Blue_Cookeh

Is this something that's actively being pushed forward nowadays? We got FTTC through our school's village a year or two ago but we're so far from the Exchange/cabinet we're still only getting around 20Mbps down from both our ISPs ( @SchoolsBroadband; and Eclipse Internet/KCOM) and it's just not enough to support a school anymore - particularly when we're talking about trolleys of laptops and all day/constant use of iPads. We're pushing more out into the cloud and we have staff that are trying to work remotely more often - as a Primary school we're small but very tech-heavy.

You're not the only one. We took the plunge and standardised on SMART Notebook once again - not ideal because it's so expensive when you're running non-SMART boards (we have a mix of SMART and CT) but they seem to be far more with it. EDIT: there's a change log here: https://download.saharasupport.com/lynx/production/win64/ChangeLog.html?short=1

Don't do this.

Ok lets start with the simple stuff (not knowing how much time you've had to play with it here) When you bring in new machines with SCCM there are two ways you can image them. 1. You need to deploy a task sequence to the "Unknown computers" collection - this is a deployment that computers can PXE boot into even if they are not already in SCCM 2. or you need to get MAC addresses or SMBIOS GUIDs for each new PC and add them into SCCM, then add them into a collection that has a deployment associated with it Have you done either of these? SCCM is *fantastic* once you learn how to use it, but it's certainly a bit of a steep learning curve. Once you know your way around it you'll think WDS/MDT is extremely limited

Hardly surprising... they were far too expensive.

It's a welcome addition - the CAA are trying to let us have our fun but still be safe about it. It's a bit crazy my Spark is about 10g over the limit though LOL I'll be fair, DJI makes keeping within the law exceptionally easy (they mark danger spots on the map and let you set your own height limit in the settings) - it could be worse... I have to take 9 exams, a radio oral exam, and a practical exam for my PPL!

See above

Sorry - we use ASM for any kids with 121 and then "manage" staff accounts ourselves by making them use their school address and redirecting all incoming Apple e-mails to ICT@. @Jamman960 we don't back any iPads up and we don't guarantee the data on them. We don't want them backing themselves up to iCloud/Apple's servers (we actively disable that functionality through MDM). Any work staff do should be stored locally on the iPad and then sync'd back up to the cloud via Office365 (Sharepoint or OneDrive). This means the user can access their work on their laptops too because we redirect documents to OneDrive on staff laptops.

How much control do you want to give him? We generally set up staff iPads without an Apple ID and control everything through our MDM. If they want an application we tell staff to e-mail it to us so we can make it available through the Company Portal (since we use Intune) or push it via Meraki (when we used to use it). This also means the school can buy the app with our budget and make it available for others or get the license back when that user leaves. Alternatively set up Apple IDs through Apple School Manager so you keep control from an IT perspective and the user can still get their own apps.

You can't stop that from happening from within FOG, you either need to stop your machines attempting to PXE boot or find a way for BitLocker to not trigger in that scenario - you're probably SOL and going to have to stop your machines PXE booting.

Usually I've found prices are either within a few quid of each other from different suppliers, or wildly over by so much that I assume they just don't want our business. I have a couple of suppliers we have a good relationship with so I'll often get multiple quotes (from new suppliers and old) then give our usual a nudge if they're a bit out. No figures but just a nudge to see if they can lower them - I'd rather stick with people we know, have used before, and have done us favors in the past for the sake of a few quid here and there, relationships are important I feel - you'll be banking on it when it gets to 5pm one day and need a new switch tomorrow morning or something. For very large deals or ongoing support contracts we'll draw the process out a bit and have suppliers go back and forth to get the best price. We're doing a favour for a local primary school who are moving into a new building with no dedicated IT provision - we had three suppliers (their current IT support and two new ones) go through an RFQ, come up with a plan, then come in and present it to us for that work. We're talking a £50,000 project then something like 5k a year on going support in that case so it makes sense to have them battle it out a bit.

Why do you want to block Search UI? That just makes Windows 10 frustrating for everyone. So long as you've removed administrative rights then tools like gpupdate etc are harmless anyway.

Sounds like a backwards way of doing things nowadays considering the flexibility and easy of management you'd get from simply shoving the system on a different VLAN - at next to 0 cost.

Just installed an EdgeRouter 4 as our internet gateway - seems to be running fine so far. Opted to completely disable the web interface and get down and dirty in the CLI for more control and features. The Edge series run a fork of VyOS if you want to have a play around. Don't think for a second this is a UTM that's capable of replacing the likes of Smoothwall, Sophos, Palo Alto etc. I wanted something relatively cheap, simple, reliable and dedicated to the job of being an Internet gateway though, and it works for that. Our path looks like this at the moment: PC > switch > core switch (set as PC gateway then default route is this point to point to the ER4) > EdgeRouter-4 > SchoolsBroadband (MicroTik/off site filtering) The EdgeRouter is doing our firewalling, policy-based internet routing (two ISPs), QOS for VoIP, routes our public IP subnet and terminates VPN for techs.

Sounds like fishing for work and that you should make your own decisions. Realistically how often does an interface fail? If someone were to cut the fibre then you could get a company in to splice it or pull a new one with more cores for more redundancy. Also if they're suggesting you switch from 1 fibre to 2 trunked copper and doing so would need a new cable run then WTF are they thinking? If you had to run more cable you should be pulling another multicore fibre cable between cabs.

I would VLAN with as little at 10 devices lol - in our school we have roughly 75 computers plus 20 staff laptops, 45 iPads, 10 IP phones and 20 CCTV cameras + servers, APs etc. We VLAN off for stuff like Guest network, security, DMZ (VPN etc) It can become a pain, but it's worth it for security and simplified management - when there's a VOIP problem I know its contained to the VLAN and it's route out to the Internet for example.

How did you remove the apps from your image? Did you use the Remove-AppXProvisionedPackage command?

Suppose it depends what kind of performance you need across VLANs - we do it with our Sophos UTM at school.

Nice to see this sort of thing - anyone know of a Windows alternative? We used to have one for requesting admin rights when I worked for my previous employer but it must have been developed internally

I'd look at the Lenovo X280 personally (or X260/270 if you want to buy old stock/refurb at a huge discount). Built like tanks, reasonably light, relatively small at only 12", TPM, very good enterprise management capabilities. Lenovo support is top notch too.

When you're forcing it on your students, considering they're likely using the standard Windows 10 style at home, it's a problem.

Disagree - Microsoft says a single site server can serve up to something like 10,000 clients - yes you may want to put in multiple DPs but I can't imagine a single school site needing them unless they have satellite sites on the other end of a "slow" WAN connection. We run all our SCCM and MBAM roles off a single virtual server with 4 cores and 12GB RAM assigned and have done for 5 years now. Saying this - we're slowly ramping down our SCCM stuff so that it only does application and OS deployment - we're moving compliance, AV updates etc into Modern Management with Microsoft InTune.

It's not a particularly useful kernel panic - if it's working now you've rebooted I would leave it and see if it happens again. If your server has ILO event logs look in there for things like memory or CPU errors - if you have a spare host then take this one down and run a memtest on it.

Agreed. The days where you have to spend mega bucks for a decent wireless solution are long gone. When I had quotes for Meraki and Ruckus I laughed when I saw the cost, both initial and ongoing. We have fancy dashboards, we have RADIUS authentication and layer 7 monitoring... and it's all open source. Paying £8,000 a year for a wireless solution? What planet are some of these schools on. We could redo our entire UniFi install and keep a few back as spares for that money, and it would last a good 5 years or more.

@SchoolsBroadband is this Friday's new Netsweeper version going to include some juicy features for us or do we still need to wait? Very happy with SB now we've been on NS for a while - it's been seemingly rock solid.