strawberry7

Hi John, Thanks for the response. I wanted to contact you directly about this but could not find your email and it was a bit long for Twitter! I understand your points, however the information back in June did not specifically say that you were going to remove this ability. As mentioned in my other posts, some notice would have given support companies and schools some more time to prepare and ensure staff mobile compliance. I am more than happy to provide feedback on the Atomwide services and LGFL. You can reach me anytime on 01252 279777 or [email protected]

Hi, I understand your points, however my main point was actually the lack of notice of the change. If we had been notified about this a few months ago, it would have given us time to prepare the schools. The password match I mentioned is done automatically via USO Sync. I agree it is not the best idea but if you provide users with too many passwords, they write them down and stick them to their computers, put them in a drawer, etc - a worse situation I am sure you would agree. That is the real world situation of what people do. It is therefore sometimes the lesser of two evils to standardise as much as possible. Consider being able to sign in to platforms with your Google or Facebook account for example. You are, in affect, creating a single login with single password. I realise there are extra security layers when using this system but the principle is the same. Whilst I do also agree with your point about user accountability, our support requests are all recorded and tracked through our support desk. It is therefore recorded when we are working with a user or their machine and the school understands this. I do not believe it creates an idea of sharing passwords. An approved, trusted support engineer, who administers your computer, being able to have access to your password is different to giving it to another staff member. Test accounts are fine but there are instances when specific user related issues need troubleshooting and ensure that it works for the exact user in question is preferable. Do you administer LGFL yourself?

Hi, It has been a long time since I posted on here. I was wondering what you all think of the LGFL change that happened today regarding staff passwords. Traditionally, LGFL have always allowed approved support and nominated contacts to view passwords for staff. This allowed us to issue new passwords to the staff. If the USO Sync was in place, it also meant we could login as a staff member without having to disturb them to check their machines. LGFL have now taken this ability away - citing GDPR compliance. I take issue with this for 4 reasons: 1. We did not receive notice that this was happening. I am asking LGFL if any was issued. 2. I am no GDPR expert but I have spoken to a few. I do not believe that having the ability to see users passwords was a breach of GDPR. GDPR is all about informing people what is happening with their data and protecting it as much as possible. It would actually be more relevant to hide the staff mobile numbers for example. As long as the staff are aware that we have the ability to see their passwords, then GDPR compliance should be met. Also it probably would have been better to give staff the ability to hide their passwords from support should they wish. 3. In the real world, this change is very impactful. An example is that during half term we are undergoing a change (coincidently LGFL related) at one of our new schools. During half term we are wanting to check various computers and teacher logons. This is now not possible as we cannot see their passwords and the staff are not contactable during half term. Any resets of passwords are going to the staff mobiles and we will not be able to access them. 4. LGFL have stated that 'In order to make it simple and efficient to reset staff passwords we would encourage staff to verify their mobile numbers.' Again, there has been no lead-in time to set this up or prepare. I would be interested to hear if you are affected by this change and what your thoughts are.

Try making your own manual shortcut. A good way of making the shortcut is to use the %programfiles% switch. This will mean that if you have a mixed 32 and 64 bit environment, you will not have a problem deploying universal shortcuts. In case you don't know, 32 and 64 bit environments can wreak havoc with shared shortcuts as 64 bit programs have C:\Program Files and C:\Program Files (x86). Hope that helps.

Haha, you beat me to it!

I would not be surprised as LGFL/Atomwide's official stance is - all remote tools except RAV3 and CentraStage are blocked and unavailable. Apparently they are working with LogMeIn to try and get it using the USO system but that is the only 3rd party discussions I know of.

Thanks for your input but as I mentioned in my post, the subnet change happened only a few days before migration. Ww changed our subnet because we simply didn't need to separate our admin anymore, we just have 1 server with 1 domain and 1 network, much simpler. Also I couldn't remote desktop because there was no internet connection into the school. I was just saying that Logmein used to show you how long a client had been off for, which was really useful. As for them updating the support case, yes they did but it was already done by then. I am not in 1 school all the time and I don't have the luxury of always being able to jump when something happens in LGFL land. I went on the training course. The trainer was great, the course was well organised and the facilities were good. Unfortunately it was exactly as I expected, 10% golden nugget info and the rest was totally irrelevant for me. I could have just looked at the last summary slide and got all the information I needed. I still stand by what I said about it being complicated, I still think the GUI needs a lot of work, I still think they should have been more up front about it at contract signing, I still think it is unreasonable to block remote login tools and I still think that rav3 is a poor substitute. I did have some interesting chats about other stuff though, for example we were discussing the fact that you have to close a browser to complete log off requests. I voiced that I found it strange with all this focus on security a process like this was in use. Apparently this is due to shibboleth or whatever it's called and they are trying to get it changed but obviously it's out of their control. Hopefully it will be changed in the near future.

Thanks again for the info, I don't want to draw this thread too much off topic but this is really interesting and I totally agree with what you're saying. It's the same reason that engineering projects take so long I guess, people so worried about whether somebody might chip a nail, the work doesn't get done.

Wow, security is an area that drives me mad and an area that I have limited knowledge in but am always interested to know more. Thanks a lot for the info!

Well this morning my LGFL 2.0 site went offline with no internet access. I couldn't access remotely and, unlike Logmein, the remote system didn't tell me how long the server had been unavailable. I originally submitted our IP information a long time ago and it had very recently changed, including us ditching our admin range. The firewall had been setup such that the admin range was on port 1 and the curriculum on port 2, therefore port 2 was the one physically in use to our network. I had submitted an IP change request and this had been done but nobody thought to tell me that they had moved the curriculum to port 1 due to the removal of the admin IP range. This meant that the internet went down due to the fact that the network was still physically connected to port 2. Luckily I was around the corner and the school was only offline for 45 minutes or so this morning, annoying that they didn't tell me though and that they didn't think to schedule the change with me. Not to go over old ground or anything but if I was still allowed to use Logmein, I would have seen that the server had been offline for the same time that the support ticket had an update on and piece it together before even arriving on site. I also would have been able to check on my iPad on the way to work and let them know when they phoned that indeed there was something wrong that would affect the whole network and it wasn't just that users computer. I will hold my hands up and say that I could have changed the IP range before installation but the change was made on our end only about a week before the install and I just hadn't even thought about changing it on the LGFL part. I have already hit the remote functionality restrictions in the first week of LGFL 2.0!

I find this interesting. So is there no distinction in the law between images being 'distributed' automatically by a technology system such as caching and you deliberately transferring such images from one form to another which requires a human input?

Well done finding it. I will keep this in mind myself as I am not very familiar with papercut but we do use it here.

If you're happy to give your user local admin access to the machine then that might sort the problem. You can do that by logging in as the admin, right click my computer, go to manage, go to local users and groups and then add the network user name to the local admin group. I give all of my staff local admin access so that they can install programs and it sorts a lot of problems. Sometimes they accidentally install rubbish but very rarely and it certainly solves more problems than it causes.

I am not refusing point blank and I have fully explained my points about that earlier.

Extremely annoying! I had a situation yesterday where a teacher was trying to move folders on a windows 7 machine and it said that the folders were in use by another program. Which was rubbish as even after a reboot it was doing the same thing. I used unlocked and it moved the folders immediately lol.

This was just an email I was copied in on and somebody from LGFL was reporting that the 2GB limit had nearly been reached. I am not going to ask them to make a change, I encourage my schools to avoid the FX system as it is clunky and restrictive. Plus it could fall over as it is currently doing. Why is the LA setting size limits on their FX system when it is provided by LGFL/Atomwide? Haven't LGFL given out a certain amount of space to each LA? I can't imagine an LA voluntarily taking less space for their FX system? Or are you talking about the document handling side been set by the LA?

You're better placed to comment than me as you have clearly been on the course. I am just going on 3 things, the Fronter course, pointless, other teachers experiences of previous LGFL/LA related courses, pointless and finally some presentation of theirs I found which had a whole load of Disney quotes on it or something, again pointless. If you are referring to 'opting out of the LA filtering' then we have done that but it still blocks YouTube, Facebook and Twitter to name a few. I don't think there is any legal requirement to block remote tools such as Logmein, after all a school could have their own connection and use these tools. Not to mention the fact that ICT support companies have been using these tools for years in schools without a problem. The rational from LGFL was that tools such as Logmein are unaccountable because they do not require an individual login, such as USO. So say I employed somebody, they got arrested, I didn't change my Logmein password, they could still get into the school. I totally agree with them, that is a possibility. Personally, if I had been LGFL, I would have put the responsibility back to the company using Logmein (or similar), just as it is that companies responsibility to make sure that arrested employee didn't still have a key fob for the school (a MUCH bigger risk). Following on from this, you could say that said employee works in ICT, so they know their way around a computer. Who's to say that they haven't installed a key logger on their bosses computer and got his LGFL USO information? In which case he can go about totally unnoticed and worse, nobody may realise he is logging in as his boss whilst he is arrested or whatever. What about OTP from LGFL I hear you say? Well what if he has stolen the bosses fob? Sure the boss would report it stolen but if he is that responsible and on the ball, wouldn't he have changed the Logmein password if he were using that system? You can go on and on with security and as somebody mentioned way back in this thread it needs to be a balance. I don't want to hijack this thread anymore than I have already and I feel I have made my points, so I'll leave it here.

Yes it is but the system stores the documents for a certain amount of time. It hasn't been designed properly, so you have to decide when you upload the document how it is deleted later down the line. It would have been far better to just make it so that initially it auto deleted the document once it had been received by all parties in my opinion. Even if it is just a transfer system though, 2GB is pathetic these days.

On a slight side note but related to LGFL 2.0, I have just been sent an email and apparently the LGFL USO-FX system has ground to a halt as the 2GB online allocation is nearly full. They are blaming staff for not deleting documents quickly enough. 2GB between 70 schools. Well done LGFL.

Have you run the command rsop.msc to look at exactly what policy is running the workstation? An alternative is gpresult /v although look at the switch to output it to a text doc as it puts out a lot of info. I find rsop a lot quicker and easier myself but gpresult does give a little more detail. Maybe there is a restriction within the student GP that you've missed? You can also run rsop from the server if you don't have the run command under the student login. You do this by right clicking on a student account in Active directory and go to 'resultant set of policies planning' Hope that helps

I can add in with unlocker, excellent program. I use it on 2008 R2 without trouble. Last night I used it where Sophos could not delete a virus and unlocker killed it in a second!

Does the GoToAssist.exe fail when you're logged in as an administrator? As a workaround have you considered using something like Firefox just to see if it gets you working for now?

Are you deploying your printers via GP?

Thanks for the input. My customers didn't choose this filtering service, it was thrust upon us by LGFL. As for it having a different UI, that might be true but I have never used Netsweeper, so it is brand new to me. I do understand what you are saying about the training, it's just annoying when I don't go to sessions that I am interested in (and actually benefit a school) but am now faced with being forced into one that I have no interest in attending at all. I understand also about networking but I can do that myself, I don't need an LGFL training session to do that. Equally, I predict that this session is going to be 90% commercial rubbish and 10% golden nugget information will just anger me further. We are attempting to back 1 school out of LGFL 2.0, if that works, I am simply going to get my other schools to do the same as I, nor my customers, want to be in a situation where we are told by Atomwide or LGFL what we are and are not allowed to do.

Thanks for the pointers guys. As I mentioned earlier, I am rammed with actual work and so don't have time to go off on a jolly to Kent for the USO course (which is pointless for me but you have to do it to get on the web screen one) and then off to wherever for the web screen course. I simply don't have any time in my week. Secondly, I don't see why I should spend the money going to a course that neither I nor the school have any interest in because we don't actually want this filtering system. Finally, why has this system been made so complex that even IT pros need an entire days course to learn how it works? I didn't go on a course to learn how my iPhone works, or my iPad, or my MacBook, or any of my Google apps, or Windows 7, orActive Inspire. Have I made my point yet lol