rogerdnixon

Pfsense + Securly at secondary and UDM Pro/SE + Securly at primary.

Canva is free to Edu - you have to sign up. Get a 1Tb workspace per user and the video editing part of it works on anything. You also get a load of other tools as well. SSO against out Google Workspace accounts.

AFI Backup here across about 20000 accounts and 30 or so sites. Really easy to setup and use, decent PAYG pricing and self service restores for end users - a big deal for us.

None of that is required with Securly.

Not experienced and we have a very large ChromeOS fleet. I'd try (if not already done) a user that only has the Securly extension pushed and nothing else - just in case thee is some interaction with another extension. Also just email support and they are normally right on it - give them a test user and they can try to reproduce the issue and figure out what's going on.

We have Workspace across our Trust - ~20000 users and we do have backup - we use AFI Backup which works well. We have it for peace of mind and because you should back stuff up. However, every year I'd say there are single figure restores of files or emails - none at all in the past few months. So its used rarely - but has been very useful in a few specific situations.

So shared drives are nothing directly to do with Classroom. Imagine them as network drives in the Cloud the the organisation owns and you can add individuals, groups or even OUs to. When a Class is created the teachers of that class and the pupils et a Classroom folder in their Drive and in that a folder for each course they are associated with. Typically as a teacher I'd hardly ever look in there as Classroom takes care of putting files in the right place and manages permissions for you. So I just use the Classroom interface for looking at students work and communicating with them and they submit their work via Classroom and it magically takes care of everything in the backend. I do have resources that live in a Shared drive that I use for assignments - so the templates if you like. In terms of management I'd recommend auto provisioning all classrooms and syncing directly to your MIS. There are numerous ways of doing this - but we use Bromcom - so they have a tool that syncs classes, users, calendars and groups and makes it very easy. But Wonde has a good connector as well as another example. The Bromcom tool allows you to add and remove people on the fly, archives classes at the end of the year and so one. Once set pretty much zero touch across 15k students. GAM is the commandline tool we use to do ad-hoc things - e.g. jump into a class and take a look. Classroom visitors is great for the likes of a cover team who just need to jump into a class or senior leaders who want to do a work scrutiny - but does need Plus (well worth it). Anyways - stick with it - Classroom is super powerful and I'd not be without it now as a teacher.

https://www.amazon.co.uk/NiPoGi-Computer-Desktop-Display-Ethernet/dp/B0C1BVHJHB/ref=sr_1_1?crid=2VL86APZQ15IE&keywords=ryzen+5500u&qid=1700656004&sprefix=ryzen+5500u%2Caps%2C67&sr=8-1 Windows 11 Pro pre installed but most of our ones run ChromeOS as we are Google Workspace and they are way cheaper than Chrmeboxes and run ChromeOS very fast.

Tend to get Mini VESA mounted PCs now. Ryzen 5500U (6 core 12 thread), 16Gb, 512Mb NVME - less than £200 now on Amazon if you buy more than one (we have framework agreement as a Trust with them). Very fast for either ChromeOS Flex or Windows.

We had issues with some U6 Enterprises that were POE related. They can pull up to 22W. Fixed by using Unifi's own POE+ adaptor which can deliver up to 30W. So while the switch might not have reached its POE budget the port might have. There is an option on the U6 Enterprise to put it in low power mode that turned off 6Ghz and significantly drops the POE requirements. Cold try that and see if the reboot persist - doubt you have many 6Ghz clients. If using the ppsk I'd also use the current RC firmware which has a load of stability and ppsk specific fixes.

For work owned phones thats what I did.

If you want to do full on management, you start by enabling Advanced Android device management (in General Device settings) on the OU the target user is in. Then you can set all of the other policies, networks and apps. However, be warned that if you do users will be prompted to set this up on any mobile devices - so including their private device. I've found most users need their hand holding through this process. Once the device has been signed into by a user with Advanced management enabled - you can then mark the device as company owned in devices. Optionally devices can await approval and then they can only use devices you approve. I'd enable on a test OU with a test user and device and test you policies before deploying to real people.

This is an opportunity to work at The Cherwell School, a large 11-18 Ofsted Outstanding secondary that's part of The River Learning Trust. You would join an established team and be a member of the wider RLT IT Support community. Location: Cherwell School, Oxford. Please visit: https://www.mynewterm.com/jobs/137970/EDV-2023-CS-27718

Sure - no problem.

We use Securly across out Trust (9 secondaries and 19 primaries atm). Dead easy to deploy, good reporting that is easy to delegate to each school. Just works and does not give me any headaches (unlike some other solutions I've had to deal with or weed out of schools that come into the Trust).

The site I'm based at (I look after a MAT), has been 1:1 for about 8 years now. WiFi - Extreme - not the cheapest but very good. Site is all gigabit - but some aggregations on HP switches. Load balance 2 1Gbps leased lines via PFsense+ with Securly cloud based filtering Chromebooks or ChromeOS Flex for all - staff and students. Latest staff device is the Asus CX34 - touch flip with stylus. Latest student device is the touch flip Asus CR1100. Did it all ourselves. Started by doing it with one year group and then rolled out to all year groups. Fully engage with staff, students and governors. We now have 10000's of ChromeOS devices across the Trust which typically take zero time to manage on a typical day/month while I cannot say the same for ipads and Windows devices which still linger around in some places.

Typically the migration tool thats built into the Google Admin console will handle 1 year back fine for most accounts. So when I've done say 100 staff accounts, I'd normally get a few troublesome ones. For those ones I spin up a VM with Outlook installed and Google Workspace Migration for Microsoft Outlook - https://tools.google.com/dlpage/gsmmo/ This take a little bit of setup - but will plod through any number of emails given time. Done accounts with >100000 items in the inbox and its what needed at times for bigger inboxes or if you want to go back more in time.

Installation work on unsupported devices - just be aware if its not on the list there is no support and in might not work long term. However, I've found the vast majority of devices work fine.

For ChromeOS Flex, end of support just means it might break with updates. Just like old hardware might not run the latest version of Windows or have bugs. You manage the devices on the Google Admin console and when you enrol a device it uses up one of your Chrome Upgrade Licences. There is no separate licence on top of this like in the old Neverware times.

I manage IT across out Trust - so we have 10000's or Classes and I also teach and use Classroom daily. For a management point of view I do nothing on Classroom on a daily basis. Classes are synced to the schools MIS - Bromcom in our case and after an intiall setup on there you leave it to do its stuff by and large. The only management tasked I'd do (or a team member) would be to add a ad-hoc teacher e.g. an intern to a class and the Bromcom tool makes this very easy. But you can do it with GAM as well. As far as resources go, they live in a Shared Drive and when I set assignments that where the the source resources live. This is something as a teacher I do - not an admin. Teachers can also reuse assignments from previous years - sometime I do all the time. You can also make a template class and share that template and duplicate the assignments on another class now (if you have Plus). So kind of like having a master class. Again zero admin intervention here - something teachers do not admins. So as a teacher/student its super easy and intuitive to use and as an admin there is virtually nothing for me to do. Win win I'd say.

If anyone is asking questions - Cyder Distributions has a nice page with Securly's doc on what you need to do and how their products cover it. https://cyberdistribution.co.uk/student-safety/ - I've used these at out Trust.

What version of the firmware are you on? 6.5.64 is the latest and we are running it without any issues. In the past I've seen issues with specific Windows devices with certain wifi cards in the - mainly Realtek one and in some case I just swapped them out for Intel AX200's and the issue vanished. Reverting to some older Microsoft drivers can also help. However, this was all when the U6-LR (I normally deploy the U6-Pro now which is a great AP) was first out. Since the more recent firmware update I've not seen any issues. Some general config points: I'd leave 5Ghz at 20 or 40Mhz not higher. Turn off wireless messing unless you are actually using it I'd turn off band steering as outside of specific use cases it can cause more problems than it solves I typically leave things like channel and power setting on auto - but they can be tweaked manually is specific use cases As some clients connect fine - then its likely an issue client side - rubbish network adaptor or maybe one of the config settings above. Good luck!

1. Short answer is no. You assign a licence to a user and then they can access voice on mobile and web. Then optionally you assign a physical Polycom handset to a user - their name appears on the phone. Phones have to be assigned to users to do anything. We put in speeddials into the handsets so from the handsets you can press 1 - dial and can whoever is on speeddial 1. Google will bulk do this on request if you give them the MAC address on the phones to apply speeddials settings to - or do it manually on the web interface. 2. Obi Edition ones will just work. None Obi edition you will need to flash to Obi firmware and then they will work. So just an extra step.

If the off hours are set, then the user needs to sign in as their school account first. Then sign out. After this sign out the device will present as a regular consumer device for the period the off hours are set. So guest mode will be there as you are basically telling it to ignore all policies for this time. However, this only applies on logoff for the school account - not a cold start.

Assuming the Trust is the primary domain and the schools are sub-domains. Just change it. The old email address with be kept as a alias automatically so email traffic won't be interrupted. We have uses with aliases for multiple schools and sometimes the central Trust so they can have multiple personas on one account.