Roberto

Perhaps we should acknowledge that the reputation factor can go both ways? Imagine working for a MAT that had a few incidents where their good faith throughout the bidding process was questionable, and finding that vendors refused to work with you. This could easily result in going through incredibly painful processes to end up having to accept relatively poor value contracts because only a small panel of vendors responded to RFPs and watched everything you did like a hawk. It would appear so. Their win suggests they had a case, yes. I’m not going to comment further on the specifics as my employer could well be involved in supplying services into the education sector and while all my opinions here are my own and not theirs, I’m wary of speaking on some legal or similar topics too much. I think my general comments make my feelings clear enough however.

We had a procurement manager at the college I used to work at. We had to run our college campus rebuild via OJEU bid process iirc, and that was 10 years ago. One thing I’d say is that the more you do it, the better you get at doing it, so really any complex procurement project is an opportunity for your org to self audit its ability to run a robust procurement competition. MATs should be looking at centralised processes for this stuff surely? Even in the private sector, once we go above a certain threshold we’re expected to run procurement processes in an appropriate fashion, adhere to corporate governance, etc. As for a company bringing this action against education organisations, if they genuinely believe that a contest was unfair, whether due to negligence or because of unfair practices, they’re damned if they do take action and damned if they don’t; I think if we were in the position of their executives, looking at the numbers, looking at the consequences to the company and employees of failing to win enough business, there’d be a red line you’d have to lay down at some point wouldn’t there?

Do you think Windows randomly unlocks itself when you’re not looking too?

Touch ID is quite natural. The only thing that comes more naturally than touching a mobile phone screen would be looking at it. Hence Face ID. As for checking it's locked - set different wallpaper on your lock screen from that on the screen your main apps are on. Simples. Or look for the padlock that's on screen. Or hit the power button, which should lock it. Why do you need to "check" that the screen is locked? Do you think it unlocks itself for funsies when you're not looking? Both iOS and Android allow you to configure your device to lock after moments of not being used, and the ones that support Face ID or whatever Google called their variant also have a setting that requires you to be looking at/paying attention to the phone, not simply be near it.

I'd look at either something like the Google Pixel or an iPhone SE at this point - they're both reliable, well supported by their manufacturer and can easily be managed with your MDM of choice (though as you mention JAMF this leads you to iPhones more than a Google Pixel I should expect). We support '000s of phones globally using a MDM service and a distribution system I designed and built and my takeaway from that is that while the more expensive phones have a steeper up-front price, you get it back in less support time, fewer support calls, less user issues and, let's be honest, if we're talking about an iPhone you're talking about a device that will be supported for several years which is *not* a given about older phones or feature phones - I think TechMonkey's point about feature phones that rely on 2g or 3g was very well made.

You say "better solution" but you've not said what the problem is with the current solution. How are the current phones "intermittent"? Is the lack of (or presumably disabling of) cameras a feature you require, a limit you're trying to overcome? You call it out but don't mention why you've called it out.

https://office365itpros.com/2021/04/15/test-office-365-tenant/ Create a trial O365 tenant? This will let you 'play around' with the features before burning your own trial. You can then look to using the trial licences in your live O365 tenant to set up and test your real deployment on your tenant. In the longer term I'd also look at a Visual Studio Pro subscription, what used to be called a MSDN subscription if I remember rightly. I use this where I am now (currently working in my test tenant today actually to test some stuff before live deployment) and used it when I worked in education. It actually gives you the 'proper' paid for licences, azure credits, etc, that you need to set up and test a lot of stuff before trying to take it into production use.

That will work fine but, if I remember correctly, you should have a P1 licence for each person using conditional access.

Pretty sure from what I heard at the time, this was more about wanting to set a quality bar for their platform that the OEMs were failing to do in their then race to the bottom for price & quality. This article is written by a well known Apple fanboy so it’s slanted a particular way but also contains some very interesting observations in hindsight.

We love it, use it heavily, and wouldn't want to be without it. That said, if the numbers aren't working for you then you absolutely should not keep paying for it. I think that's the key thing here - I've never minded spending money but I like to think that the money is spent well. If that stopped being the case for Prime then I'd absolutely cancel it.

Yes, completely normal. Full time contract meant full time hours - both in terms of days worked as well as hours. Exactly the same as other sectors, and it was how we used to schedule IT or buildings work that would otherwise disrupt services used while students or academic staff were working.

Agree with this so much. I’ve used the same independent mortgage advisor for years and she is incredible. A good one will be able to look across the whole market, will find deals you never knew existed, will ask you about and understand your needs and save you a great deal of time. Oh, and money.

That makes sense. Why would a standard user be able to schedule a task that affects the whole system?

Atari Jaguar Joystick/Joypad? It played a mean game of Doom back in the day...

With regards to the cloud programming, that feels like a serious potential flaw for a house control system tbh. I've had good experience in that regard with Drayton Wiser which seems to be less well known here in the UK - https://wiser.draytoncontrols.co.uk/. Their controller sits next to the boiler and continues to run the scheduled programming if your internet is offline. You can't change that programming via the app (but you could override a room to turn the radiator on or off from the Wiser TRV) when there is no internet but at least you know it's going to be sticking to what you presumably thought was a sensible routine at the time you set it!

Sounds like a fault (or at least an assumption that isn't always correct) in their laptop deployment, and I'd be very wary about poking around in other organisations' settings in your position. I'd push it back to the LA to fix properly, if only to avoid the "Jawloms at school X did something and my laptop hasn't been right since" conversation. The hacks I'm seeing people posting are very clever technically but I don't think you have authorisation from the LA to change their laptop settings, do you?

Apple II Disk Drive

I don't think there is a competitor to CC4. It was quite literally the definition of an item being a jack of all trades, master of none. It did both back end management of users and resources, software deployment and end user device management all in one place and that's a tall order. @Norphy has mentioned some very good points that I won't regurgitate here except to say/agree that Microsoft's management tools in Intune/Endpoint manager are able to help with the end-user computing experience - device management, software deployment, security/antivirus, etc. If you are (or are happy to become) a consumer of the Microsoft O365 platform then there's a lot to be said for the user experience and the ability to integrate the two and get the benefit of some vertigal integration there. User Management can be scripted or largely automated with other tools and shouldn't be too painful to be honest. In hindsight, and as someone who at the time was a staunch believer in moving to a "vanilla setup" this is a bit of a weird one. I was very happy to migrate away from RM Connect when we did, but there is no doubt that while you can gain a lot from the flexibility to use your own choice of standard tools for various tasks, sign standard support contracts, hire staff with general windows experience, you do also lose the surface simplicity of having a single viewpoint to manage the whole thing. In many ways, I wouldn't necessarily call it a saving in terms of your time and effort at all, but you do get the benefit of choosing where to spend that effort where it will do the most good in a new approach.

Prior to replacing all the locks with Salto at my old place, the physical keys were handled by the site team and while we probably would have knocked up a quick database to help them track it if they wanted, our IT team did not get involved. Regardless of the technology (or lack of it!) being use to manage it, there's a good arguement that says that site access control really should be a site team problem imo.

My apologies for my reply the other day. I've been looking into this since then and yeah, it looks like you can't prevent it. It seems odd to me, but there is actually a feature request for Microsoft to make this possible. You can prevent people enrolling devices in Intune, you can prevent them from signing in from their registered device, you can lock all that down, but it looks virtually impossible to prevent AAD registration.

I suspect you have confused AAD join and AAD registered. See https://www.how2code.info/en/blog/azure-ad-registered-vs-joined-devices/ There’s nothing wrong with Devices being registered as part of MDM onboarding.

I'd agree with this. I always advocate hugely for moving to cloud services but it isn't a magic "secure all the things" switch. It's perfectly possible to have a secure on-prem RDS farm and a leaky as heck modern cloud implementation depending on how well they're implemented. Security starts with an honest appreciation of your org's exposure to risks and the cost of a risk being exposed, leading to properly designed security policies that are applied at all levels of your org, and technology being deployed according to well-planned and robust policies to adhere to those policies is only a small part of what needs to be done.

Switch to keyless entry systems such as Salto.

Maybe there's a correlation between being a failing school in general and underinvestment in infrastructure (and not just IT infrastructure). I can certainly make a case that improving IT resources makes it easier to achieve in other areas also. After all, is there not about 80 pages of people effectively saying "people under-invest in IT when IT is now essential to running an edu establishment" in the devaluing IT jobs thread?

Yeah. Going back a long time now, I did my college's website once. The best lesson I learned from that was not to do it a second time. Also, as has been pointed out by FN-GN above, the website is a marketing task, not an IT task. Your job should begin and end with facilitating the platform if it's hosted in-house. Oh and possibly steering them away from the idea that individual contributors throughout the org will be directly editing the website, because that'a a fair contender for lesson #2 from my past experience. That idea is bad and whoever is suggesting it should feel bad. At best no one will bother, and at worst you'll get a mix of fonts; badly taken, poorly cropped and improperly uplaoded photos; editorial mistakes; dead links; and typos that will make your website look like an absolute joke.