mrstrong

I've completed setup assistant in jamf school and assigned the new ipads to jamf in apple school manager. Then in jamf school I've assigned the "Automated Device Enrollment Profile" to the devices So I think I'm ready to go? e.g. unbox a new ipad, start ipad setup assistant and connect it to wifi manually and it should enroll into Jamf ? My question is can I speed this up with apple configurator connected to a trolley of ipads over usb? E.g. use "prepare" or just add a profile with a wifi payload ? And I guess the wifi network I use to enroll will stay on the ipad after it has enrolled so need to be careful not to use an open / unfiltered one or can I force remove/forget a wifi network via jamf school after its enrolled?

@ibpalle regarding Smoothwall’s client-based Cloud Filter: am I correct in thinking that the smoothwall is not acting as a MITM (i.e. decrypting and re-signing with its own cert) ? E.g. the browser is talking direct to the website over HTTPS but once the browser decrypts the page the client extension kicks in to parse the content and apply rules (rules must be stored on client) ? So its not really filtering "in the cloud" ?

seeing this for this site https://www.thinkuknow.co.uk/ we do https inspection and you can click advanced and proceed and it loads as "not secure" the certificate says it is invalid (issued by Digicert) From memory shouldn't this be the CA smoothwall showing as we are doing inspection? Just tried another site mxtoolbox.com that loads fine and the cert is valid issued by Amazon (again not smoothwall)? Mmm just realised this chromebook is using Smoothwall’s client-based Cloud Filter so maybe that makes a difference. I guess I could just add thinkuknow.co.uk to a do not inspect category but still curious as to why getting invalid cert ?

just powered that chromebook off, logged in and now working , even with just https://classroom.google.com/ I definitely powered if off earlier today. Now on the new tab page on the upper right I have "Images", the "9 dot waffle", and account circle you can click, is that what you meant by "click on your Google account menu in page" When it wasn't working that account circle wasn't there suggesting it wasn't signed in ? We've had 5 or 6 of these this week. Wondering if its a wifi / connectivity issue e.g. maybe just lets you login to chromebook using cached credentials. I've also had quite a few that seem to connect to wifi but then say something like (can't remember exactly) "network unavailable" and take you away from sign in page to a page showing list of wireless networks. Maybe they are connected issues. Oh well nearly home time, will see what monday brings.

just added that link as a bookmark (under Devices->Chrome->Settings->Users and Browsers then select pupils OU and add under Managed bookmarks) and reloaded policies ok to push it out but just get the message: "addition of more Google accounts is disabled" maybe time for a powerwash ?

you mean when you click your profile picture top right next to 3 dots and you can switch profiles ? Kids don't seem to have that option. Thats one hell of a bookmark / URL ! Can I ask where it came from / how it "works" Anyway will give it a go thanks

Strange issue on several chromebooks: they login ok but can't access google classroom. Background: for some reason classroom didn't always show up under the 9 dots google apps (top right on new tab) so I added a bookmark for them to https://classroom.google.com/ Seemed to work ok but now for several kids the bookmark just re-directs them to https://edu.google.com/intl/en-GB/workspace-for-education/classroom/ Then a pop up appears and takes them to UK site (link as above with en-GB now ALL_uk) At top right of this page there is an option to sign in to google classroom but when I try that it says "addition of more Google accounts is disabled" so far tried: reboot chromebook, clear all browsing data, reset settings edit: not just classroom, same for other google apps like drive so it;s like they've signed in to chromebook but google chrome is not signed in

probably not this as you say only staff affected but its not your anti-virus misconfigured is it ? I noticed the other day that our sophos blocks https://translate.google.com/ for example

I used to try and keep my 365 inbox empty via moving emails to folders but now I just delete the junk and leave everything else in my inbox, there must be 1000's in there going back years! Never been an issue (so far), e.g. search seems to find stuff ok, filtering works. Is this not best practice, how do you do it ?

yes added google directory and can see /pupils OU mapped to local Students group I can see urls being correctly identified (category is correct) and allowed /denied so it's working but Policy column is completely blank even for urls in a category that is in a web filter policy. realtime filter on client correctly reports policy (matched rule is policy number) just looking at https insepction looks like someone has turned it off! I'll switch it back on and re-test seem to remeber you have to log out of web interface and give it half an hour to sync policy changes back up to cloud ?

Hi just got round to do some testing and can see the chromebook IP listed in the secret knock page ui/admin/cloud_filter Also on chromebook I can see "smoothwall extension" version 1.0.31467 updated may 4th so guess it auto updates? In web filter logs username is mostly now showing the full gmail account rather than IP (still a few records with the IP though) Also noticed the Policy column in web filter log is blank when the username is a gmail (but populated when username is an IP). Is this expected ? Are there any other things I need to consider e.g. like when using ipads with an MDM you have to update tokens / certificates every so often, and any performance implications ? thanks again

thanks, never had an ssd fail before, it was a dead cheap Integral "Performance SSD" https://www.integralmemory.com/ bought quite a few, hopefully not a bad batch, usually use Kingston think I will just reimage onto a new drive

Hi, had a report of pc blue screen and now it is in bios: the ssd is not showing up as a boot option I tried a different sata cable and port on mobo, so took drive out and plugged into my PC with a usb drive caddy. It comes up in disk management as Disk 2 Unknown Not Initialized (this is what you get with a new ssd ?) has it just died on me (first time for an ssd) or has windows done something nasty to it ?

I did a few experiments. I tried to create a distribution list but it looks like you can only add internal emails, read that you would need to add external emails as contacts first and then add them !? Anyway here's what I did for reference: I created a shared mailbox and blocked user sign in (MS advice). (edit: and add staff members) Then from my outlook web client I click my picture top right and open another mailbox (the shared mailbox). Opens in another tab, then select people on left and Your contact lists, create new contact list (think this is just for this shared mailbox?) can add external emails to this contact list (no need to create individual contacts first) Then send from shared mailbox to the new contact list, recipients can see all other recipients but like you said if I BCC to the contact list (don't even need to put an email address in TO) recipients can't see others and reply and reply all seems to just go back to the shared mailbox. So I think this is a solution?!

Hi, the head wants to send emails to a list of external email addresses when one of the external recipients replies the other recipients must not see the reply e.g. only the head sees replies and don't want the possibility of an accidental reply all from the recipient (confidential content) if possible head also wants to be able to give other internal staff access to email threads (messages sent and replies) is this possible ? Just looking here https://docs.microsoft.com/en-us/microsoft-365/admin/create-groups/compare-groups?view=o365-worldwide maybe I could create a "distribution group" with the external emails and also a shared mailbox then head sends to the "distribution group" from the shared mailbox (or would they need to use BCC) ?

Hi, each pupil has their own chromebook, i.e they are not shared. At start of pandemic (2 years ago!) we got the offsite filtering working with smoothwalls help My memory is a little vague but looking in google admin I can see there is an OU with an app extension jbldkhfglmgeihlcaeliadhipokhocnm And in the smoothwall Directories we have Google as well as our Active directory I used to move chromebooks going home into this OU to get the offsite filtering. Is this what you mean by the cloud filter ? Like I said this was a couple of years ago, does anything need updating ? As we have on premise smoothwall would using cloud filter on site have any performance implications ? Also I thought when we used the offsite filtering you had to view logs on the client ? e.g. see https://kb.smoothwall.com/hc/en-us/articles/360006892380 OR do these logs get written back to on-premise box as I want to report on sites visited /blocked / bandwidth etc. I guess it is not possible to have hostname visible in smoothwall's DHCP (currently UNKNOWN for chromebooks) or report by MAC address (smoothwall doesn't see layer 2?) thanks edit: I don't have direct access to a smoothwall account manager as box is managed by LEA so I have to go through them first which can be quite a slow / painful process!

Hi, currently our chromebooks are on their own vlan / wifi sid In smoothwall we have a transparent authentication policy for that subnet with no authentication (students for unauthenticated requests) Its simple and works but has some limitations, e.g. when looking at a report for bandwidth usage by user you only get the IP The IP's are given out via smoothwall DHCP on a 1 hour lease so the report is pretty useless for historic reports / identifying the real users. As a quick fix is it possible for smoothwall to report on say Top MAC addresses bandwidth usage ? Also for chromebooks the hostname always shows as UNKNOWN (ipads show their name). Is there a way to get chromebooks to show their hostname? Then I could up the lease time to say 7 days which would enable identifying users in last week ? Of course the best solution would probably be to change the authentication ?! How do you do it e.g. do smoothwall still recommend "connect for chromebooks" as the best option?

I tend to use https://speedtest.btwholesale.com/ and https://www.thinkbroadband.com/speedtest also get test files from https://fastest.fish/test-files and test e.g. upload here https://www.azurespeed.com/Azure/UploadLargeFile

was set up by our LEA: in core blocked content YouTube is not ticked so I guess that means by default everyone can access it and I've added the block for students at the top (1st web filter policy)

testing on a chromebook, when they first go to youtube.com they get the "Before you continue to YouTube" cookies popup, if they click sign in they get default block page: url: https://accounts.youtube.com but if they click "accept/reject all" the page partially loads (no video thumbnails) though you can click on a video, one played yesterday but today just gettin spinning circle lots of denied in the web filter log too but why no blockpage ?

leeds-56 and getting similar results (i.e. partially unblocked on refresh) @TriggerHappyUK nice video by the way, what software do you use to record the screen like that ? edit: just tried adding explicit block rule at top but made no difference:

I'd be happy! Our old head used to boast about coming in over summer hols to paint school to save money! Used to get me to do cabling / AV installs which I was never happy/confident about, no training etc, remember watching a youtube video to work out how to terminate cat 5 in patch panel!

does anyone mind posting what their schools spend annually on gas and electric ? We are large primary, 600 pupils, found out it's currently £30,000 but forecast is 100% increase i.e. £60,000 ! edit: would be nice to have a breakdown of where this is being spent, e.g. heating, IT, boiling the kettle etc !

we use smoothwall on site (firewall web filter/proxy) and it can do dhcp if needed (instead of a windows server)

slightly off topic (sorry) but this has piqued my interest in wanting to understand how schools are funded. Can anyone point me at an overview or summarize how it works. E.g. for an LEA maintained school is it TotalSchoolBudget = numPupils * X + numPupilPrem * Y + AnyRandomGrantsSchoolCanApplyFor X = allocation per pupil ie approx £5000 Y = allocation per pupil prem (e.g free school meals) approx £1000 Then the govs and business manager, head and LEA agree how much money to allocate to each budget pot (e.g. 3 year plan reviewed annually?) e.g. staffing (main one!), IT etc. Within IT I know we have separate budgets eg. hardware and software and we are not supposed to spend money from the hardware budget on software etc which can be a bit annoying. Eg a few years ago we had a few grand left over in hardware and computing lead was told to spend it (not allowed to "carry it over") and so some rushed purchases where made without much thought. I guess it gets more complicated given academy schools etc and differences between england, scotland, wales. Given costs like energy prices are rising will schools have to increase that budget pot and reduce another pot which could mean e.g. "letting some staff go" (not re-hiring ) to cover the leccy bill ?