dhicks

The interactions with your support staff are being handled by a different member of staff at this end, not me, sorry. I think we have our issue figured out - we ignore the Windows client completly and just point users at the Smoothwall gateway's login page instead, where they can log in with their Google login. Has the advantage it should work on other platforms, too (i.e. our pupil iMacs). We just need to figure out how to add a link to the login page from the "You have been blocked!" message page.

That's pretty much the bit I'm trying to figure out - what makes for a suitible "enterprise" building control / monitoring solution? That Shelly 1PM Gen4 does, at least from the hardware specifications, seem to be a proper bit of home / office / light industrial kit. I've not looked at building control networks much recently, so I don't know what software is going to be suitible. My plan is to look at Home Assistant (which, despite its name, looks like it might handle the average office or school as well), but if anyone has any experience with something they reackon would be more suitible that would be great to hear about. Putting the Matter devices on their own VLAN segment does sounds like a very sensible idea. As I gather most Matter-compatible devices seem to operate over WiFi rather than wired ethernet (not sure if that's actually an option for Matter, again I'd like to hear from anyone who actually knows) I think we're most likely to create a separate SSID on our wireless network for these devices to use.

Hello All, I've been looking at adding some timers to various powered devices. I'm looking at starting with our lobby display screens (currently using basic plug-in mains timers) and the lit trophy display cabinets, working our way up to timers for laptop charging cabinets and, possibly, heating / aircon appliances. We use Ubiquiti switches and wireless access points, so I did have a quick look at their controllable power devices, but those seem to be US-only and, I think, recently discontinued. I saw the press releases from Ikea a little while back saying about how their new home automation range is going ot be Matter compatible / certified, which resulted in me having a look at what Matter is. If I understand correctly, it's a cross-supplier standard that seems to be quite well supported. I had a look at Ikea and TP-Link's Matter power controllers, but in the end I think we're likely to go for something like the Shelly 1PM Gen4 - not an "end user" sort of device, but handily small enough to fit in a power socket pattress and seems to be properly specified to handle 16A loads (resistive, inductive and capacative, which before I started looking at this I didn't know were different things), complete with power monitoring (around £22, so a realistic price to be able to buy and tinker with): https://kb.shelly.cloud/knowledge-base/shelly-1pm-gen4 Does anyone currently have a building-wide networked device control / monitoring system set up? If so, do you have some sort of central, preferably web-based, control panel / dashboard set up that people can log in to for control and to get data about entergy usage and so on? I'm aiming for something "enterprise ready", so something that can handle multiple users, preferably handling Google logins, with some users able to just read usage data, but some (site staff, etc) able to change things like timer settings. It would be good for pupils to be able to get involved, certainly at least in the reading and processing of power usage data. The most comprehensive controller / dashboard I've found so far would seem to be Home Assistant: https://www.home-assistant.io/ I've not figured out so far how that handles logins.

Perfect timing - a bunch of our teachers have just bought USB document cameras, I'll point them at this.

Are you likely to have a solution working and ready to roll out by the end of this week / next week? Your Windows client currently has a couple of config options it reads from the registry, could you add another registry entry that defines a regular expression for the client to apply to the usernames it picks up from the local machine?

We're just looking at this now. Our Windows devices log in with pGina which, similalry to GCPW (or other Windows login providers), Windows sees as a local user with the local machine name as the domain ("TEST001\pupil1"). The installed Windows Smoothwall client seems to be picking up that whole username to pass to the Chrome plugin, so the Chrome plugin thinks it is trying to filter a user called "TEST001\pupil1", rather than "[email protected]". Is there maybe a setting we can configure, either on the Smoothwall appliance or in the configuration for the Windows client, to tell Smoothwall how to parse the username? A Regular Expression of some sort, maybe?

Right-oh, thanks for following up. We've just set up another test machine here, I'll maybe have another go here and see what happens.

The "Do you have any kind of remote access for staff (not IT) so they can work remotely?" question: the only "yes" answers are "Microsoft DirectAccess" and "a VPN", an "Other options" item would be handy there.

We've tended to re-install Windows, with setup (including installing GCPW) via unattend.xml, maybe some supplementry scripts, and Action1, I don't think we've tried just installing GCPW on an existing Windows machine. Did you get a chance to test USB 2FA keys again with GCPW? I couldn't get our keys (Feitian) to be recognized, which I understood was simply a limitation of what access the Windows login mechanism gives GCPW to things like USB ports, but you reckoned you might have got USB Ubikeys working with GCPW at one point?

We were looking this a couple of years ago - relevant thread: GCPW should now pass login cookies on to Google Chrome - check the version you are using, there was an issue a little while back that took a while to get fixed, again, relevant thread: On first run, Google Drive for Desktop needs to go out to the browser to get authentication to connect to the user's Google Drive. There is a separate registry setting you can set to make sure Drive for Desktop opens up Chrome (which the user has already just logged in to) rather than the system-default browser (which Windows tends to keep setting back to Edge at any opportunity). The user doesn't need to log in again to connect up Drive for Desktop, they just need to approve further permissions for the Drive client. It just takes a few clicks, but is the kind of the thing the average user ignores / closes without reading. Therefore, if you read through the first thread I linked to, you should see a link to an application I wrote that forces the user through the setup-Google-Drive-client before the Windows desktop (Windows Explorer) loads. This also means you can have the Drive client load before Windows Explorer, so you can redirect the user's Desktop folder to a Google Drive folder. Users logging in via GCPW get local Windows profiles on that device, by default anything they save on the desktop doesn't get synced to Google Drive. I should add that I haven't touched the above application for a couple of years, it is not extensively tested or guaranteed to work in any way. It is a fairly simple Go application, easy to compile yourself, so you can modify and tweak it if needed.

We use Google Workspace, and now all our file storage is on Google Drive. All staff have 2FA enforced on their accounts, we provide Feitian USB keys as the 2FA method, which (so far!) have proved quite robust and secure. I think we've mostly got people out of the habit of emailing documents around, instead editing and sharing them from Google Drive, which cuts down on the number of copies of data floating around in random "downloads" folders. We haven't yet stopped people connecting to GMail with phone / home desktop email clients, but we might consider it. Our MIS (iSAMS) is web-based and accepts our already-2FA-ed Google logins, which makes logging in to that nice and simple, and for the few users (only half a dozen or so now) that still need a Windows application for something we have a remote desktop server, also web-based and accessed via Google logins. We issue all teaching staff with managed Chromebooks, so they have a school-managed device they can use from home if wanted. We don't currently restrict people from logging in to GMail, Google Drive , etc from non-school-managed devices, but we might revisit that policy in the future.

Depending on screen-sharing system / technology, some of the ones now built-in to boards are cloud-based services, with the board and the client connecting via a cloud service, so local network access between the two devices might not be needed.

We've tended to use £60-ish-from-Amazon combined HDMI / USB extenders: https://www.amazon.co.uk/PWAYTEK-Extender-Keyboard-Control-Ethernet/dp/B0C13Z1XV1/ref=sr_1_3 They work pretty well, although they do occasionaly freeze up and need a quick switch-off-and-on-again - we suspect putting them on a timer switch so they go off over the weekends would probably be enough. For the model we have, just the transmitter end needs a power adaptor, the other end is powered via the ethernet cable, so one less cable at the other end. We haven't found an affordable 4K version yet, but our classroom desktops are all 1080p and most people use their screens mirrored so hasn't been a huge issue yet.

If it doesn't have a standard "kettle lead" (IEC C13, which technically only supports up to 10A, or you sometimes see IEC C19 (16A) connectors on servers / UPS equipment) connector, as @CrootUK points out, it's probably expecting a 16A or 32A connection, possibly on a dedicated mains circuit. I would advise getting an electrician to come and get it wired in - if nothing else, they have the proper insurance. I've had one of these go wrong before - there was a loud bang and everything stopped working, which wasn't a fun day.

We have iMacs in our IT suite, which seem to have been fine with pupils having access to Python on the local machine - they are closely supervised, though. Our remote desktop system for staff uses Guacamole for web-based access via Cloudflare Tunnels with Google authentication (users are already logged in to their Google accounts, they aren't even presented with another login screen, they just click on the "remote desktop" icon and it loads). I was thinking of creating something similar for pupil use but using Pangolin instead of Cloudflare Tunnels, and probably a Debian desktop instead of Windows or MacOS. This will run on a VM on our server in our building, so will be behind the same filtering infrastructure as other devices. It should, hopefully, give each pupil a handy place where they can have a development environment to tinker around with. I doubt graphics performance will be good enough to support running games directly on the remote desktop server, but a local-access-only web server should be do-able, so they should be able to develope web-based stuff for them and their friends to play if they want.

Also possibly an option: the average CCTV system these days probably has good-enough-for-assesements video / audio quality. Our Ubiquiti CCTV system can manage 4K cameras, and audio recording is an option, so you could have a fixed location for recorded assesements with a CCTV camera there.

Cameras / camcorders: "Camcorder" still just about seems to be a product catagory on Amazon, we have a couple of older Panasonic camcorders which have lasted well. They have decent-enough image quality and will take external inputs for microphones if you want to get a mic closer to the speaker. If you want to use a camera as a webcam then we've found cheap HDMI-to-USB adaptors (£20 on Amazon) work surpisingly well - they turn an HDMI signal into a USB webcam signal. For recording a basic one-to-one language assesement I would have thought the average webcam on a laptop / Chromebook would be okay. If you want to add an external mic, we've used a USB mic interface with a Chromebook before (£30-ish on Amazon for basic ones, plus a mic and cable), they're pretty much plug-and-play, although it does make for more things to plug in. If you use iPads, the Padcaster might be your most compact / all-in-one solution: https://padcaster.com/ It gives the iPad a zoom-able lense and an external mic. I think they now have options for phones as well, so you could have a cheap-ish managed phone (£150-ish?) you use for video recording.

Hmm - assuming current price of electricity around £0.26 per kWh, running for 6 hours a day, with a £30 resistive heater drawing 2kW (constant, which might be a bit over the top) and a £300 aircon unit drawing 1kW (for the same amount of heating work done), around 620 days. In a school setting (not 7 days a week, and you're not using the heating all year / during holidays) that's maybe 6 years.

With our building, we find there is generally enough capacity to power heaters for all the spaces that need one, but people tend to buy 3kW oil-filled radiators, which tend to get up to temperature and then cut off, coming back on after some time or when they sense a temperature drop. Of course, they tend to all come back on at the same time, which then trips the circuit (which becomes an IT problem because the computers have stopped working). Generally, we've found that small 500W oil-filled radiators (currently around £30 on Amazon) are fine, they make for a more consistant power draw from the mains. More ideally, decent modern aircon units can generally heat as well, and much more efficiently than plain resistive heaters. Larger initial cost (starting at more like £300), I'm not sure how long it takes to break even with heating costs compared to other heaters.

Ah, odd - I had a demo from them a few years (might have been 10...) ago at BETT (yearly UK education IT exhibition), I guess they didn't sell so well in the UK.

We've not got anything installed, but we've looked at Lightspeed in the past (confusingly, different company from the one that does network filtering): https://lightspeed-tek.com/

This is the problem we found in our (older) building - half-a-dozen charging cabinets, in different classrooms but on the same standard 32A ring main, the total power draw should have been fine but the circuit breakers kept tripping. We replaced some individual chargers with multi-port USB chargers (proper 20-port chargers) and that seems to have solved the problem. It does cut down on the amount of cabling needing to be crammed into a charging cabinet, too. In theory, we would like to have timer-controlled plugs so that cabinets are only charging during woring hours when someone is available to keep an eye on them. In practice, we haven't yet found a basic timer plug that is reliable enough. We might have a look at Matter-compatible devices (as now sold by Ikea, but other vendors are available).

I'm currently using a 2015 model iMac running ChromeOS as my main office machine, and we have a few more of them around the school. They mostly work well, although the built-in wireless hardware seems to no longer be supported by ChromeOS, so they need a wired connection. Not a problem in our case, but might be an issue for some schools / home users. I think someone's tried an external USB wireless dongle with no luck as well. They are, of course, older devices, so it might be a good idea to think of them as, say, 60 iMacs with 20 sets of swap-in spare parts.

Good point - I don't think we've had any devices fail that turned out to be just the power supply, if a machine goes these days the problem generally seems to be something whole-motherboard related. A couple of (minor) niggles we've found with all-in-ones: The built-in / pop-up webcams are snazzy, but confuse teachers easily. Even ones with built-in privacy screens that you can pull accross with a little tab on the top of the camera cause confusion, we have a couple of all-in-ones with a big, chuncky USB webcam sat on top as staff can more easily see and understand those. Built-ins are probably more tamper-proof if you're in a classroom, though. Modern all-in-ones, for some reason, tend not to have USB ports on the front, and can be a bit light on USB ports on the back, too. We find we have to lead at least one short USB extension cable round to the front for people to plug in their USB 2FA dongles. Might be less of an issue if you don't use USB devices for 2FA. In some cases we've had to add a small USB hub at the back to accomodate more ports. Most all-in-ones have HDMI (or maybe USB-C) output ports, so you can add a second monitor (or classroom touch screen), but only a few rare all-in-ones have HDMI /input/ ports. Unless the manufacturers are very well organised, you can't generally get a second monitor that exactly matches the all-in-one screen, so for our (limited) two monitor setups we tend to go with mini PCs with two matching monitors.

For staff, in classrooms and some admin offices, we have 24" screen Lenovo all-in-ones. They've been pretty reliable over the last three years or so, we had a few in the initial batch that needed replacing under warrenty, so having a few spares is always a good idea so you have enough to swap out while repairs are on-going. They are very fiddly to take apart yourself, we found it tricky to even get the back off without the screen cracking, so future RAM / harddrive upgrades would be tricky. They do make for a nice, compact device with a reasonable screen size and relativly few extra cables to be tinkered with in a classroom setting. I think I prefer the external power brick - we generally mount them under the teacher's desk in an Ikea cable tray, cable-tied it, and that does make them replaceable if there's a power issue. For those (admin) staff wanting a larger screen we tend to get Mini PCs and velcro them to the underside of a monitor stood on the desk. With suitible short cables and enough cables ties / wrap the cables can be quite neatly done, and you do tend to get a more powerful machine / larger screen for your money, although they aren't really tamper-proof for the classroom. For our ICT lab, we have iMacs. Nice hardware, no excess cables, although they do now also have an external power brick. Oddly, the wired network connection goes into that power brick, which seems a bit odd at first but I guess does make the whole thing a bit more tamper-proof. More expnsive than most all-in-ones, but we figure we should get a solid 7 years usage out of them, so in cost-per-year terms they aren't too bad.