rogerdnixon

I suggest you do a feature request specifying exactly what you require - they tend to be very good at listening to their users. If you enable SMIME you can do an exchange of emails with the other person and see what level of encryption they are using by looking at the padlock symbol - goes green if they support SMIME.

Not exactly sure what you want then. I get these things from O365 users which send "encrypted" emails and I just click on the link and it opens - nothing more needed to authenciate. If you use SMIME - you need to have the certificate added to the device to be able to read the email - if thats what you want. Perhaps users should lock their device?

The option to print, forward etc are all disabled and you set and expiry date. You can optionally add a passcode via a phone number you supply. You can also use SMIME encryption if you want a higher level of encryption than the standard TLS.

I'd say so. I've had a few users email me saying it was not there - a reload of GMail made it appear in every case so far. Does not appear on the Android app for me yet - only web.

You enable it on an OU or Group level. Took a while to show when I first enabled it and a few reloads of mail.

Securly will do some of that - which is what we use. You still need a firewall of some sort onsite. MDM is built in if you use G Suite - for Android and iOS.

I don't think the G5's meet the CPU requirements for 6.7. I'd suggest using 6.0U3 which should work. Use the HP custom image for per Gen 9 servers - https://www.hpe.com/uk/en/servers/hpe-esxi.html

I'd agree that guidelines are open to interpretation. Regarding incorrect DNS settings - they are set at the network level and if someone on an unmanaged device puts something else in (say Google DNS) they get no internet at all as we block external DNS at the Firewall level. On Chromebooks (our main device type), it does not matter what you put in as the DNS settings as filtering is done at the device level and assuming you have appropriate policies in place there is nothing a user can do about it and it works on any network. All I'd say is that its much easier to use and seems way more effective than anything else I've seen used at other schools or used myself and parents love it and students hate it!

We use it - both for Chromebooks (so using the extension) and the DNS product for everything else. Works well and is easy to us. Authentication is via your G Suite account. Reporting is good. Parents like the parents app which allows them to control the offsite filtering (within limits we set) and see what their little darling have been doing. So pretty good for a 1:1 Chromebook setup. They offer a full SSL decryption version that we use. You also get Auditor and the Teacher Dashboard as well which nicely links to Google Classroom. BYOD is a bit of a pain as users have to install the SSL certificate to get anywhere. You need some sort of firewall as well - we use ClearOS which does the job fine.

If you have a limited amount of bandwidth, I'd make sure you have updates set in device policy to scatter updates over a few days. A large number of devices all updating at the same time can hammer bandwidth. Additionaly, if you are using Android apps and wiping local user data each session - they they all have to download again. I'd disable Android apps outside of a 1:1 deployment.

That's more like the three year price. It does depend on what options you pick.

Yes, we use Securly DNS (which covers PCs, BYOD, Guest and MacOS). We are 1:1 Chromebooks staff/students - so most people are on ChromeOS. They proxy trafic to any site you don't globally allow and they also have a tool that inspects mail and Google Docs for potential safeguarding issue called Auditor. You get alerts when people try to access blocked sites, do Google searches that are flagged as potentially harmful, visit sites that while not blocked may suggest certain activity patterns or there is flagged content in Mail/Docs. You can export reports on individual activities either as pdf's or csv files. What I like is it is dead easy for people to use - i.e. safeguarding teams and they can get what they need in a couple of clicks. Its not without its issues - some versions of Android don't work properly and Google Voice (which we are trialling) does not work on anything other than the guest network due to the way they inspect traffic to Google land. All being worked on apparently. Unless you force google searches to co.uk - they automatically go to .com - not a big deal - but slightly annoying. Happy to discuss it it detail if you want at some point.

Already mentioned - but take a look at Securly. We use this for our content filtering - so Chromebooks, PCs, Mac, BYOD onsite, Guest network and Chromebooks offsite. Easy to setup, cloud-based and not too expensive. We are planning to roll out across our Trust as we are all part of the same G Suite setup. You can deligate safeguarding stuff for specifc OU's to specifc people on each site and set policy based on G Suite OU membership. You need a local firewall - we use ClearOS - a linux distro that works very well + easy to setup. I believe they now have an O365 option as well - at least there is an O365 login button on the sign in page. They also have a parents portal and app which our parent love which allows them to control (to an extent) the offsite filtering on their childs Chromebook.

I'm pretty sure that feature is only there in Enterprise Editions - so G Suite for Education Enterprise. One of the main things you get is the security centre which this is part of. Does not chnage the level of protection you have - just a reporting tool.

Custom Directories is the way to go. We have 24 schools/organisations on our G Suite setup. Each school has its own custom directory and we have other ones that are things like allstaff across the trust. Based on Group membership. Yuo can user GAMADV-XTD to sync members of multiple OUs into one group.

1:1 Chromebooks here - all 11". Bigger ones are too heavy and don't fit in bags.

There is an option to export to PST file which you can open in Outlook. So run your search and there is an export button. Then you get to download the files.

Yes you can. In Drive settings there is an option to add trusted domains and allow sharing to them. Just enable this on both domains.

We have a couple of USB to ethernet adaptors and then you don't ever have to put in credentials manually. But its a behaviour management thing really - nail a few and the rest get the message that its pointless and they will get a consequence.

Make sure you have the force reenrollement option turned on for the devices. This is a device policy. Then its up to you if you let them re-enroll them (which is the only option if the first policy is turned on). The ability to enrol a device is a user policy. We don't allow other users to enrol devices - so they have to come back to us. We then give them detention for trying to wipe their device. We have one a two a year (1:1 Secondary) who try it on - they get the message pretty quickly and realise its a pretty futile thing to try and do. You could allow them to re-enrol the device - but they still need a network connection to do this - so would have to come to us anyways - so no point really.

Just go for Aerohive Connect as already mentioned unless you need the higher end features. You get similar features to Unify and they host the management interface for you. APs are similar in price to Unifi. If you need the Selct options - then shop around - we got about £3000 off our renewal by doing this.

1100 Students (Y7-13), ~150 PCs/Chromebases, 1:1 Chromebooks.

You can have anyone, organisation members, members, managers and owners - so there are five levels. So you can allow managers to post and not members for example. You need to click on view in groups services in the admin console to view all the settings. You can also do it via commandline using GAM.

You can also set the Groups permissions to restrict who can post and what they can do. Group permissions are very granular and can be configured in a number of ways. We tend to use group permissions rather than compliance rules for this reason (although we do use these in specific situations). So we have a students group that contains all the students in the school. They are all members - but can only view messages and that's it. Various members of staff are either owners or managers and can post - but posting is restricted to managers and owners.

In the UK - https://ebm.co.uk/ From US https://www.chromebookparts.com/ - will ship to the UK. We often buy quite a lot from them in one go.