jmak

Happened to three people in our team yesterday morning but not most of us. No users reported it. Seemed to resolve in the afternoon.

We have our domain whitelisted in Hive, users SSO to the client, receive a code by email and then the first time they print they can tap their card (any NFC card works), enter their code and that's it. Nothing manual from IT support.

I've been running a Dell latitude 5445 with a Snapdragon X plus X1P4200 for six months now and I'm really happy with it. I'm really just a standard admin user - anything else, I log onto a server. The only thing that doesn't work that I used to use day to day is RSAT server tools. I fixed that by announcing to the team that add a security improvement we were going to stop using RSAT on laptops 😁 Battery is a game changer. Price is in the same ballpark as a MacBook Air, so if you're happy with Mac OS and not having windows software that's another great option.

Chromebooks and Linux are still a struggle. The only option is their browser extension which converts the document to a PDF before printing.

I'm very resistant to having policies which have overlapping remits. You almost always end up with discrepancies or at the very least an unnecessary overhead of ensuring all policies are aligned at all times. And remember that a policy is what you do, not how you do it. I think you'd struggle to get much beyond: "The school will publish and maintain a website that complies with the required standard as set out by law, publishers all statutory information about the school and its activities and meets the requirements set out in other school policies." But since statutory requirements mandate that you must publish certain data on your website, this demanding that you have one, even that short statement is superfluous. Beyond what it's statutory, I wouldn't specify anything about a website in a policy - you might find a way you want to improve it that hasn't been envisaged when the policy was written, or you might be obliged to add a data type or remove something which could be in contravention of the policy. In short: worse than useless.

My own reading had pointed to grafana and there are people in our organisation already using it for other purposes. I'm glad to find other Edugeeks using it - I didn't mention it in my first post to avoid influencing the answers! I'm not in a school any more, but this is still the most knowledgeable and helpful forum around! We have more money flowing through the organisation, but we don't (and never will) make a profit, so money is tight. The expensive software mentioned in my original post is provided by the "enterprise". We don't have any choice about paying for it, so we use it. Anything in our division is usually open source or low cost.

Are you happy with it? I came across it last week and if it does what it claims I think it could be what we're looking for. It can't find many reviews - looks like a bit of a niche product.

Evening all I want a dashboard to give me and my team a live overview of the health of our network and alert is to high or critical priority incidents. I'd like it to ingest data from our antivirus (Trellix), endpoint management platform (Tanium), Network management (Cisco DNAC and ISE) and active directory. Is this a job for our web developer or is there a product out there? Open source is our preference, but we'd consider paid products.

Microsoft have acknowledged that there's a problem with the or of support message in the GUI: https://www.neowin.net/news/microsoft-clarifies-it-is-not-actually-ending-support-for-many-windows-10-pcs/

Just adding a confirmatory data point. License reports installed, or endpoint management software matches, but the GUI says out of support. When I asked my preferred AI how to tell, the answer seems to be that you'll know when you get an update. It couldn't be much less reassuring. Doors anyone remember if it was similar for Windows 7? I'd moved to Windows 10 years before the deadline, so don't have any previous experience.

I've been pushing people really hard in the last year in a tough financial climate to replace their non-Windows 11 compatible machines. The good citizens have been punished and I have lost credibility. All pretty annoying really. Edit: I'm not entirely surprised this is the outcome, not I didn't feel I could afford to take the security risk.

I've gone to Pixels for the early security updates and long (7 year) support. I'd be tempted by this if I was looking for a new phone now: https://www.voxi.co.uk/phones/google/pixel-10 Or the 9a for £10/month

The only point I'd expect to be involved would be at procurement - I would give a list of non-functional requirements, like network compatibility, security (including how long they provide updates) and compatibility with any existing BMS equipment that's installed. I wouldn't expect to test against those standards, just review to ensure they're included in the contract. I'd then expect whoever installs it to come to me when they want to connect it to the network. Obviously this didn't happen when our new building was specified and there was no handover from the installer to the maintenance company and because it was installed before we occupied the building, they just connected it up with some unmanaged switches and it has been a nightmare to configure them all to work together. When we moved in, the whole BMS was running off a single desktop PC in a room that looked like it had a cement and dust explosion and no one had any instructions. And yes, we did spend days and days getting it into some kind of usable state.

I'm running a Dell latitude which is domain joined and it's fine. Obviously can't be imaged with MDT as the arboriculture isn't supported. Also won't run Active Directory management. We have just joined a Surface Pro to the domain with no issues and it does look nice. Our user insisted on the Snapdragon Elite processor which made it a bit more expensive. My Latitude was cheaper than the i5 version and the battery really lasts a day and a half, even with Teams meetings.

You still need to be using conditional access policies to force use of the Outlook app, otherwise they can use the browser or any other email client and you have no control over the state of the phone. Personally, I'm happy to have conditional access controls on my phone - it suits me to be able to look at an email or receive a Teams message when I'm not at work and I'd rather not carry two phones. Conditional access doesn't give the organisation any control over my device and I have a separate profile with work apps/accounts so I don't get disturbed, but I can proactively look if I want to. If I was expected to work remotely it be available by phone, I'd expect to at least be given the option of a work provided device. I know what the finance issues are in schools having spent years managing a school IT budget. Where I am now, individual line managers have control on what they spend on IT for their staff, so we get the same issue in some places. It's a false economy; we issue Dell Pro laptops (previously Latitude) which cost around £800 with a five year next day onsite warranty including accidental damage cover. That's £1.50 per week, a tiny proportion of the cost of employing someone.

I would run the argument that it's not a shared account - only one person at a time knows the credentials so you can always identify who used the computer. When you submit your application you're entitled to an hour of advice - I'd use that opportunity to ask before you submit your answers.

Definitely sounds like a visit to the dealer is required. I would be polite, but firm and state that I would prefer it to be repaired, but that the work would need to be completed within 30 days of the original purchase as you don't want to lose your right to reject the car. It might focus their minds.

Do you have any "super -nodes" configured? That helped general stability a bit on our installation.

If you're looking for something like a Surface Pro, take a look at the Dell 7350 detachable. We get them for a similar price, but including the pen and a five year on site warranty with five year accidental damage. If you're getting an actual Surface Pro, take a look at the Snapdragon version. I've got a laptop with the Snapdragon processor and the battery lasts ages and it's less affected by the unvented form factor. If it was for me, I'd rather have a 2-in-1 device with a 360° hinge. It's more compromised as a tablet, but a much better laptop.

Sorry - it was a reply to the thread, not aimed at you and the part about conditional access was supposed to refer to BYOD specifically. I get the issues with MFA in schools. I do get irritated when organisations say they can't afford to give people laptops/phones etc. If users are allowed to choose to use their own device, they need to obey the roles and technical controls need to be in place. Otherwise the employer must provide the equipment for the employees to do their job. That might mean a shared PC in an office in school. If they're expected to work at home or be contactable by phone, then the employer must provide the equipment.

If you don't control the security standards of the devices that access your school's data, then you can't protect it. The scope for Cyber Essentials makes sense - but it does pose challenges. It sounds like you use Microsoft products - if you haven't come across Conditional Access Policies, take a look. There are quite a few threads on here about it. If staff *need* email on their phones, then the school should provide phones. Similarly if they need laptops to do their work, the school should provide them. If staff are being offered the convenience/privilege of working from home or using their own device, setting standards and controlling what data can be accessed is entirely reasonable - and entirely non-negotiable. And while I don't sound sympathetic, I really am - it's still a battle I'm having where I work, which isn't a school. I just hope I win before we have a catastrophic attack. Cyber Essentials is an appropriate name - in my view what they ask for is a bare minimum.

I use the ipk command, instead of the /copy i.e. slmgr /ipk XXXXX-XXXXX-XXXXX-XXXXX-XXXXX And then activate with slmgr /ato

I use BitWarden. I like it because it's open source and the free version gives the features I need. However, you do have to trust their cloud. If you want to self host, KeePass is good and popular and arguably more secure, but it's less convenient

Nscs guidance is to not enforce password changes unless you have reason to suspect a password compromise and that you shouldn't enforce complexity rules (it is shown to reduce the security of passwords. If you use a password manager (encouraged) you can let the machine generate and save a highly complex password, but if it's a password that someone might need to remember, you're better off sticking to words: https://www.ncsc.gov.uk/collection/top-tips-for-staying-secure-online/three-random-words After part of our organisation had an incident which we believe was down to a brute force attack, we set the minimum length of 16 characters. I use a password manager and unless it's restricted by the system, I use 30 character passwords.

Demonstrated by being familiar with the URL: https://www.edugeek.net Degree or equivalent experience = able to demonstrate membership > 3 years