Roberto

I volunteer for my church to help with what is essentially after-school clubs there. I enjoy it precisely because it's a change of pace from what I've been doing all day at work. I also help out with tech issues - in many ways the problems are not dissimilar from what I see here from small primaries with modest needs. I'd hate feeling constrained or obligated by these volunteering efforts, in both the above cases I'm not the only one doing it, it managed without me before I started and will manage without me if I stop, so it feels like volunteering rather than something I'm pressured into.

I've got no problem with USB-C as a charging cable for my personal devices - or anyone's really, as we tend to take care of our own stuff. Even stuff that's issued to you 1:1 you might take more care of. But yeah I'd hesitate over its use for shared devices in a charging dock, people will use the cable to pull on the laptop, shear is going to happen because its unrealistic to expect people to pull perfectly straight at all times... Not a good combo.

In fairness, I can imagine this being bloody distracting if the extended desktop action has put screen #1 on the projector display/TV screen behind you. Not everyone is comfortable with touch-typing (and even if you are, if things aren't perfect this would be a great way to end up typing your password into the username field in front of 30 students, all of which are going to laugh at their teacher and some of which will use that password for mischief before the staff member realises and changes their password. Whatever else you can say about teaching, it's worth remembering that they're essentially putting on a performance for each class they teach, and it doesn't take much to get some audiences in the mood to heckle the performer. And some actors can easily be put off their performance if the stage isn't set quite right.

When all's said and done, we live in an imperfect world and if you make a selection of S2D with 2 nodes with awareness of the limits/weaknesses vs. your budget restrictions, I think you could defend that choice on that basis.

This is where my mind went - can you get a third-party warranty in place? It does somewhat depend on how well the systems are meeting your needs outside of warranty concerns, and how old the systems are already. There's a huge difference between something that was purchased as "up to date" kit 4 years ago that still meets your needs and could easily have another two years third-party warranty vs. something that is 6 years old, was a bit underspecced due to budget in the first place, and has its rivets popping already. And of course make sure SLT understand that this is you mitigating risk, not necessarily the 'new normal'.

I’d suggest using it as a guide- take the time to understand what the items being scored are actually saying and then produce a measured response/ plan of action, rather than blindly chasing a number. microsoft’s gamification of security is all well and good for getting you interested, but make sure you’re not missing something vital in your security posture that isn’t measured by secure score because you’re busy trying to make a number go up.

A3 as others have mentioned. In addition to unlocking all the functionality to review with just one A3 licence, you can of course purchase A3 then unlock the A5 functionality with just one licence, to decide if you want to pay for it (some interesting stuff around risky logins, etc). But A5 isn't required.

Not in education but we have at least equally strict data requirements. We do this with Entra ID Conditional Access. This allows you to check the device being used is a corporate device, it allows you to ensure that only apps that can further have their settings managed (e.g. the Microsoft app stack and a few others) can be used to access data, that devices can be marked 'lost' and blocked, all the good stuff. You can further make a general requirement that apps must support entra ID SSO which allows you to bring them under this tent quite nicely, and if you are obliged to have one or two exceptions (lets live in the real world and acknowledge exceptions will always be with us) then you can in theory spend more time managing risk from these exceptions because you've managed everything else in Entra ID. I personally feel this - or the equivalent from other product stacks - is pretty much a basic requirement to be handling sensitive PII.

Same. I always liked crucial as a vendor that gave good value for decent goods, both personally and professionally. I guess you can't blame them for going where the money is, but what a shame.

Requirements without the resources to back them up are just empty words right? I reckon we can all agree with that. It's at least blind optimism even if it is meant in good faith.

KCSIE isn't new. I was worried about that back when I worked in education which is starting to be a good while ago. With regards to the costs of things, I know many schools are seriously financially constrained but, picking on your example above, I'd say £800 a year to keep my then employer off the front pages of the paper tabloids and websites like the register for the wrong reasons was excellent value for money. I'd be thinking about whether you could consolidate a few services either with a current supplier or a new one to reduce complexity and hopefully costs as per the LGFL example others mentioned.

Yeah but just think of the advantages - for Google mostly - if they can get it right. They're not going to stop trying until they can make it work.

Honestly it feels like something that shouldn't happen in 2025 The forum software managing to bring the irony.

Hard of hearing myself and I echo the comments about wearing some kind of ear protectors. Take care of your ears and eyes. I think we're all aware of watching out for our eyesight but hearing is insidious - you don't notice damage here so easily until its too late.

I think if I were inventing and naming it, it would have been called something like IA - Intuative Automation.

I used SwitchShop when I was in edu, and used Redway relatively recently for a very high profile office fit out, I guess 18 months ago. Both are companies I would 100% work with again.

We tend to flip between 512 and 256 depending on what our vendor has in stock of our model but then we're a business with 1:1 allocation of devices, not a school with shared use. 256Gb is a bit tight for us with some users' software needs and profiles tbh, so I'd be wary of that size for shared use.

Not sure but they could contrive some kind of peacekeeping role post the war between the sea devils and humanity that they're pushing as a spin-off. Maybe not tied down unable to travel at all, but limited in duration or distance that could be travelled. Or who even says it needs to be earth? Tthough the advantage of earth of course is that you don't need to have half of each episode be exposition to explain how, I dunno, the banking system works on the world of "Wibble" in order to establish that something bad has happened to the Wibbleonian banking system due to aliens (maybe even human invaders, who would be alien to the Wibbleonians) that the Doctor needs to fix. Are there any fans of Charlie Stross here? I had the pleasure of listening to him talk about the Laundry Files series once, and about how he has a real problem with writing new fiction in that universe because the main protagonist has essentially become overpowered and can address anything he faces with essentially "God Mode" abilities. Hence the "new management" spin-offs from that universe that he's writing.

What would be interesting in terms of improving writing would almost be limiting the Doctor's ability to travel the way they did for Doctor #3 back in the day. The problem with being able to go anywhere, anytime is that the writers almost have too much choice. Every episode becomes the equivilent of a "very special episode in which "the crew" of your favourate show somehow all go on holiday together".

Ah ok. Perhaps we're focusing too much on the "BYOD". Let's back up a bit Radius auth - you should be able to authenticate trusted devices (AD joined) via RADIUS or Certificate auth to a SSID reserved for those trusted devices. So you authenticate the device to join the WiFi network and login proceeds in the normal manner once that's happened. You'd want to isolate this SSID for LAN connectivity. For users with BYOD devices, phones or whatever, you'd have a second SSID with some firewalling/VLAN config that just routes them to the internet so they can use whatever you've published for essentially home use. This is pretty much "how it's done" these days... except my employer's actually gone with captive portal for the BYOD network rather than having to deal with people wanting support for getting their unexpanded VIC=20 to connect to wifi via an AD account...

Yes. Then don't do that. BYOD might work for letting them use an isolated internet connection to hop on to your cloud provider of choice to work on documents that way, that sort of thing, but you'd have to be insane to let them connect to your actual LAN because of security, safeguarding and GDPR. And that's just 3 show-stoppers I've thought of in about 40 seconds of reading this.

Software and patch distribution? Tanium.

Oh yeah. 100%. But OpenAI hear you. OpenAI don't care.(*) (*) neither do the rest of them, not singling out any vendor as worse than the rest here!

I suspect the answer they’ll give you is to use ChatGPT enterprise. We’ve (not a school) done this to allow us to control sign-ups from our domains, to avoid unauthorised use and to avoid our sensitive data being used to train their models.

Why not just use the %serial% type template then log serial to room in whatever hardware database you have? Much easier to move a machine in the event of a fault if you don't have to fiddle around with renaming the device in Windows/AD/EntraID too...