smarties11

Makes me wonder when it would have been picked up by CAPITA otherwise. I don't think it will be too long before MS disable TLS 1.0 in the OS by default, they've already disabled it in their browsers. Would we have just installed the latest feature pack or a windows update one day to find Exams Organiser broken on all of our clients?!

Yes, it's a very small deployment used by about 10 users, so all the RDS/RemoteApp roles are on the same VM. We could split them I suppose but would be a waste of resource. The real issue here Exam Organisers use of a now insecure protocol to talk to the SQL backend.

Hi All, We've had an issue recently whereby on a new RemoteApp deployment, SIMS Exams Organiser refuses to work, giving various SQL errors and requesting credentials. CAPITA investigated this for us, and found errors in the server event log relating to schannel. On seeing these, it dawned on me what the issue was - as this server is public facing, I use IIS Crypto to disable insecure protocols and ciphers. Therefore I figured Exams Organiser must be communicating with SQL using one of these. After some testing by enabling / disabling various protocols, I have narrowed it down to TLS 1.0. If you disable this protocol on an Exams Organiser client, it can then no longer speak to the SIMS SQL database. CAPITA are escalating this, however it is a little concerning given that TLS 1.0 has been insecure for several years. Obviously within a LAN the implications of this are not as great as they would be with a public facing service - but it did surprise me I must admit. I thought I should make other Schools aware that may be using this across RemoteApp or any other public facing system - if you are using it successfully, then that means you have TLS 1.0 enabled which is a security risk.

I thought all recordings were stored in sharepoint now, on the files tab of each team, in a recordings folder?

We're also seeing slowness today with assignments, meetings are OK apart from the issues still present from yesterday with powerpoints and recording

Let's hope so! It's working great otherwise, video and sound are fine etc so hopefully just a bug for them to fix. Still not showing on O365 service health though!

National issue. We're running all of our lessons live over Teams today and many staff are seeing the same issues. We've advised them to share the PowerPoint window instead, this is working for most but some can't see any open windows to share, so the only answer here is to share the desktop with a hefty data protection warning given! The other issue we are seeing is recording is very intermittent. It is failing first time but often working second or third, but then for some it says 'failed to upload to stream' when the lesson ends. Even though it should be saving to Sharepoint?! Heard similar reports from one or two local Schools

We are a SmoothWall School, and ever since we deployed it several years ago our DNS path has always been SmoothWall -> DCs -> ISP with no issues. I'd suggest this route. EDIT: just to clarify for clients its client -> DCs -> ISP. Above was meant for what is set in our SmoothWall.

Hi All, I'm trying to get SIMS Examinations Organiser working correctly via RemoteApp. The user can launch SIMS no problem, however when they click Focus | Examinations, they see the usual splash screen but it sits on "Logging into the SIMS database" for a couple of minutes. Then, it prompts for credentials for connecting to the SQL database? I've tried putting valid credentials in here (including prefixing with sims_) and then you are given an OLE DB provider error - [DBNETLIB][ConnectionOpen (SECCreateCredentials()).]SSL Security error If I run SIMS directly on the RemoteApp server (Server 2019), even as a domain admin, I get exactly the same error? Thanks!

No, it's a teacher policy setting that means any meeting started by a teacher automatically defaults to 'organiser only' on the who can present option.

Our pattern suggests that only those using Windows devices can access chat, even when disabled. Android and iOS respect the setting. To prevent students joining as guests, get your teachers to 'meet now' rather than schedule the meeting. Then there's no way of joining as a guest as students are never aware of the join link. They can only join by being signed in to Teams and opening the correct Team and clicking join when the meeting is available. This is how we've done it since June and never have we had students coming in as guests.

To prevent this happening in the future, follow this guide to set students as attendees only by default so teachers don't have to do it for every meeting. We've done it this way since June and it works perfect. https://teams.rocks/2020/05/19/students-as-meeting-attendees-by-default/

That's not been our experience, we've used Teams through a few isolations now and only started to see this behaviour recently. On an Android client, the chat icon isn't even available and this is what I would expect when we have chat disabled in the meeting policy and the channel permissions set so that only owners can post? But Windows clients don't seem to respect this setting?

Hi All, We've been using Teams for live lessons since June. We have applied the Education_SecondaryStudent policy package to all of our students. We've tweaked these policies to our own requirements, including setting 'allow chat in meetings' to disabled in the meeting policy. This, in conjunction with changing the posting permissions on each channel to 'owners only' meant students were unable to use the chat feature in live lessons. Something has changed.....now students can use the chat facility in the meeting. They can also 'reply' to any post made by an owner in the posts tab. But only if they are using a Windows Teams client, testing on Android shows these features as being correctly blocked. Any ideas?

Is the disk storage behind this VM an iSCSI SAN? We had a similar issue with a server a few months back - when I looked into it, one of the round robin/redundant links had somehow set itself to 100mb on the adapter properties in ESXi. I manually reset this back to 1GB and all was well! Worth a look?

IRIS also own ParentMail, who have recently farmed out their LiveChat (which was previously really good) to an abroad call centre and it is now terrible!

Nope, we remove all leavers accounts on 1st working day of September.

We find that background effects isn't available the first time Teams runs/installs for that user profile. If you quit Teams fully by right clicking the systray icon and restart it, then it's available.

Great; thanks Roby - I'll look into it - sounds like this is the way forward

Not true, we are OVS-ES licensed and were using DBA no problem at all. It just requires that you need to have the 'A1 Plus' licenses added on to your tenant, and that was cumbersome as Microsoft made this a bit of a chore for Schools to do. The new DBA method (which requires Azure joined/hybrid joined workstations) can also be used by OVS-ES. I'm interested to hear about your shared computer activation experiences though - when we looked at this 3 years ago it was quite messy as you had to store the licenses in a central path; plus it still counted towards the users personal 10 devices. How does the new model work for you? Thanks!

You can either use shared device activation or device based activation. Shared device activation is quite messy. So we opted for the latter, it basically activates the device by creating a new user for each device in O365. There is an activation tool provided for this (OPPTransition.exe). This worked great initially, however it is now broken and instead it just activates against the logged in user, even though when you check the registry the registered account is still the device account. This causes an issue as it uses 1 of the 10 devices each user is allowed. Staff that move about frequently then get errors saying they have reached their 10 device limit. It's on my list of things to fix. I suspect this method is now deprecated, as the latest info about device based activation on Microsoft's website describes a new method where you have to join or hybrid join each workstation to an Azure domain, then assign licenses in Azure AD. It's a real shame they didn't make the activation method more straightforward, either KMS or AD based.

We've been using Office 365 Pro Plus on all of our workstations since late 2017. We run current channel and tend to update every 2 or 3 months or when there are security fixes. No issues at all with SIMS.

The reason students can join as guests is because you are scheduling the meeting, which sends an invite with a link to join - which they can follow and choose the guest option. In our policy, we instruct teachers to use 'meet now' instead. This sends no invite, and the students can only join the meeting by being signed in to their Teams account, browsing to the correct Team, seeing the ongoing meeting and clicking join. This is the method we established in our pilot back in June, and successfully used for a fortnight just recently when we had a year group isolating at home, for all of their live lessons. It helps that we use Salamander to publish their timetable to their mailbox calendar, which shows in Teams calendar. So they knew where to be and when. This way you can still host your external meetings too.

Yes, that's right!

What are you using for patch deployment, as there might be a facility in there? In SCCM for example, you can set a computer restart policy, where you define two time based settings; one to display a temporary notification that the user can dismiss, warning how long it will be before they have to restart; and a second which displays a dialog which cannot be closed, with a countdown timer on it counting down to a forced reboot. We do 1440 minutes for the notification and 720 minutes for the forced restart notification. This gives users the option to reboot at any point within 24 hours at a time convenient for them, but forces them to do so at the end of the 24 hour period (with a countdown displayed after 12 hours) and this works well for us.