forkies

On the CVE for PrintNightmare it states about the fix prior to them releasing the Update. On the fix it lists 2 workarounds prior to the update to protect against the vulnerability: Option 1 - Disable the Print Spooler service - Obviously not an option if you want to print! Option 2 - Disable inbound remote printing through Group Policy: Computer Configuration / Administrative Templates / Printers - Disable the “Allow Print Spooler to accept client connections:” policy to block remote attacks. So if I am thinking correctly, by disabling the GPO option, then you could apply the RestrictDriverInstallationToAdministrators to 0 and although it opens the vulnerability you are also protected as you have applied the GPO to disable client connections? Or are we concerned that users may install a rogue printer driver from the server/a server? But hopefully this is very unlikely if the existing point and print restrictions to limit which servers are trusted is in place?

Thanks, found an article in the end detailing the issue as you have said. I have decided to deploy it via the MSU for the mean time in SCCM, will await the MS advice while we use the work around. Thanks! Tom

We have had a bit of a lapse in our windows update and have since resolved this, however we have just tried to deploy the June Cumulative Update (KB5003637) for our devices and it is coming up "Not Required". Having delved into this we have found it is because their is a prerequisite for this to have the May CU update (KB5003173) installed. If we download the MSU for the May CU and install it, we can install the June CU. However, we cannot deploy the May CU via SCCM as this has been marked as Expired and Superseded by the June CU. Given we have not deployed the May CU due to some issues with windows update, we are currently sitting on a OS version from March 2021 (KB5000802). Has anybody else come across this issue? We cannot deploy May CU as it has expired, but we cannot deploy June CU as it requires May CU on the device. Thinking of just deploying the MSU for the May CU to a device group targeted by OS version just to get the update out and then can deploy the June CU as normal. Any advice would be appreciated. TIA, Tom

Second EduLink. Would do 2 of the 3 on your list and cost wise we saved money just moving from Groupcall messenger to EduLink, then we also closed down about 3 other products which EduLink as a system covered, so overall we made several £k in savings each year.

We use ticket tailor for a few things, it’s free if you don’t charge (which I assume is the case for this!) and easy to setup an event. https://www.tickettailor.com

I believe it is in the webinar, the handbook and on the gov website regarding lateral flow testing. However it appears they have now reduced this to daily/serial testing. However, noting if you have a positive then you instantly will go into serial testing and they will have now had close contacts being in a classroom if you do not isolate them. From the FAQ document: “anyone tested as part of the daily/serial testing of contacts programme will need to wait somewhere before being allowed to begin normal school/college activities until they receive a negative test result”

Still X code. If they are vulnerable or key worker then they should either be marked as present if in school or C coded if not in school, instead of X coding if not. But all other students still X code.

No as never got a solution to our issue. Now lockdown hit we probably won’t be looking at it until next year.

Yes the mobile and email! The two main fields needed to be accurate so would be best for copy paste instead of manual entry which could lead to errors. Also we have some staff who do not have a mobile number, but this is a required field on the form, so not sure how they are supposed to register.

24 hours to register the test subjects. One barcode should be on the LFD cartridge, one barcode should stay on the reg card for the student/parent/staff member to register themselves, this is so they get a text/email with the result (instantly upon the school scanning onto the Test and Trace system). Everyone who gets tested MUST isolate until they get the result, so you either need a lot of staff registering the students or the students/parents registering themselves. As it is well publicised that it takes 30 mins for results, anything over 45 minutes for them to get the result notification will be scrutinised and complained about. Test and Trace will contact you if you do not register people but upload results, or if results are uploaded too long after testing. It’s not very well thought out for schools/young people being tested unfortunately! Lots of barriers to this so far which is likely to slow down the flow rate.

A mix of excel online and forms, plus a quick flow. Registration assistant enters using a barcode scanner the student admission number and lfd barcode which pops it in the excel online file, there is a merge in this from a similar entry at the recording assistant desk. Any positives or voids are handled by another laptop if the student is to be in school (key worker or vulnerable) so can see live if the student is negative, void or positive. Good luck!

We had an issue like this with our Smoothwall. This was confirmed when we moved from NEC to 3CX and the issue persisted. We actually found we were dropping packets for a few seconds every so often on the WAN link and that the port on the Smoothwall was showing down then up instantly. Smoothwall failed to resolve and I ended up spinning up PFSense to route all our SIP traffic and essential services through, not had a single issue since. I only route filtering via the Smoothwall now as that has less impact. Will be moving away from Smoothwall next year with our renewal due. I would suggest checking the system logs on the Smoothwall around the time of the loss of voice and see if it shows your WAN interface dropping and if so good luck getting it resolved without doing what we have done.

Going to have a meeting tomorrow, but I think this is what I am going to propose: -Teachers isolating not symptomatic, to check cover list and invite in the covering teacher (saves us adding the cover teachers to the teams). -Teachers unwell, then supply teacher to be added to the teams - list from Cover Manager to be clear on this. Should be a lot less of this so much easier to manage. -Head of years to be owners on all form groups so they can arrange cover of these Teams as they occur first thing and more of a pastoral related management concern. Further, I have tested and if I manually add a Owner they are not removed as you said, so that is positive.

Thanks, the issue is getting the data in a format that works. I am going to be sent a list in some scribbles and so the time consuming bit will be actually entering the data. It is just as much the staff who are employed as the ones who will be external to cover, so Teacher A may be covering 2 lessons one day but then its Teacher F that is covering that group the next day. Along with Supply 1 in between. A right mess and means assigning various teachers/cover accounts to various Teams and changing it every day based on a list I will get at 8.15am in a rubbish format to be ready by 8.45am! Then it is removing them afterwards, keeping track of what needs removing and when, as some will be covering longer than others. We don't want them all getting notifications from the other Teams when they are no longer teaching that group.

New issue is I have a teacher who is on SDS csv newly assigned to a team but when the sync completes he is not being assigned to the group, have looked and all is correct on the CSVs but SDS isnt updating it! I thought I saw somewhere that it removes those who come off the list, so assumed this would affect manual additions too. I will give it a try.

We use SDS to create Teams from Sims. When staff our absent/isolating I am now being asked to add the covering staff/supply staff on the Team so they can either teach the students who are isolating or to show the students who are in class on a laptop the Teams lesson from the teacher who is remotely teaching if isolating without sypmtoms. How are you all dealing with this? From what I understand, if I add a person on Teams and then run SDS it will remove them as they are not on Sims. So we are looking like we will have to forget SDS and go manual to avoid wiping out our manual changes. Further, each morning, we will have to manually assign the cover/supply staff to each class they are covering. I can see this taking a lot of admin time each morning and with students chaning sets or joiners. Are you also removing the covering/supply staff from the groups when they are no longer covering (the next day or week)? Feedback on what you are doing regards this and how much time it is taking would be appreciated. Thanks, Tom

£7K for 1Gb/1GB with Southern Comms, over an Openreach circuit. Definitely worth going up, we used to be on a 20MB LEA circuit, before going 100MB then 300MB and finally 1GB

Found it here: help.e-safesystems.com:82/kb/index.php?action=artikel&cat=30&id=162&artlang=en

Hi all, For those of you with SignInApp, do any of you allow your sixth form students to leave during the day (we let ours go to the local shops), we want to buy the Sign In App and use that to get these students to sign out and back in during this 30-40 minutes period. My question is, how does this work? I spoke to Sign In App and they suggested that when the student signs out, it will input a session mark (predefined by us) to state they have left school, but when they return it will not overwrite that code. So what do you do about this? Interested to hear before we purchase. Thanks, Tom

Have you got nec licenses for the phones on the phone system? This licensing model is exactly why we started looking at ditching our old nec and ended up moving to 3cx, plus better features and ease of management.

Anyone contacts us about CPOMS I just close the ticket/reply to the email with “we do not manage this, contact the safeguarding team”. (Even when it comes from the safeguarding team!) Because it is basically a usb stick, which means it is IT, which means we pay for it. It’s ok, I just don’t replace their computers as often to save the cost and some.

When we got CPOMS I asked about all this and I was so happy when they said “we recommend IT not having admin access as it is a safeguarding system”. So the DSL is responsible for anything to do with CPOMS now and she does all the staff account management. Obviously I suggested sso but if they aren’t providing it, and this is the system my safeguarding/LT want to go with, then I am more than happy I am not responsible for it. Only thing that annoys me is the USB key which comes out of my budget, would be much easier and cheaper to use the authenticator app.

You cannot set delegation mailbox access between hybrid environments. The shared mailbox and the user mailboxes of those that need access all need to be in the same location (either all local exchange or all O365).

I have just been looking at similar (moving from NEC). We have gone for 3cx as cost was too high for MS and didn’t fit the bill for our needs. I’d recommend looking at 3cx.

Ours have a laptop loan agreement which they must sign when receiving the laptop, however when they eventually come back to me saying it is broken and they "don't know how it happened" but it has been like it for weeks, I go to the BM and say and they tell me to just replace it. We have only once charged a member of staff for a laptop when it was significantly damaged just before they "left" the school. I usually try to give them a worse (older, hand me down) laptop when they break their laptop. Then they whine about the fact it is super slow and old, usually resolves the issue of them not looking after their laptops. Doesn't help with a certain member of LT who has been through 4 laptops in 3 years and about to have another one!