dhicks

We have our remote desktop server behind a Cloudflare Zero-Trust gateway, with authentication at the gateway level via user's (2FA-protected) Google (or Microsoft, etc) accounts. That tunnels straight to the application server (in our case we're using Guacamole to present the web-based remote desktop) rather than forwarding port 443 from your firewall. Admitedly, probably a bit pricy for more than 50 users - a couple of other similar services are available (ngrok, possibly Tailscale) that might be a bit cheaper.

Ah! Forgot to add: our Sports department uses Squad In Touch. That seems to work well for them, I don't think we've had to help them set up / configure anything.

Surely you can't be serious?

For actually-important information regarding children (medical information, exams information, etc) we communicate via our MIS (iSAMS). We tend to use its send-parents-email feature rather than have parents use the Parent Portal app as that can be a bit clunky. Their email system works well, with good deliverability, sending emails via SendGrid's transactional email API. For less-important stuff, we tend to put information in a newsletter. We were sending that newsletter out via a Mailchimp mailing list, synced with parent contact information from our MIS, with Mailchimp handling unsubscribes and so on. I think the marketing department have now stopped using that mailing list, I think they're just publishing the newsletter to a URL on the website.

Ah, good point, that sounds familiar. I've seen that in other APIs, I think they're using a standard tool to create the API (Swagger?) and documentation (complete with handy test environment), which makes sense.

Sorry, I haven't looked at the Wonde API recently (although I keep meaning ot get back to it), but they might be expecting you to step through page-by-page until you are returned 0 records / an error / an exception of some kind so you know you've hit the end.

We use the hosted version of iSAMS, so we don't have an on-site server and, therefore, don't have direct access to the SQL database behind it. iSAMS' "batch" API is quite good for extracting data - it's not an REST API (that's a separate thing in iSAMS) where you have multiple endpoints you can call, instead you define the data that gets exported for a given API key in iSAMS and then the calling application gets that data in XML format. We have scripts that get that data and process it in various ways (we use data from iSAMS to create users, for instance) - mostly that data gets written to various CSV / XLSX files for end users to use, but we could write it to an SQL database if wanted. I've used PowerBI a little, and been quite impressed with its features, but if I was aiming to process data from iSAMS (and/or combined with various other data sources) I would prefer to extract the data from the various sources into common storage (probably an SQL database fo some sort), then build reports using a Javascript front-end that could be served by a simple static web server, making it possible to more easily distribute to end users, including parents.

It sounds like they have a working TV that has, at least, a VGA input - it might also have an HDMI input. In which case, all you should need is a NUC-alike mini PC (£160-ish on Amazon) and an HDMI-to-VGA converter cable (£20?). £30 for a ChromeOS management license if you're using Google Workspace, otherwise maybe try a Linux distribution set up as a kiosk that simply loads the BBC iPlayer page. I have a script to set up Raspbian as a kiosk machine: https://github.com/dhicks6345789/device-config That hasn't been updated for a while and might need a bit of tweaking.

We run a couple of (Panasonic, I think) 75" TVs in our front lobby. They've been on probably 12 hours a day for the past couple of years with no problems that I can see. Around £600 each from Amazon. We have those plugged in to ChromeOS machines - small NUC-alikes reformatted with ChromeOS Flex and joined to our Google Workspace so we can manage them as kiosk machines. Under £200 each for hardware and license, assuming of course you use Google Workspace. Both the TVs and ChromeOS devices are on simple digital mains timer plugs, they get the power cut at 7pm and come back on at 7am.

We've just replaced our all-in-ones after 7 years. The old machines were still usable, and were taken by a charity which re-distributes them, they take anything under 8 years old, so our 7 years usage out of them sounds about right. "All-in-ones" here meant both some VeryPC Windows devices and some iMacs - the iMacs were about to go out of MacOS security update support, again after 7 years. We would expect the same amount of use from laptops (especially teacher devices), possibly with a replacement battery half-way through their lifespan if needed. Chromebooks: until they go out of update support, for some devices that is 10 years, although again 7 might be closer. We've just replaced our staffroom devices (NUCs running ChromeOS Flex) after 6 years as there was an update issue. This is assuming the devices don't get bashed around too much, of course - I think some schools allow for a 20% replacement / spares rate, we're nearer 5%. Monitors we simply use until they stop working. Our touch screens we'd expect to get 10 years out of them, athough any embedded OPS devices might need replacing after 5 years. We would expect our servers to last more than 5 years, I think ICT Direct are even doing extended warrenties for older hardware up to 7 or 8 years. Switches: we've just reeplaced our switches after 10 years. Network wiring: I think the warrenty was meant to be for 25 years, I don't know how well that holds up. Wireless access points: we've just bought new Ubiquiti access points to update our existing Ubiquiti points, we're installing them one-by-one. The older ones are working fine, probably about 5 years old. The new ones have support for newer wireless standards, of course. Much the same for CCTV cameras - we're finding our older (5 years?) cameras aren't supported as well by Ubiquiti's management system, so we're upgrading individual cameras as we get to them. Printers we have on a managed contract, I think typically 5 or 7 years. Phones (as in wired handsets): I think we've got 10 years out of our current handsets, some of which we're now replacing. Tablets / iPads: we'd go by the iOS-updates availability, which I think is around 5 to 7 years. Mobile Phones: again, we'd probably go by updates being available, so we'd expect to get longer than 2 years from a device. For my own device I have a FairPhone, which should last (with updates) for 10 years.

For Google Workspace, GAM will let you script adding backup 2FA codes for each user - I think you get 10 per user. You could then export those codes to a template that prints onto an A4 pre-perforated cards sheet, so each user gets a credit-card sized card with their codes on. They are one-time-use, so they'll have to cross each one out as they use it, then come to you for a refill when all 10 are used. If people mostly use the same computer they'll probably only have to complete the 2FA step once. The above might not be the best / most secure option, but it is an option.

We're looking at the same thing. We currently use PaperCut, running on an on-site server. It would be nice to be able to do away with that server. I think we've looked in the last at PaperCut Hive, but at the time it didn't support departmental budgets, only individual budgets. Has that now changed, would anyone know, or is that something that PaperCut Pocket handles?

Macs turn out to be suprisingly fine about what devices they will work with - I use an iMac (now formatted with ChromeOS, but ran MacOS for several years) with a 20-year-old Dell keyboard and a Microsoft mouse as my daily-use workstation. Whenever I've had to plug a screen into a Mac (iMacs / Macbook) it's been quite okay, even touch screens - just plug in the USB connection, MacOS handles touch input with no fuss. It's probably time for an upgrade - we've just moved on our 2017 iMacs as they were about to end support for security updates for MacOS.

Nothing too specific, but Lenovo have recently been emphasising that their newer devices are more repairable / recyclable than perhaps previous devices have tended to be. I would also recommend getting devices with two USB-C ports that can be used for charging - it seems to be our most common breakage, someone managing to break a USB-C port (generally, we think, by pulling the device out of the cabinet without unplugging the cable first), so having a spare available is handy. We use Lock-n-charge charging cabinets, but tend to find the 5-device baskets they supply a bit too heavy for a smaller child to carry, we prefer the "toastrack" wire slots instead. You can hacksaw off a few of the internal wires if you want to fit more than 10 devices in a cabinet - we can fit 15 or more devices in a "10 capacity" cabinet.

We still have a now several-years-old couple of Panasonic camcorders. I'm not sure what the current model is ("camcorders" as a thing aren't as common / updated as they used to be), but Amazon seems to have 4K versions for around £400. I've used those with an HDMI-to-USB adapter (around £20 on Amazon - make sure you get HDMI TO USB, not the (much more common) other way around) to plug straight into a computer for use with Teams / Meet / etc. For snazzier cameras, or a snazzier multi-camera setup, then Blackmagic's kit is affordable (although not "cheap") - around £1,300 for the camera, then a lens on top of that. The ATEM Mini 4-channel camera switcher (around £300) is very good value for what it is, letting you plug in 4 HDMI channels (direct output from a camera or from a laptop) and switch between them, outputting to HDMI and USB (to plug into a computer as a simple generic camera device). You can use it with any HDMI-outputting device, not just Blackmagic's cameras, it works nicely with our Panasonics. Whatever camera you get, best to make sure it can output a "clean" HDMI feed, i.e. just the thing you're filming, without any menu overlays over the top. Of course, "camcorders" are way less common these days because everyone uses tablets / phones for recording. You could get a tablet or phone to dedicate to recording video. If so, Padcaster make cases that turn your iPad (or, now, tablet or Android phone) into a tripod-mountable camera complete with extra lens and microphone.

We tend not to use the baskets any more, but we've managed to lose / dispose of the wire-frame "toast racks" that came as alternatives in the cabinets. I don't suppose you have any spare you'd like to swap?

For our relativly small set of Windows machines (70 or so, I think now), on our single quite compact site, we simply installed from a bootable USB stick (made using Ventoy) automated with a standard unattend.xml file. That installs the base Windows 11 and the Action 1 client, everything else (updates, more software) can be rolled out from there.

We've installed ChromeOS Flex on some 12-year-old laptops (non-managed devices for people to take home), it seemed to work okay. We did have an issue with some 6-year-old NUC7JY devices we had in the staffroom, those conked out when upgrading from ChromeOS 128 to 129, completly failing to boot. We had Windows 11 installed on some older hardware, too, just before summer - I think our oldest Windows 11 all-in-one was around 8 years old, but we've replaced those with newer machines now as they were quite slow and would possibly / probably have update issues at some point.

We issue 2FA USB dongles / fobs to staff, we don't require they use their own phones for 2FA (official school policy is "no phones in classrooms"). We use the same devices for building access (Paxton) and printing (Papercut), so staff have one school-issued device to access everything. For those that want to use their own device (typically a Macbook), we have a web-based remote desktop server behind a Cloudflare zero-trust gateway that staff can access via their (2FA protected) Google account. I'm not quite sure why some staff like Macs so much. We have few older iMacs we have re-formatted with ChromeOS Flex in our Art department. When one of their power supplies conked out, we replaced it with an all-in-one Chromebase - same OS, same sized screen, I think even the same keyboard, but the teachers still complaied because they wanted a Mac!

We now use Moysle MDM to manage our ICT suite of iMacs (Summer 2024 model). That lets users log in with their Google credentials, I assume it also supports Microsoft (and Apple?) logins. For our previous set of iMacs, we had them authenticating via LDAP - first the on-site Active Directory server, then we switched to Google's LDAP server so user could log on via LDAP but with their Google credentials. Again, if you're using Entra ID (Azure Active Directory) you might be able to do something similar. We've re-used some of the older set of iMacs (2016 model, I think?) as ChromeOS Flex machines, which they work really nicely at.

Ah - so you mean we have to first pay for A3 / A5, then pay for CoPilot on top of that?

Copilot: there was a talk from Microsoft about Copilot at the Edugeek conference last week - I'm guessing the recordings might still be available. I never did really figure out how the licensing worked. ChatGPT: we're a Securley customer, and seemingly they do a suitible-for-schools version of ChatGPT, basically proxying ChatGPT and adding some filtering and so on on the way. It actually looks really handy, and if I understand correctly it's included in our Securley subscription. Only really relevant to Securley customers, of course, but if you're on another filtering system they might have a similar service, might be worth checking, or I don't know if Securley offer the ChatGPT bit as a separate product.

Ah! Possibly something to do with getting the content to refresh. I've noticed our screens can take a while for changes to take effect (ChromeOS seems to load up the cached version of content, even after a reboot) - not a huge problem in our case, but worth checking if you are rolling something out over a larger estate of devices.

Our main virtual machine server, running Windows Sever 2019, is using Windows Storage Spaces. The (small) boot volume is a simple RAID-1 mirror of two drives. The rest of the disks are presented to Windows as individual disks (I think we put a separate HBA card in that server) and it sorts out how it handles redundancy and failover. We have both smaller, faster SSD disks and larger, if slower, mechanical drives, so we have Storage Spaces use the faster SSD layer as a caching tier. We also have a Synology server which we use to back up Google Drive, it has a similar disk setup to the above server, which it has all the stuff built-in for - you just tell it what disks you want in which layer and it gets on with sorting out how they are split up. A RAID setup (or, at least, some kind of physical disk reducndancy) shouldn't add much additional cost to a server these days - having a second server for failover is more of a nice-to-have option. We've actually just turned off our old main Windows file server and domain controller(s), which took up the larger part of the resources on that main server, so if we do refresh our on-site server hardware at some point we might only need a small device with a basic RAID-1 mirror to run the few services we still run locally.

Our lobby display screens are ChromeOS kiosk devices, showing a basic HTML slideshow. We didn't need a separate kiosk app, we just pointed each device at the URL we wanted to show, that seems to work okay.