pete

...or said "Thank you for your advice, but we won't be doing that. Instead as per NCSC and NIST guidance we use MFA (list details) wherever available and have processes in places (list processes here) to detect unusual behaviour and account compromises. Forcing frequent rotation in conjunction with long holidays leads to passwords being written down." "Don't rotate passwords" isn't the advice. The advice is "have MFA in place on systems, have methods to detect account compromise and unusual behaviour and respond promptly to those detections. Done all that? OK, now you get them to pick one good password that they don't have to change unless something iffy is detected." 'cos otherwise you've got hundreds of "Thisisthe14thtimeIchangedthis!" quality passwords from the "let's make them change passwords regularly" regime.

Since about Monday our schools have been getting the "Sign in to confirm you're not a bot" prompt. At the three schools with Google Workspace (or Entra ID linked to Google Workspace), that's not really an issue beyond breakings videos embedded into Powerpoint. At the two schools who don't have it (except as a placeholder so we have it in case we ever need it) it's a bit of a faff. ISP is aware and poking YouTube - it turns out they've been a little cavalier when applying it to whole netblocks. I've chased it from the Google Workspace customer PoV, but as soon as they confirm it's a YouTube decision/issue it gets thrown over the fence to YouTube. Anyone else?

Moves around a lot? Action1 (or Jamf School for iPads). Mostly stays in one place? Currently WSUS. Looking at winget update for Win11, but needs more thorough testing and investigation around reporting options.

I make our lot either use the MIS SMTP provider (we use Bromcom) or Mailchimp for bulk mailings.

From your link, the "Sign in with Google > Help (from Help Privacy Terms in tiny writing) > 3x3 grid menu in top-right > Google Search" Gets me to www.google.com in normal Chrome. May work in the Kiosk app too if not enough thought has gone into it.

Follow up: We got the Bouncepad kit. There's a few nearly-good-enough options but we'd end up having to modify them in the workshop. If you tell them you're a school, there's a discount.

^ Given (IME) Copilot can barely* provide an accurate answer without a follow-up "please check your answer", the "hey, does student X need a prevent referral?" and the SEN recommendations query are a bit WTF. *and not complex or nuanced stuff either. It gets basic percentage calculations wrong.

I'm sourcing some front-of-reception stands for sign-in tablets. They should have a reasonably* secure quick-release function (grab and go during evacs). The Bouncepad kit (Bouncepad Click wall and desk mount and maybe the Bouncepad Flex) looks great and I'm seeing lots of positive reviews, but....... ....anyone found a similar mount for less cash? Amazon throws up a few, but I'd like a "we bought this and it was great" recommendation if anyone has one. *they're all covered with cameras. Mostly a "stop Bob knocking it off the counter" concern.

Don't rely on consent for things that are* core school functions (as in, they're not optional) or the agreed mechanism that helps fulfill that functions. If the DfE says "you need to share attendance data with us via Wonde", that's not based on consent. If the school has Microsoft 365 as their established way of working, that's not based on consent. If the school needs to store a photo of Jimmy such that they know what he looks like (and can provide that to the police should he steal just the one swan), that's not based on consent. *as in, a headteacher would agree with that definition. If it's just Geoff wanting to try out the latest shiny widget with the children and the HT doesn't know WTF he's up to, that's one thing. If it's "we as a school have decided to use Platform A for purpose B", then you don't rely on consent.

Follow-up: Even after ParentPay confirm in writing that they've actioned your contact termination, they may not bother to properly inform their credit control team who will: Automatically send renewal invoices to the email that's not the licensing/renewals point-of-contact (but may once have been) Have an auto-responder* on the SMB-ESScreditcontrol@ mailbox that acknowledges a recent mistake re invoices, but possibly not this mistake. But they do include a phone number to ring. Chances are you'll be "accidentally" hung up on though. *

It will (even the most basic data protection / AUP will cover "don't give data about people to random companies without proper authorisation and due diligence") and that'll cover you in court, but if you want employees to do the right thing and avoid dealing with the fallout of them not doing so, you need to be more explicit. Even if the "AI Policy" link goes to appendix 3 of the data protection policy, it's easier to put that link there than hope they look in the policy and scroll to appendix 3 unprompted.

^ The comment author goes into a bit more detail in the article, which is worth a read.

Is the PaperCut server running the connection over HTTPS? If so: 1) Does the copier trust the certificate(s) being presented by the server? 2) Is the server using TLS 1.2 or better for the connection? Also worth a look here: https://www.papercut.com/kb/Main/FirewallPorts/ to double-check.

https://www.404media.co/teachers-are-not-ok-ai-chatgpt/ My favourite comment (emphasis mine): Last year, I taught a class as part of a doctoral program in responsible AI development and use. I don’t want to share too many specifics, but the course goal was for students to think critically about the adverse impacts of AI on people who are already marginalized and discriminated against. When the final projects came in, my co-instructor and I were underwhelmed, to say the least. When I started digging into the projects, I realized that the students had used AI in some incredibly irresponsible ways—shallow, misleading, and inaccurate analysis of data, pointless and meaningless visualizations. The real kicker, though, was that we got two projects where the students had submitted a “podcast.” What they had done, apparently, was give their paper (which already had extremely flawed AI-based data analysis) to a gen AI tool and asked it to create an audio podcast........

We're in the market for an easier and more consistent means of conducting lesson observations across the trust. This would be for primary and secondary settings, with a bit of pre-school. A quick demo of SISRA Observe looked interesting but the lack of SSO (and so MFA) and MIS data sync puts me off. That's two basic requirements missing. So what are your schools using that isn't a series of manky spreadsheets and doesn't require YetAnotherLogin? cheers Pete

We sent in notice (via email, to the correct address) in good time and were instructed that they wouldn't accept email: We sent ours in via special delivery. Parentpay acknowledged receipt within a day or two of posting. If your client is relying on the argument: "Our account manager said they didn't handle contract negotiations and we had to talk to another dept. We then did nothing for six weeks and were surprised when the contract was renewed." ...then the professional thing to do is politely point out they need a spreadsheet (at a minimum) tracking contract renewals and here's a template they can use.

Does OWA work for the recreated accounts? As in - mailbox is otherwise functional, but Outlook classic won't connect? Was the Outlook Classic install aware of the previous shared tenant (GPO, other settings) or is this a clean device that's never connected to the previous shared tenant?

We use it (and Visigo before that). Previously we used eSafe (awful software, Smoothwall bought them out, kept the people and quietly buried the software in the woods). Alerts are actionable if they hit an DSL mailbox (either in the digest or individual alerts, and occasionally we'll get a phone call if it's serious enough). It integrates with MyConcern (dunno about CPOMs/others - poke @tom_newton) to generate alerts if you want that. The dashboard has enough context around the search that I rarely have to add further context for behaviour incidents (OK, occasionally I have to explain niche Internet subcultures). Compare that to other products with a high rate of false positives, the reduced faffing (and freeing up staff for other things) offsets the price (in our opinion).

If the cab's deep enough, we'll use a 2U rackmount one. If it's not (or we're only powering a couple of low-draw things), we'll use a desktop UPS on a vented shelf. please don't put them unsecured on top of cabinets. It triggers H&S auditors.

Our primaries are currently using PiXL ( https://www.pixl.org.uk/primary). It's not really fulfilling their needs and/or the data quality coming out of it is substandard (Yes, GIGO, but I know decent input data exists). We're quizzing local primaries to see what's decent, but to cast the net further afield - what are your primaries using and how is it from an end-user, data quality and deployment / management point of view? cheers (This is not a customer retention opportunity)

@mikeprice same, and I went to a school that insisted Y7 to Y11 used fountain* pens for writing in lessons. Biros were begrudgingly allowed in sixth form. *given the amount of white shirts we ruined with ink, I'm amazed the headteacher wasn't hunted for sport by the parents.

As mentioned up-thread, ban terrible supply teachers from IT lessons - we save about a grand a year in peripherals by refusing to have a couple of people on the premises. Secondly (and it's early days, but working in one of our schools), find a G502 knock-off that's cheap, sturdy and reliable. So far the students have trashed them because they quite like the LEDs.

Mind posting to see if that change persists after the SBC is next patched? (I know it should if they're following best practises and not amending edited config files without asking, but.....)

It depends: Y12 and Y13? Yes - they're allowed phones/tablets/laptops in school (provided they don't use them in corridors or in front of Y7-11) - but their names goes on the whiteboard and we disable their accounts if they're not returned in a timely manner. We reserve the right to say "Nope, you never return it on time". Y7 to Y11? Unless that's your Sports Studies video on there and the deadline's today/tomorrow, put it away or you'll lose it until the end of the day. To be fair to the sixth formers, they're much better than staff at returning borrowed kit.

Yes - updating to the very latest drivers on all the affected devices (using HP Image Assistant) solved it in all reported cases. It's not clear whether we downloaded an iffy driver release when we prepped for the rollout or if the MDT task sequence missed/failed to install a driver and used a generic instead.