smarties11

Yes we use Freshdesk (free)

Hi All, I was wondering if anyone can recommend an off-the-shelf job ticketing system to use for reprographics requests? We are already PaperCut customers so have requested pricing on their job ticketing module, however this will mean an upgrade from NG to MF for us too so I expect it is going to be extortionate! Any other products out there? We could build something in house with Power Automate / Forms but just looking to weigh up the options! Thanks

Working here now on the new blocklist Thanks for the speedy fix! Was it an erroneous pattern triggering the ads category?

Definitely believe that the 'advert' category is being falsely triggered (by whatever URL pattern rule has been added / changed) rather than it being an advert server cert. SISRA and gov.uk don't have any adverts on at all and they're the two sites that brought the issue to our attention this morning. Have only seen it triggered here when attempting to upload or download - browsing to the gov.uk page to upload our VAT return, browsing to the upload page in SISRA to upload assessments and clicking a link to download a data destruction cert from our asset disposal company. I've not seen it triggered yet in general browsing but others may have??

Example...

Yep same here, seems to be mainly when uploading / downloading things on a secure site, we've had the same issue today with SISRA (upload), VAT on gov.uk (upload) and our asset destruction company (download). The fix for all three was to add those domains to the HTTPS inspection exceptions list. Both Edge and Chrome were reporting these as secure sites but with some non secure elements? So I think the issue is something to do with HTTPS inspection and the adverts category somewhere?

Hi All, Has anyone been through a full finance audit since ISA 315 was updated with regard to IT processes and their impact? We've been handed a 'questionnaire' by our auditors, which isn't actually a questionnaire but a blank table with some examples. They are suggesting that we need to complete the table, listing all IT processes, risk assessments and what system they relate too. And to do this for all systems we use across the School. So essentially looking at every system from the POV of permissions, user access, authentication methods, risk mitigation, security, backups etc. I've questioned whether this should only be for systems relating to the production of financial statements (as my research online would suggest) but the auditors have said it needs to be everything, giving examples such as "teacher laptops, next of kin information and online student attendance recording". I just wondered if anyone had any experience of this yet, as to produce that for all of our systems and processes would be a large time commitment, and I wonder if the auditors themselves have got the wrong end of the stick. I've read ISA 315 appendix 5 and to me it reads that it only covers processes relating to the production of financial statements. We've asked for an example of a completed questionnaire but they say they can't find one (?!) and have instead just given us a one line example of a single IT process for one system. Appreciate any pointers - if it has to be done with all systems in scope, then it has to be done, but don't want to do it unnecessarily!

Thanks everyone for your input. I've passed on to our FD.

Hi, We are using SIMS.

Hi All, I've been asked by our FD to get some input on recommendations for document management / paperless systems in Schools. The initial requirement will be for finance (paperless handling of invoices etc) but likely to expand into other areas. Would be interested to hear what other Schools are doing on that front, and how they find it. Also - are there any good Facebook groups / online forums etc for Schools finance that I could point him in the direction of? Thanks

Just to come back to this and update for the latest 2023.8 version. Essentially the same however.... - The VCRedists can be handled in the same way, so update the list above with the latest filenames OR you can use the VCRedist PowerShell script to manage your Visual C++ lifecycle (https://vcredist.com/). I use this method and then deploy the latest supported Visual C++ runtimes to all PCs and update them when required - The fonts MSI package doesn't inherit todays date now when it's cached to the c:\windows\installer folder. It will be dated around the time of the Sibelius release. You can verify this by attempting to uninstall the fonts package from add/remove programs in control panel, when you get the UAC prompt it will tell you the name and location of the MSI Hope this helps!

Nope, spent hours researching it and then just got staff to enrol manually 😆

Immutable backups weren't a deal breaker for us as we do cold backups too, using an external SSD rotation which I change each week. But as you say, they are coming in V9 which is in beta. GFS wise I guess it depends what you need to achieve? We retain all daily backups for 90 days (both on NAS and cloud storage) and then we use GFS to keep a monthly archive of the critical data (MIS, documents etc) and we've found that more than covers our needs. Obviously now most Schools have a significant proportion of data in the cloud this needs to be considered too. We use Barracuda for M365 cloud->cloud backup, and then I also use the (free) Active Backup on our Synology NAS to keep an on-site copy of all our M365 data too. I use the same NAS for this as we use for Altaro.

I'd 100% recommend Altaro in conjunction with Wasabi as the cloud storage. It works out very cheap, much more so than Veeam. You can also buy Wasabi now through the UK reseller, Autodata, to avoid having to pay by card. Autodata will invoice you and take payment by BACS. I put quite a lot of detail about our Altaro setup in this thread http://www.edugeek.net/forums/security/223075-backup-strategy.html if you're interested.

No, we just have our backup share on the NAS set so that it can only be accessed and written to by a single account, and the only place that account is used is in the backup software (Altaro for us). So a hacker would need to extract the credentials somehow from the software itself. On top of that we also keep cold backups on an SSD rotation which is rotated weekly. No need for any fancy scripts to disable ports etc, you can guarantee they'll let you down when you're doing an urgent restore!

Thanks for the feedback everyone. I'm inclined to allow our staff to use it for training events but continue to mandate Teams for meetings. I was just hoping that there might have been some updated guidance somewhere to that effect from GOV.UK. I'd hate to be in a position of vulnerability with this, where our cyber insurance was saying we had gone against the most recently published advice on using it in a public sector environment!

Hi All, During the early stages of lockdown, both the government and GCHQ informed the public sector not to use Zoom due to the security holes in the product. We weren't using Zoom for anything, but at this point I actively blocked it on our web filter and advised anyone wanting to use it to use Teams instead. I know that Zoom worked hard to address these security holes, but I've not seen any updated guidance on this. We're getting more and more requests from staff to use Zoom in School, usually for staff training but sometimes also from external agencies. For the latter we tend to use Teams and set the meeting up from our end, but for the former we don't really have much choice if we want to participate in the training! I'm guessing the reason why Zoom is popular for this is because they can use the free version? I have no major concerns about this use case, since staff training is usually generic with no personal content relating to individuals. I was wondering if anyone had come across any updated guidance on this? I've done a quick google and can't find anything official beyond 2020. Thanks!

All good here this morning. We've had no issues since early hours of Sat morning.

We came back online around midnight and it's been stable since, I've been able to run the offsite backup copy jobs successfully this morning and all our overnight cloud sync processes ran correctly. It looks like they know where the issue is now and have perhaps isolated it. Latest update is that BT are enroute to their node 4 datacentre. I hope this means things are looking more positive for Monday! It's certainly made us reevaluate, we're pressing ahead immediately now with a backup line, which was in the roadmap for later this year.

Lincolnshire School here down since 1.30pm yesterday. Connection is live but very slow and intermittent. Called immediately at 1.35pm, was on hold 20 mins and ticket logged at 1.55pm. NASSTAR treated as isolated incident (advised to reboot router etc) despite me informing them I had confirmation from several other local Schools that they too were affected, but because they had no central comms on that they could only treat as isolated. A parent ticket was raised by NASSTAR at 2.55pm, recognising a central issue, almost 90 minutes after the incident began. Contacted emPSN to express dissatisfaction and was advised that they became aware of the issue at 1.30pm, so a bit of a communications issue here resulting in NASSTAR wasting time logging individual tickets and advising customers of isolated incident. Recent updates seem to suggest a sync issue between their pair of resilient (ha!) firewalls? There was a period of time whereby comms between emPSN and NASSTAR was being appended to the parent ticket and then being distributed to Schools via e-mail. It seems there were issues around 9pm or so whereby there were no Schools available for testing, NASSTAR giving the impression that they were giving up until the morning, with emPSN expressing concern over this in terms of a long period of downtime not reflecting well on them when they are in the middle of recontracting their customers. Someone from F1 in Lincoln then offered their services for remote testing (they support many Schools in Lincs particularly primaries I understand) The case then seemed to hinge around a commscare engineer who was due to arrive at 11am this morning (I believe he arrived slightly earlier than this). Most recent update suggesting firewall sync issues. We had service restored at 18:18 this evening but only for a period of 10 minutes, it seems this coincided with them hard resetting the firewalls and re-installing the IOS looking at incident timings. I'll be very interested to see the post incident report on this and have requested to be on the distribution. I'm sure the issue is a complex one however this level of downtime and impact on Teaching and Learning just isn't acceptable. We already have plans in motion for a redundant line however this won't be until later this term / early next. We have a SmoothWall which can handle the failover and firewalling, we'll likely use Lightspeed or YouFibre who are in our area (and have already run fibres into our BT manhole on-site) and offer 1gbps speeds so much faster than FTTC.

Yes, e.g. https://www.network-cabs.co.uk/accessories/recessed-extender-brackets

Hi All, Came across this today - and wasn't aware myself so a heads up really. By default, Microsoft allows any users to domain join their personal devices to your Azure AD. I wasn't aware that this was the case. With Windows 11, 'connecting to work or School' is part of the initial OOBE setup with a new machine - and users that do this innocently, probably expecting it to just set up their e-mail account/OneDrive/O365 end up with a laptop that is domain joined - and is then fair game for remote wiping, InTune management etc. This became an issue for one of our employees yesterday, as her laptop brought up the BitLocker recovery screen. Despite her using her personal Microsoft account to sign-in to the laptop, the recovery key wasn't saved there. Thankfully she read the MS article on recovery keys and got to the bit about work/School accounts and asked the question of me - I was dubious at first but indeed her recovery key was in our AAD, because she had 'connected to work or School' on the Win11 OOBE. It is possible to prevent this happening in AAD at Devices | Device Settings, as below. This setting shouldn't effect user-less domain joins e.g. hybrid, autopilot etc - however I can't test that as we use SCCM here and haven't moved across to InTune (yet). Hope this helps some others.

I think I've reached the limits of my knowledge on this one.....I've tried converting both to HEX and there is no pattern with swapping the bits round. I've set the app-tap to read in Hex, Dec, Dec10 and Net2 formats and compared those values both decimal and Hex. I've converted Net2 and the codes returned by app-tap to binary and then overlaid them to look for a pattern (nothing). I've tried little->big endian conversions and again nothing obvious :-(

Hi All, We've recently purchased Sign-In App visitor management system, including the 'app-tap' proximity reader. It's all working really well in my testing. However, one pitfall I've come across is with the enrolment of our existing Net2 proximity cards. I had expected to be able to export the Net2 token codes from Net2 and then transfer them into Sign-In App. Unfortunately this doesn't work, as the code stored in Net2 is different to the code that is read by app-tap. For example, in Net2 I see a card code of 55263203; if I transfer this into Sign-In App and then use app-tap, it doesn't recognise my card. If I enrol the same card into Sign-In App, the code for the card is 80415818 - and then it works. I've contacted their support and they say the Net2 codes are encrypted and cannot be converted. I just wondered whether this was the 'final word' or whether anyone had any luck? I see some posts on here about converting the Net2 codes to a longer format for use with PaperCut, but in this case both codes are 8 digit. Just trying to avoid staff manually enrolling. Thanks

I think Synology supports sync to S3, so you could use some cheap cloud storage like Wasabi to keep your Google shared folder on your Synology in sync. Personally I prefer two separate solutions though, completely independent of each other which gives more flexibility in the event of issues with one or the other. Barracuda is very cheap and worth the investment IMO. I think Datto do something similar for Workspace, but no idea on costings. The great thing about Barracuda is that it is unlimited storage and retention, and you only license your FTEs, students are free.