minimoo

Whats the difference to UJ-00012?

so just auto - i've spent a the week with a POE device that doesn't work if the switch was set to "Auto-1000" - but with "Auto" comes up fine. In any case, i've definitely got the MK500's working over POE from the switch here. Pretty sure we've not used any injectors!!

i've just found the inventry installation document where they included images of the box - MK500 zebra . @thebatman - under the port/trunk settings -what's the port set to - in terms of auto etc?

We've got a mix of 2530/2540 switches - and inventry (albeit bought 18-24 months ago) quickscans. No issues with the HP POE here.

It depends what you are after out of it - money is tight in school's - but if school is part of a trust, and trust are upgrading a number of pc's for example; they might be willing to throw minimum wage at a week worth of help for example. If I go back about 10 years or so, we used to have some students help out - benefit of this was they knew the school, the staff know them etc. i.e. you could say "go swap PC in room 40" and they'd be off. I'm not based in Liverpool, so can't help you out - but good luck and hope you find something.

"Since I'm under 18 I presume I don't need to be background checked". FYI - Minimum age for DBS checks is 16 year old, so it's likely that a school might want to do a background check if you were working on site and going to be in contact with students. However if work was over the holiday(s) when no students are in... Also, have you approached your current school to see if they would like a hand ?or have you already been doing that; hence the existing knowledge?

I've had a couple of staff report ink<>ie crashing, so it looks like they having multiple issues going on at the moment - we've got some new boards so updated from 17 -> 19 as new boards pens didn't work on 17; and 19 is listed as first version that supports the new boards.. then have staff with ink crashing, so a catch-22

@Spence_101 - as you've been talking to smart, they've done a update yesterday to smart driver/ink - 5th September, which fixes an ink<>IE crash issue. Do you know / can you find out from your ticket if this is them bringing forward the november patch or means even if we update to the new version, we will still have issues until november?

Originally, I went the route as atomwide/lgfl were saying at one point in time that they have their load-balancing firewalls in front - and therefore in a failover scenario implying the IP's could change. Equally, I agree with you - the only issue is that we often find that we've missed something e.g. forgetting to update the lets encrypt certificate and needing an 'immediate' dns change to fix it; or that teacher/support company that needs to remote in to fix something / view a AQA web cast that they've paid for starting in 20 minutes. Whilst most of those scenarios describe an in-house issue, the manual side of it does slow down those scenarios. On that note - @PaddyNewman - I don't believe the firewall rules view is a 'live' view ? I seem to remember hitting an issue once where the information on the rules page didn't match the live rules; as we'd changed information in a seperate ticket - is that still the case? If so, a read-only dump of the action rules in place instead could also be useful!

@DavidYoung - when I spoke to someone about the adobe setup (after starting this thread) - it seems that the we'll be able to do the federation stuff/ ad sync etc, so will be fairly sensible setup; so I think schools will be covered there. The size /setup of the school is going to make a difference here. At the price of £4.89 a pupil (above) and taking our intake and knocking off 120 - licensing all pupils would cost about £6,200. Any staff licenses would be on top - so if licensing all staff would probably add on about 150 users; about £800 so £7,000 per year. In contrast, you can get a device license for around £22.65 (not sure if you can get a cheaper price with more units) - equivalent of about 300 pc's. In particular case, number of students doing gcse or alevel in art/media/technology is around 273 - giving them a free license then a named license for course work would cost £750. Licensing 3 main computers (so around 90 computers) + the computers ks3 may use in technology (60 computers) - would be around 150 computers * 22.65 i.e. ~£3400. Licensing all teachers/staff would add about 800; That would come to about £5000 - depending on how you look at it, a reasonable saving on the £7000 going the named route. Obviously, this approach wouldn't allow KS3 students to access the software at home, and licensing all staff is probably quite generous in my example above. However would cover use of adobe by students in classes, and would cover exam pupils in practical having full access to work on coursework both in and out of school [ @JohnJackson - fyi]

@PaddyNewman - it gives a nice green tick for everything apart from: TLD Parent Check - WARNING: Looks like the parent servers do not have information for your TLD when asked. This is ok but can be confusing. SOA Refresh - WARNING: Your SOA REFRESH interval is: 900. That is not so ok SOA Expire - Your SOA EXPIRE number is: 86400. That is NOT OK The point I was more trying to make is whether there are settings that may be good practice that a custom system could encourage. I'm not fussed about these, but for example, I know we don't have DNSSEC enabled on our domain, and i'm not sure I've ever requested SPF records - the 2nd one we probably should do, the former probably less so

I'd thought of this as more of a tool for IT staff to use - as you'd need the SID in the registry for the user first right?

@PaddyNewman - your reasons was why i'd probably do a mix (even if the techie users would hate) - e.g. promoting that https is free and easy might be good thing for some schools to be aware of (although i'd probably argue them not running a web server might also be a good idea in that case ) There's actually an open source system ( https://www.vinyldns.io ) used by comcast in the US - that is apparently used by 'thousands of engineers'. They have a system where you can define ACL rules to apply to a zone file i.e. screenshot in https://www.vinyldns.io/portal/manage-access . A concept like that could be used to address the issues you hit. Only other suggestion I would have would be do if showing visible records, whether it's worth having some audit rules for good practice against the domain. For example, if I put our domain into https://mxtoolbox.com/domain - it tells me that: a) our domain can't be resolved without http://www.* (I'll put in a ticket for that on monday I think!) b) there's no DMARC record c) we don't have a dmarc quarantine/reject policy d) SOA refresh value is outside recommended range (I suspect that's deliberate by atomwide!) e) SOA Expire value is out of recommended range and then that mx.lgflmail.org reverse dns does not match the smtp banner, and a transaction warning time for smtp So using your example, if a user viewing their zone did not have a SPF record set and they've got MX records configured on the domain , you could highlight that they might consider whether they want a SPF. Having a school's version would mean D/E could be ignored and you could focus on what might be important for schools e.g. required g-suite/office365 dns entries that are missing - or even I saw mention of the adobe offer needing a DNS update...)

The run as rob thing looks like it's more focused on apps (and as you say is obviously commercial) - what caught my eye on arthur's app is it looks like it's solving a simple problem. Most schools are going to have some deployment solution/method already, but doing tasks as an admin can be awkward. For example, we used to have a admin user with a shared password; now have moved towards LAPS - which means that you need to look up the password for the workstation. This service looks to be a rather simple way of granting a temporary privilege, seems secure and sensibly implemented at a quick scan of the code. At one point I coded a self-updating windows service in .net, but in the end found that updating it was a pain, and that it also used a chunk of RAM - but that was back in the 2.x days.

@Arthur nice, so uses the security context of the named pipe call to see who accesses the service - what does the .net service come in at resource wise (ram?)

@PaddyNewman @ghanel, In terms of business case - DNS system could do with an update. Whilst it's not that often, and I've not done it for a while - i've submitted 2-3 tickets over the years for a copy of our zone file for checking. If other schools do the same, that's a lot of work for support. However, i'd probably argue that it's more important to allow schools the ability to change records in some way - or at least change some records. I'm not sure how many schools are still doing their own hosting (either themselves or via azure et al) and using atomwide for DNS, but I'd argue now that schools should be running 100% HTTPS. That requires a certificate. Whilst you can pay for certificates, with Let's Encrypt offering free wildcard certificates with dns validation - but the certificates only last 3 months (you can renew over 1 month before expiry iirc - so that's 6 support cases a year for each wildcard certificate). In my case as we have *.domain and *.sub.domain, that's 12 support cases I will need to log each year. If for security we validate and our own records checking we ask to validate our dns zone once per year, that's 13 support tickets that would need to be raised per year. Recognising that there is a security/configuration issue here and that atomwide may not want to allow full editing rights for that reason, it would be good if: a) It was possible to see the existing zone b) For things like g-suite verification @ghanel example above) and my let's encrypt example - that there was some ability to modify these by schools directly. The let's encrypt application keeps running until the zone has been updated - whilst I assume it's sensible and generates an ID that lasts a week (or similar) - I've not tested/hit whether closing the app and restarting it would generate a new verification code; and therefore require a new support ticket...

Whilst this is a week after the initial post - if you are a sims school, it might be worth checking out https://id.sims.co.uk/support/ - they are trying to integrate timetables from sims to o365/gmail, setup cloud accounts; and do the SDS <> teams stuff (including writeback from teams back to sims for assessment) Is it possible to do something directly now then ? It would be good to stop syncing student data with atomwide and just use google/office as an authentication provider. Last time I checked there was some student/staff data that it was not possible *not* to export via the application, even if you wanted to.

Has anyone explored the adobe / lgfl deal? It's been hard work trying to get answer out of them. So hopefully someone from on here has already looked at this, or maybe @JohnJackson can share a view The initial announce of 120 named users looked like it would be a good deal for a school - '120 free named licenses' would allow for a school to cover some GCSE/AS/A2 Art/Media/Tech classes; or maybe all depending on the size of the school. The school could then, separately outside of the LGfL offering purchase the new shared device licenses to use in their main computer suites for all pupils. So just as a bit of background here - Adobe used to do named / device cloud licenses - and I believe in February scrapped their legacy device licenses. However introduced 'Shared device licensing' which is only available for education. Details of this is on the adobe site @ https://helpx.adobe.com/enterprise/using/sdl-faq.html The LGfL @ https://static.lgfl.net/LgflNet/downloads/services/adobe/LGfL-Adobe-FAQs.pdf - to say that if you already have adobe console set up, that it won't be possible to get the free licenses on that console, but you will have a seperate adobe console - and presumably would need to have 2 different adobe enterprise ID's ? If that's the case, it looks as though the LGfL have been classed as a business/enterprise by Adobe. If that's the case, given that other large companies have a habit recently of throwing things at education, I wonder at what point by going the LGfL route it's possible that school's will miss out on an educational offer. Whilst I've not kept up with pricing, there was a post a few months ago asking if the LGfL is really worth it - at the edugeek conference where I casually asked what the pricing of connections are these days - i'd expect in London you'd be able to get a dedicated leased line connection of 300/300mbps for ~£4000 a year. Add in filtering solution for 1-2k a year - it does start to look like their could be a significant saving against the LGfL offering.

There was also a BSOD bug in rdbss.sys with offline files if the file cache got full in some scenario. I managed to raise that with MS at the time; it was early windows 10 aka May 2017, but workaroundsd at the time were to increase cache size, decrease amount of data or use workfolders. I started making the switch to work folders at that point. I've been slowly moving to work folders as we've moved staff laptops from win7->win10

Often the card readers act as a keyboard, so can read the number into notepad. Inventry have a 'blaster' app that lets them configure the card reader to read different types of cards Where you might have problems is if you are reading stored data from the card. For example, we use iClass cards - and read the iClass ID - inventry's reader does not support that and reads something different from the card. Also, I think inventry might have added functionaltiy recently to pick up students signing in from paxton doors - If i remember spotting that, I would have thought there's a good chance you can get inventry+net2 reading the same string.

what does the net2 system currently read from the cards?

In terms of my query about whether a PDF version is planned to be made available - that's come back that they don't plan to make it available to non-members, so might be just stuck with the flip book version. Obviously from my side, I could become a member and find out more about that - however, what i'm really after is a template documents. I've almost finished typing up the retention document manually, but guess I now need to start a discussion with them on how it (the content) is licensed.

@Edu-IT @Grumbledock - Curriculum/building etc bits are largely untouched. Some tweaks to dates. Lots of changes to GOVERNING BODY, PAYROLL + HEALTH AND SAFETY which was lacking before is now complete. Lots of references to IICSA, and some unexpected things e.g. keep staff training on safeguarding for 40 years. It would seem that the people involved have been familiar with Governance, payroll, health and safety as few changes to 'school' side of things. What strikes me is I was expecting to see a reduction in retention (in some cases) as people consider GDPR, whereas if retention has changed, it is generally the case that it has increased in duration. For example, I expected to see "Visitors log" to be cut back to 12 months or similar for example - but it's been kept at +6 years with a better explanation. In terms of the retention bits - I've got those typed up as an unformatted table in word - more then happy to share. Governing Body • Addition of “Records relating to the election of parent and staff governors not appointed by the governors”. Retention: Date of election + 6 months • Addition of “Records relating to the appointment of co-opted governors”. Retention end of term, if minuted, except allegation children – then 25 years. • Addition of “Records relating to the election of chair and vice chair” – Retention: until minuted • Addition of “Scheme of delegation and terms of reference for committees” – retention: until superseded • Addition of “Meetings Schedule” – Retention: current year • Modification: minutes – whilst suggestion of permanent (as 2016) – addition that LA may only be required to make available for 10 years. • Removal of “inspection copies” of minutes • Possible Modification: “reports presented to governing body” vs “reports to governors meeting” retention – 6 / 10 / permanent getting passed around • Addition of “Register of attendance at Full governing board meetings”. Retention date of last meeting in the book + 6 years • Modification: “papers relating to annual parents meeting” – Personal information changed to ‘yes’ • Addition of “Agendas – additional copies” – date of meeting / secure disposal. Should have personal information set to ‘Yes’ • Addition of “Records relating to Governor Monitoring Visits” - +3 years/ secure disposal • Addition of “All records relating to the conversion of schools to Academy status” – permanent. Under the 2016 was for +3 years? • Modification of “Records relating to complaints made to and investigated by the governing body or head teacher” from +6 years to also include “If negligence involved then: current year + 15 years. If child protection or safeguarding issues are involved then current year + 40 years” • Addition of “Correspondence sent and received by the governing body or head teacher” - retention +3 years • Modification: action plans by the governing body and policy documents – was life + 3 years now ‘until superseded or whilst relevant’. [Note to keep anything on safeguarding pending recommendations] Head / SMT • Modification: Clarify that “review” means “review annually, or as required if not destroyed” • Modification: Correspondence – was “date of correspondence + 3 years then review” – now “current year + 3 years” • Modification: “Professional development plans” – was life of plan + 6 – now held on individuals record, if not, termination of employment + 6 years Operational Administration • Addition of “School Privacy Notice which is sent to parents as part of GDPR compliance” – until superseded + 6 years (why??) • Addition of “Consents relating to school activities as part of GDPR compliance (for example, consent to be sent circulars or mailings)” – until pupil leaves • Modification to cover electronic – “Visitor management systems (including electronic systems, visitors books and signing-in sheets)” and retention: “Last entry in the visitors books + 6 years (in case of claims by parents or pupils about various actions).” • Modification: “walking bus registers” – was +3 years, now +6 years HR • Modification – appointing headteacher – retention was +6 – now +6 months or +6 or +15 (negligence/abuse) [interestingly different to +25 in Governing body section] • DBS - was 6 months – now saying keep for duration of employment + 6 years!!!! Also refers to retaining references and “other documents” conflicts with section below that says don’t keep proofs of identity etc? • Removal of “All records leading up to the appointment of a new member of staff – successful candidate” – This looks like a mistake – I think the meant to remove ‘unsucessful candidates’ from the previous line to cover both. • Modification: Staff Personnel file – reference to keeping if case under IICSA • Modification: Annual appraisal – changed from +5 years to +6 years • Addition of “Sickness absence monitoring”. Retention +3 or +6 years • Addition of “Staff training – where the training leads to continuing professional development” • Addition of “Staff training – except where dealing with children, e.g. first aid or health and safety” • Addition of “Staff training – where the training relates to children (E.g. safeguarding or other child related training)” – Retention – 40 YEARS! Payroll and pensions - complete new section -2 items to 3 pages worth! Health and safety – lots of statutory provisions updated Statistics and management information – addition of moderation.

I'll post up any differences to the retention guidance shortly. The body of the document i.e. the first 30-40 pages including sample forms / background has obviously had a rewrite for GDPR so is probably worth a read.

My online gaming friend has left me this evening (real life of something) - so I've got a spare 4 hours to review it and compare