker goes you don't need UEFI, or even a TPM with Windows 8.1 and up. SecureBoot is probably worth the hassle nowadays though. You don't need any special version of Windows for UEFI, so long as UEFI boot is enabled on the machine, Windows will set it self up for it during install. @ReadTheNetwork you do need to enable UEFI boot, it's a UEFI option and Microsoft are starting to force people to use it over the old BIOS boot method because it's more secure.

You need a real MDM too, like Meraki or Lightspeed.

Yeah we have a couple of Wi-Fi based Avaya IP phones that can do H323 or SIP if that's something you're after, we had good results extending our Wireless network out onto our field using Ubiquiti sector antennas for this. These are primarily for the after school clubs in summer, though. For our site team we gave them CAT B30 phones and an iPad Mini in place of a laptop. They seem to love that setup. None of this replaced our onsite digital radio setup, though, we still use those all over the place.

I did in-place upgrades on our Hyper-V hosts (from 2012R2) with no issues at all. Now I just need to rebuild my SCCM server... not sure the benefits are particularly worth the hassle.

Have you tried disabling VMQ in the NIC properties in device manager? I stick to Intel NICs since they seem to be the most stable and supported across all OSes, using them with Hyper-V on Dell servers without this issue but when we did have other NICs the link above solved a lot of issues.

SnapComms: Internal Communications Tools : Employee Communications is another fairly decent one.

You'd fix all your problems by deploying an internal PKI. You can deploy your own domain wide PKI and send out the root certificate as a trusted root certificate on all your clients, then use your domain PKI to generate all the certs you need for DirectAccess + clients. You don't want to be faffing around with LetsEncrypt and DirectAccess config every 30 days believe me! There are multiple ways you can do this via OpenSSL and Microsoft Certificate Authority Services. I created a 2012R2 VM (off the domain) that holds our root keys and I use to export CRLs etc as necessary, this VM is kept on a USB stick in the safe, and a backup kept off site somewhere. We then have an 'online' intermediate signing CA which generates certificates for our servers, services, and clients, which is fully domain joined and integrated into AD DS and AD GPOs.

Bingo. I have 4 NICs in our Hyper-V boxes. One for the management OS only on an untagged port and the other three are one LACP trunk in Server 2016. I put that trunk untagged on one VLAN (for VMs without a VLAN tag) and then tag all the other VLANs for other VMs with the tag. I didn't need to do anything in the Hyper-V switch for this, just connect the VMs and either tag a VLAN or don't. You don't want to seperate vSwitches into different VLANs really because then it becomes a pain to migrate VMs between hosts automatically

Once again I'll recommend the Ubiquiti G3 cameras at a hundred quid a go!

We were an all Netgear school for 15 years. The switches never failed us, but eventually the APs started dropping like flies. The Web Management was shockingly bad when it came to VLAN configuration (these were Smart switches mind you, not fully managed) but they didn't really skip a beat in use. That in mind, I ripped them all out and replaced them for HPE/Aruba a couple of years ago. I think we just outgrew the Netgear stuff really since we started adding more and more devices onto our network, needing routing/VLANs/voice etc. I know Ubiquiti's ES switches run a form of Vyatta/VyOS, but I'm not sure on the Unifi ones... they seem a little less managed? maybe to me. I'm certainly interested in them given the price points but I don't know if I'm ready to ditch the HP stuff when the CLI is so good, and the pricing vs Cisco is just right. We are using Ubiquiti wireless at the moment though and have had zero problems.

Lightspeed's MDM looks ugly (IMO) but it seems quick to jump onto iOS MDM features as they become available. For example I still can't deploy Application specific PLIST configuration files with Meraki, but I can with Lightspeed. That alone is a major feature. Also I found that if you're into Lightspeed's filtering then you can do some neat stuff with the built in iOS filter and Lightspeed, even when off site.

Are you seeing a lot of duplication on your photos between staff? It might be worth turning on deduplication if you're on Windows Server/whatever-supports-it. We saw a decrease of around 30-40% space utilised in some cases which helped... a lot.

Amazon Glacier is very cheap to back up to (but quite expensive once or if you ever need to pull data from) if you're looking at cloud options. We're lucky in that we're gaining a new building so I'll be using DPM to backup to a Synology NAS, which will then replicate to another Synology NAS in another building. Another option I began exploring before our building work was having a Wireless P2P link between us and another school a couple of miles away (line of sight), which would have given us a good few hundred Mbps into a dedicated VLAN on their network and vice versa, since we only have 25Mbps FTTC up here. Realistically I found Windows Server Backup to be very reliable, my main issues have been storage and finding a geographically redundant backup with a fast enough connection out.

Ubiquiti G3 cameras are fantastic

Ubiquiti G3 cameras are fantastic

I thought you could add passwords to profiles so they couldn't be removed?

I mean out of those two I'd go with SchoolsBroadband. Yes they've had their problems but they have seemed to solve them nowadays. I think if I were doing our broadband again I'd be choosing Zen Internet and using Sophos UTM for onsite filtering.