colly72

Welcome to the weird and wonderful world of IT in education.

You can but it will then keep reinstalling any Android app when each user logs back in.

Android apps in particular present a problem with shared Chromebooks, as they install per user, so will quickly eat up and local storage if you have a few Apps and a lot of users.

Stating the obvious but just be aware of device-based OUs vs User OUs and the settings in your Gsuite device management https://support.google.com/a/answer/4352075?hl=en

Aruba/HP switches here. We tag the VOIP vlan and untag the PC VLAN.

We use Sophos Central here and I love it. For me, it's much easier to use than the old Enterprise Console - it's really simple to create and apply policies to different groups of users or devices. I'd agree with @Achandler about it not being so easy to identify if a computer doesn't have it but you can use Group Policy to push out the install.

ManageEngine do a free one for up to 25 devices, plus they also do a refer scheme, so you can get up to 75 devices for free. I'm using it here. If you want an extra 10 free licenses, pm me your email address and I'll send you a link.

I'm wanting to do the same thing, so we can smoothly migrate to XG. I asked a similar question on the Sophos Community some time ago - not sure if this is what you want to do also but my plan was a non-starter due to asynchronous routing issues: https://community.sophos.com/products/xg-firewall/f/sophos-utm-to-xg-migration/110325/running-xg-alongside-utm

Basically, you create a campaign based on either phising, credential harvesting or luring an end user to open and email attachment. You can then choose the type of attack - there are lots of templates to choose from, from Paypal, to Barclays, Currys or HMRC etc etc, which you can tweak and customise if required. You then choose a training modules (videos, quizzes etc), that any user who get's caught is enrolled onto. You then choose your users or groups of users from your existing Sophos Central account, to target the campaign and schedule when to send it. Once sent, you can view stats from the dashboard, to see who's opened the email, who's clicked on links etc etc.

Spiceworks cloud, or Freshdesk both work well and we've used in the past as they are free. Also used Netsupport Servicedesk too previously, which works well although not cloud-hosted I don't think.

We paid around £530 ex VAT for 110 users, for 21 months (strange I know but this brought it in line with the rest of our Sophos licensing).

We've recently signed up for Sophos Phishing. Can create campaigns then target automatic training for all those who get caught. Works well and is quite cheap.

+1 for Chrome Remote Desktop - https://remotedesktop.google.com/home Free and simple.

Hi all, Heads up for an issue with the latest round of MS updates on devices with Sophos endpoint installed https://community.sophos.com/kb/en-us/133945 https://support.microsoft.com/en-gb/help/4493467/windows-8-1-update-kb4493467 (Security-only update) https://support.microsoft.com/en-gb/help/4493446 (Monthly Rollup) https://support.microsoft.com/en-gb/help/4493448 (Security-only update) https://support.microsoft.com/en-gb/help/4493472/windows-7-update-kb4493472 (Monthly Rollup) https://support.microsoft.com/en-gb/help/4493450 (Security-only update) https://support.microsoft.com/en-gb/help/4493451/windows-server-2012-update-kb4493451 (Monthly Rollup) To summarise, don't install the updates if you have Sophos endpoint, or if you have, remove before rebooting.

Hi all, As you may know, ManageEngine do a great MDM solution, that allows you to enroll 25 devices for free. I've seen today, that using their referral program, it's also possible to get an extra 10 device licence for free, for both parties, up to a maximum of up to 75. If anyone wants an invite, to benefit from an extra 10 free licences, please pm me with your email and I will send out the invite. No catch as far as I can tell! The link below gives more info on the scheme: https://www.manageengine.com/mobile-device-management/refer-and-earn-licenses.html?mdmod&did=649005701

WD are pretty much rebadged Sandisks - never had any trouble with either. Crucial have always been good for me too. Samsung seem excellent but always a tad more expensive. I'd go for a minimum of 240GB - we've had problems with some older machines with 128GB ones that filled up with cached profiles pretty quickly.

+1 for Zen. We've had a leased line with them for a long time now and ADSL before that and never had any problems apart from when a contractor dug through the cable on a Saturday morning. They still had it all back up and running by Sunday evening. Would definitely recommend.

We're on 9.601-5 - no issues here. Like @mark100, we used to have the odd drop out with the http proxy restarting but that was quite some time ago.

We use Firefly and are largely happy with it. It is expensive but for us, coming from a SIMS Learning Gateway/Moodle/Staff Intranet environment, it was a good way of us consolidating all our platforms under a single pane of glass. I'm not sure how we could publish reports to parents re MS Teams/Google, although I agree they are excellent products. If we were purely using it as a VLE, then I would agree, it's overpriced.

If the catalog becomes corrupt, wouldn't you lose all the non-destructive changes made to any images?

This is one of the workarounds. A NAS drive capable of ISCSI could do this but apparently performance is poor, then we also have the issue of backups etc.

It's also held back by the fact that Adobe don't allow catalogs to be stored on network locations for a very specific reason - corruption. Any solution becomes a workaround and you therefore end up accepting the inherent risks associated with that workaround. From what I read, although the SUBST option works, there is a real potential for corruption, should the connection drop. Another option, of having an external drive is prone again to corruption should the drive be removed but then there is the issue of backup too. My response to our SLT and photography team so far is that why should we introduce a workaround that might work today but fail tomorrow and cause more problems than it solves in future months? Our photography department keeps telling us that its the industry standard used in businesses and universities bu they don't listen to the valid reasons why we can't do it. Perhaps I should implement the workaround then when it goes wrong, I can just say "not my problem"!

We have the same issue. Photography department are pressurising us to make Lightroom available but there seems to be no sold way of getting it to work well in a networked, multi-user environment.

We considered this, including the implementation of docking stations in classrooms. In the end, teachers were wary of not having a dedicated classroom PC, or things not working properly at the start of the day etc, so we ended up just replacing and leaving PCs "in situ". Nice idea in practice but I think support calls would increase (at least they would where I work!).

We've had a BYOD policy for the last 2-3 years, using a Meraki wifi network. We have a segmented VLAN, which we use to split the BYOD devices from the network, with isolation enabled so they can't see any other devices. They authenticate with our Sophos UTM using browser authentication, then we filter/scan as we do on our LAN It works really well but....... My advice would be to avoid BYOD. We've found that it's very difficult to monitor and control what the students are accessing on their own devices. From a pastoral/safeguarding viewpoint, it's a problem. It's also difficult to have consistency, with students using a combination of devices. We're now looking at school-provided Chromebooks that we control, to prevent these types of problems. Best of luck if you do go ahead with it.