Roberto

I've had confirmation that academies are eligible to join or remain members of JANET/JISC. The site hasn't been updated yet.

I use a JANET connection (I'm the Infrastructure manager at the 6th form College @Norphy used to work for). The connection is great value, is very reliable to the point where outages are a "once every few years" event at the absolute most. Support is first class, responsiveness of the people providing the support is quick and their knowledge of the system is great. Their monitoring of the connection is fantastic and they will give you good visibility into the connection stats for your connection and all the other links from the JANET network out to the Internet at large (they have several) and they have direct link pipes into major providers such as Amazon/AWS, Microsoft/Azure and so-on so connections to these services are both highly reliable, fast, low latency, etc. I would always use JANET for the internet connection anywhere it was a possibility. If you're able to be part of JISC as well as a JANET user, there's also some very good value to be had out of things like Eduroam, their certificate purchasing services, legal services, ATHENS, and so-on.

I remember watching all these first time round and loving each episode. Have to say, much like 70s Dr Who, the sets and special affects haven't aged well...

I'd never say "never" but I suspect the chances are approximately equal to those of Elvis not only being alive but of being seen by scores of independent and reliable witnesses in Hyde Park riding Shergar.

There's an explanation here and a "streamlined" guide here on the technet site, which will hopefully be useful for anyone seeing similar issues. This should still have been in Windows 2016 unless you're using the absolute latest build hot off the presses, but upgrading ASAP (ideally before promoting a new DC) is still the right way to go to fix things.

Luton Sixth Form College is looking for a full time IT Infrastructure Engineer to join our Information and Technical Services team at the college. To apply, visit our advert on www.fejobs.com and click the "How To Apply" link. Salary is the Sixth Form Colleges’ Support Staff Pay Spine point 36, £28,680 rising to point 39, £31,054 with annual increments based on service and performance related criteria. Working 37 hours per week Monday to Friday between the hours of 8:00 am and 5:00 pm, full year, a degree of flexibility is required. You will support and develop the College’s core IT systems including: • Managing image deployment, patching and management tools for servers and workstation using SCCM • Maintaining and developing the College virtual Hyper-V infrastructure and central backup systems • Installing and supporting the College’s server and network infrastructure, based predominantly around Windows Server and HP Procurve switches We are looking for a candidate who: • Has a degree or equivalent level of education for the post • Has an MCSA or equivalent experience Start Date: 2nd January 2018 Closing date for all completed applications: Monday 4th December 2017 at 12 noon Interviews planned for: w/c 11/12/17

It's perfectly reasonable to respond with "that information is on our website, see..." and I'd probably suggest that publishing data for FOI requests online and pointing people to it is quite a smart move - you're making the information freely accessible after all - and you can point the next person to ask how many left-handed teachers you have who are also glassblowers in their spare time at the website where you've already published the answer. It's not reasonable to choose which addresses you will accept FOI requests to. Staff need to set OOO and be aware of who to forward requests to as a matter of urgency internally.

You've got things slightly backwards: ADFS doesn't sign you into office 365, rather office 365 should forward authentication requests to your ADFS server. I'm not merely being pedantic, with that statement but rather trying to say that what you're describing isn't entirely clear; what actually happens when your users log in? Office 365 needs to be configured to authenticate users against ADFS instead of its own Azure AD objects, for example. It works here and users on-site connect to Office 365 and everything else we've federated via ADFS. We'd regard any user being asked to log in (not simply being confronted with a login screen if they browse to https://portal.office.com, but actually then having to type in their password) as a fault in our systems that should be fixed, provided they're using a supported browser. Have you read https://gallery.technet.microsoft.com/Setup-Office-365-Single-1016583a

On most busy, modern networks that's damn close to being a paperweight, and I notice even that's been disputed. We review and change our switch and wireless configs on a fairly regular basis (I'm doing it today in fact) and not being able to change settings on switches or wifi would cause absolute bedlam here. I've got no problem with firmware updates and the like not being available outside the support contract, that's what it's for, but the idea that I can't actually manage my network then? I *don't* think so.

I know this sounds extreme but I agree completely. CCTV is a potential minefield and every moment the CCTV is running without knowledge of what you can and can't do and who does and does not have access, and under what circumstances, you're really not far away from a very expensive foot in the wrong place.

While I think he only had one #1, I think he had a good number of top ten hits here and abroad. I think any list of one hit wonders that includes Rick, A-ha and Dexys has very little credibility.

We have 40-something switches, most of which are chassis based. Even with switch management tools, I really would not want to manage the corresponding number of 1u non-stacking switches; it would be about 200+ switches, a nightmare.

Hi Gareth, We have our users, staff students and guests, all authenticate to our local implementation of eduroam wireless which uses RADIUS auth. We then can use RADIUS accounting info to send the IP and user details of the user to our firewall which then knows who they are on whatever device they use without requiring anyone to authenticate further. It's then easy to say that staff BYOD devices get the staff filtering settings, students get normal student settings, visitors get a general 'guests' policy and all activity is logged against IP and user ID for future reference. We're worried about both accessing and posting questionable material in terms of both safeguarding, cyberbulling, prevent, and we're happy this is a decent answer to our needs.

The pricing for SonicWALL is pretty keen still I would say. I've been happy with it from both a price and performance/behaviour aspect.

Happy to see I'm not the only one considering ubiquiti for home use.

These people need to be found and stopped. Locked up in a cell with a faraday cage around it, if that’s what it takes.

You will need a server communication certificate for the ADFS server itself (and any web application proxy you're also using with it) that allows clients and relying trust partners to connect securely to the ADFS server. This is what will will allow the server to communicate over SSL/TLS This will need to be a valid certificate for the FQDN of the ADFS server both internally and externally, and should probably be from a public certificate authority. I would suggest using a name such as federate.nwhs.uk and buying a certificate soley for that URL rather than using a wildcard, though wildcart certificates should work if you already have one handy. As for how you publish the endpoint to your users' devices, I would suggest making the same address valid for the server internally as well as externally, e.g. wherever clients are they will need to redirect to federate.nwhs.uk for authentication and you may need to do some fiddling with DNS to make this work if you are using a different internal and external domain name root. You will also need token decrypting/signing certificates, which can be generated by the ADFS server itself if you choose. These will not be trusted by third parties, though this actually should work for most ADFS scenarios. If you do need to get a publicly trusted certificate for these too, I would say it should be a different certificate to your service communication certificate. Microsoft have some more info on their website: https://technet.microsoft.com/en-us/library/dn781428%28v=ws.11%29.aspx is a good techie dive into what's needed https://blogs.technet.microsoft.com/adfs/2007/07/23/adfs-certificates-ssl-token-signing-and-client-authentication-certs/ is older and written with an old version of ADFS in mind but has a very clear explanation of certificate requirements.

IIRC, educational use exceptions involve using the item for actual educational use, for example a dance class using a particular track in their performance. The organisation creating a video itself, e.g. a promotional video, and uploading it to a website such as facebook or youtube is more like public performance of the song and wouldn't be covered. https://www.gov.uk/guidance/exceptions-to-copyright and Copyright User – Education spell it out fairly well. Note the phrase clarifying teaching / educational use as "for the sole purposes of instruction" on the second website, along with the paragraph on public performance that I've extracted below:

CMDB is short for Configuration Management Database. It's a key concept in IT management frameworks such as ITIL or FITS. It is (or can be) quite a bit more comprehensive than what I've normally seen included in an asset register, in that a CMDB can hold all kinds of items and establish relationships between them, e.g. you can have entries (known as CIs, for Configuration Items) for different items of hardware obviously, but a good CMDB will allow you to establish a relationship between them, so allowing you to tie together a keyboard, mouse, monitor, desktop and printer as all being associated with one another and also a particular person or location (both of which can be CIs too). Moreso, a good CMDB will tie into, or is built into, helpdesk software and allow you to monitor, manage and even predict faults in individual CIs or even classes of CIs (e.g. if you run a report showing that a particular model of desktop PC is failing at a high rate, you can pinpoint an underlying fault (e.g. bad batch of RAM) and use that to predict which other models of desktop might fail in the future and manage the repair of all the affected items in a controlled manner. CMDBs can also be used to manage software licences and if you tie both hardware and software into your CMDB, it's possible to build up a detailed picture of how each PC or laptop in your system should be configured, what should be installed on it, etc, and then use monitoring tools to scan devices on your network and flag up anomalies. Or if you're really feeling fancy, automatically remediate the issues it finds.

What are you actually trying to achieve here? The non-cortana black search box is what lets you type, e.g. ‘word’ and have that appear as a shortcut to launching word quickly instead of having to click all the time. Is there an issue with that? its what ours are set to use and I hope I haven’t missed an issue with it!

There's quite a lot of discussion of this on Reddit's /r/sysadmin and /r/sccm among others. The general consensus is that the LTSB version of windows is a poor choice for a general desktop or mobile deployment for a number of reasons: Only security bugs will be fixed. Having trouble with terminal services client or some weird issue with the shell after you've rolled out LTSB? I hope it's a security issue because if it isn't, your users will be looking at it for a long time.[/List] Apps like Calculator and photo viewer are being moved to universal apps. Regardless of your opinion (I'm not really a fan), that means these apps won't be in your LTSB deployments. You're either hacking around trying to make copied over old versions of things work (and remember, good luck if a security fix breaks your hack to get calculator working because only security holes get fixed in LTSB) or your users are going to be asking you why they can't open calculator. Third party applications might make assumptions about Windows that are true in the main service branches but aren't true in LTSB; e.g. updated shared libraries. IIRC, MDM isn't supported on LTSB, so there might be implications for control of laptops/windows tablets outside the building. In fairness, it has taken a fair bit of effort for us to produce a Windows 10 Enterprise build that we're happy with, to roll out this summer. We've made heavy use of tools like the poweshell script Fazza mentioned earlier, but even there we started from a presumption of "Universal apps all suck, delete the lot" and ended up putting a few back on.

I think the runaway .vswp file is your problem. You might want to see if https://community.spiceworks.com/topic/1410685-vmware-vswp-files-and-datastore-disk-space-capacity helps.

This does sound like a storage issue. How is that handled? Could some part of that chain of components have dropped offline?

I'd suggest the idea of wanting end users to supply BYOD devices that you're going to lock down as if they were the organisation's devices won't fly with everyone. It certainly wouldn't with me. Remember BYOD is "Bring Your Own Device", not "Buy Your Organisation's Devices". I think this could work on a greenfield site if you went with the organisation providing Chromebooks or iPads or similar from the get-go. What would be the objective for all this? I can see the attraction for a MAT for not hosting everything locally on one or two of its sites in order to ensure that the whole MAT doesn't lose access to a shared resource if something goes down but you are going to be moving from a huge capex spend (to buy traditional servers and workstations) to a huge opex spend for the services you're buying in, along with a serious capex spend on network infrastructure to provide a robust enough LAN to support this kind of set-up. I think I'd go for a hybrid approach; there are some things that might benefit the staff and students more from being hosted on-site, and some things I certainly wouldn't expect to see hosted on-site these days except for legacy installations... email is an obvious case in point where I don't care how good someone is at hosting Exchange for themselves, Microsoft are going to be even better at it, and google better than all of us at hosting non-exchange email.

If it's all the same managed service provider, want to take a bet it employs two consultants who know how to write scripts (whether human documentation or a bunch of powershell say) to do things like clone drives, move data, etc. and eight "consultants" whose specialist technical areas are lifting heavy objects into and out of racks, and how to run a powershell script or follow documentation to the letter.