Sheridan

This is all Netgear stuff- M6100 series. Sounds like @FN-GM has the same sort of setup (on a larger scale) So I guess I'd have create VLANs to replace our existing subnet ranges, and then remove the IP addresses from the ports. I'll need to get the VLANs to effectively replicate the current setup as we have fixed IP address devices and DHCP ranges all setup.

At the core switch each of the edge switches is connected through a 10G fibre port. Those ports have their own IP address which is a seperate range (i.e 192.168.10.0,192.168.20.0 etc) so that we effectively have 9 subnets. The 10G ports are routed by the core switch - so effectively the seperate blocks of the school have their own IP range. Its almost like vlans with out any tagging etc - but I want to 'overlay' a vlan across the various subnets for the wireless.

I'm just planning what I'm about to do with our wireless makes sense - I know a lot of you will have already done something similar so I'm just doing a reality check! We basically have network cabinets around the school, connected by fibre back to a main cabinet with a core switch. All the fibres terminate in the core switch and each fibre port is a subnet - routed at the core switch. No vlans are currently set up but the various (192) subnets can route across each other perfectly through the core switch. Its probably not the best solution but it works fine and releases a lot of ip addresses, as each subnet uses a DHCP range. In each subnet/cabinet there are wireless APs - so the various APs have different IP addresses across the school - routing makes sure that they all report back to the controller and clients can connect. As we are planning to expand and upgrade our wireless it makes sense to move the APs onto a wireless VLAN - making sure the clients stay on a seperate IP address range just for wireless clients (and possibly guest clients on another vlan in the future) My understanding is that I need to tag the ports (i.e vlan 50) that the APs are directly connected to in the edge switches, and tag the uplink ports in the edge switches for VLAN 50, At the core switches the uplink ports will also need to be tagged for this VLAN as well? At the core switch I will create a VLAN that has a seperate IP address (another 192 range) - so any clients attaching to the APs are on that VLAN and will get a seperate IP address from the DHCP server, meaning their address won't change as they roam around the school. Does that sound correct? Its not often I have to work with VLANs so I'd appreciate any comments!

Same here, deployed with solus3 using the firewall settings specified by capita and it works OK.

When we last setup an IT Suite we had the PCs in boxes under the desks (locked away!) but with a USB extension on the desktop. Teachers can then hand out the webcams and they are plugged in just for the duration of the lesson. The only downside is that we had to make sure the webcam drivers were in the images for that suite - we used Microsofts webcams and they seem to do the job nicely, we did try some cheaper ones but had issues with drivers and really poor images!

We're looking to replace the old visitor book with a ipad driven system - we've looked at a few (such as Sign In/Lite) and most will do what we want - but barely any will let you buy them outright, they're nearly all monthly/yearly subscriptions. Is anyone using a system like this that was just a one off app payment?

I thought that was just our students who used to do that!

It's slightly unreal the rate that well known people are dying far too early.

Thats exactly what I'm trying to do - deploy IOS devices with AC2 and then Meraki. However we implemented the Device management in GAFE to enforce Staff who use their personal devices to set a passcode when using Gmail on their phone for example. The problem is GAFE now sees our staff ipads as external devices, and theres no way of distinguishing them!

I'm going around in circles with AC2, Meraki and now Google MDM!

Hmm, I think I've got myself in an MDM loop We have some staff 1:1 ipads managed by Meraki for app deployment etc - they can take these home and also use them in school. As we use GAFE we also have device management enabled so staff using the Gmail App on personal devices get the Google MDM to ensure its passcoded etc. The problem is, Meraki MDM and Google don't sit together - if you try to install one and the other one is already on it fails as there is already a management profile installed! I can't see a way to 'whitelist' devices in Google, so am I asking too much to do this?

We do use WSUS, but weirdly the issue with the language pack is on a machine that doesn't have the WSUS policy applied to it!

It does seem to hit the proxy - but only occasionally. The language pack seems to ignore it but 'normal' updates can be seen hitting the proxy but just dropping out. Setting the proxy in two places is a step backwards though!

Does anyone else find Windows 10 updates are really unreliable behind a proxy? We use WSUS, but occasionally want to run a full online update, this is almost impossible to get working. It just stops, drops out with an error or sits 'Downloading'. We have the full MS update sites list whitelisted for unauthenticated access and it makes no difference. I've spend ages trying to add a 6MB language pack to one device and its progress bar never moves, and the proxy shows no activity from that device. It will eventually drop out with the error 0x800F081F.

We're most likely going LTSB, I want an OS not a collection of crappy apps designed for a home PC. XBox FFS in Education?

How are those with microbits dealing with them? Front I understand students would need to have access to use storage devices which we currently block.

I've set this in the same way as you (i.e just Block access to C:\) and it works OK - if they try to browse to c: it changes it to file:///c:\ and tells you its blocked. Have you got anything in the whitelist (Allow Urls) that might be overriding this?

SLT don't care about the space (its in our office anyway) and I bet the power reductions are minimal. Don't get me wrong, I want to VM the lot! But to do it in one go its an uphill struggle. Instead I'm trying to setup 3-4 hosts (1-2 a year) and gradually have all servers running on a set of physical hosts.

Flash 21 seems to have installed OK in all cases (admins, staff or students) and the only way it works now is by forcing IE11 to display youtube in Compatibility View - I've had to set that using a GPO. You get a brief flash on the video player about needing to install Flash but it disappears and the video plays. Switch off compatibility View and its no good - across our entire network. We get a persistent nag message about certificate revocation as well that relates to doubleclick.net but I guess thats due to our smoothwall's https filtering.

Hmm, our IE11 (on Windows 7 PCs) now won't play any youtube videos at all. Every user just sees the spining wheel. Chrome works fine! We're using IE11 and have the Play Animations and Sounds options ticked in GPP (always have done). This just seems to have happened recently as well. Now not one person can use IE with youtube. A lot use Chrome anyway but as IE is still our default browser it causes problems with links. We updated to Flash 21 recently so I'm suspecting that has broken it.

Some of you must have better budgets than me! We're still running mostly physical servers with local storage, some of the oldest have been merged as VMs onto a new server but theres never the budget to do the whole lot in one go, which means a SAN and and some decent hardware to migrate everything over. Problem is, we know virtualization has its benefits, but when you have very few issues with physcial server setups its a hard sell to SLT to rip all of that out -so you carry on replacing individual physical servers on piecemeal basis!

Blakes 7 was my favourite as a kid. Also had some early lusting for Servelan!

Windows 10 LTSB, Classic Start Menu and Applocker and I'm nearly happy with the image. Still buggy, still can't manage the Start tiles and Applocker still flakey about blocking powershell. I also don't like the fact that if a non admin searches for powershell, they can find it - they can't run it but they can open the containing folder and therefore browse around the C: drive, despite this being blocked by group policy. Its likes going back to Windows 98 from a management point of view.

Thats the only way I see around this, allow App Store until they accept the invitation, then remove it again!

Ok, so I'm now going around in circles. I have deployed a small test number of staff iPads with meraki to apply policies, settings and Apps. This is working fine. However these staff also require iBooks, so we have to get each staff member to create an Apple ID and 'Invite' them to join the Meraki MDM - then we can deploy books to their accounts. But - and this is the part I'm sticking on, we want to stop them adding any old App or Book they feel like - these are supposed to be school ipads. But you can't disable that in the MDM settings, as soon as you remove the App Store they are unable to complete the Invitation process. If you leave this App store on they can install the hell they like using their newly created Apple ID, which they only need for the books in the first place! This is a mess, it seems at odds with everything I'm trying to do - provide a configured and managed device where I can deploy free and paid for Apps and Books to devices - once you add in the books it all falls apart. Please someone tell me I'm missing something obvious here!