pete

Not unless you're appeasing an auditor who's never heard of Password Setting Objects. If you are, put something reasonable in there as a catchall and then put more granular policies in via PSOs (Active Directory Administrative Center > (domain name) > System > Password Settings Container. If their password has expired, it'll force the change at next login. If it hasn't expired, nothing will happen. As others have said, you're strongly encouraged to enforce good passwords from the beginning using something like Entra ID Password Protection (https://aad.portal.azure.com/#blade/Microsoft_AAD_IAM/AuthenticationMethodsMenuBlade/PasswordProtection), require MFA and monitor for problems (365 Defender alerts, SpecOps Password Auditor, HiBP subscription (school discount available if you ask)) than force frequent password changes.

We have one per school as a VM (2 cores, 4GB RAM. 40GB disk). Building a new one and adding it to 3CX takes about 5 mins. Looking at the 3CX HA page, I suspect you could make that work across two VMs on different hosts with a bit of faffing unless the setup script explicitly checks the hardware isn't virtual.

I should probably have made it clearer I'm the trust data protection lead (with an outsourced DPO to keep us honest). Why? We had a looming deadline (May 2018) for compliance at one of the schools pre-MAT, none of SLT were taking sufficient notice and the business manager (at the time) and I got fed up and fixed it. Since then I've been trying (with variable success) to entice non-IT colleagues into sharing the oversight load and responsibility.

Edit: If you wear a school or trust-wide data protection hat......... Do you check code locks on doors aren't set to 12345, 67890, 2024, 2025 and any founding date found carved on a stone near the front door? If you find a key, do you see what it opens and follow any further found keys? Do you restrict yourself to knowledge that a student or visitor familiar with the site would have? Or, to put it another way - absent taking along entry tools, how close to a physical penetration test do you get?

^ All of the IT areas that might contain personal data should have retention defined within your R&D schedule. Your retention decision-making is a whole-school consideration and having it written down where everyone expects it to be prevents surprises. Include retention for things like: Student homedirs Staff homedirs (ideally include a requirement that their line manager checks/countersigns deletion) SLT Email - deleted items (you may want a longer audit trail for bigger decisions by SLT and Governors etc. If you're using legal hold options, make sure it's documented) Staff & Student Email - Deleted Items (We automatically empty it after X days, it's in the policy agreed by the trust board, yes, that's why your "important stuff" is gone) Staff and Student email - junk email (see above) Staff and Student Mailboxes Internet Access Logs - without incident (general "Bob searched for penguins") Internet Access Logs - with incident ("Sarah was flagged searching for inappropriate content and a member of the pastoral team was alerted" - retention tends to be longer, may be added to MyConcern) Safeguarding / Misconduct logs (Smoothwall Monitor, Netsupport, etc) - as above. If these are exported as part of an evidence trail and included in a student record / MyConcern, document that too. Network logs (event logs, webserver access logs, network performance data). Usernames, public IPs correlated with usernames, etc (webservers, 365 and Google Workspace logins) MIS Data on Students (plus EIC, SEN extended retention considerations) MIS Data on Staff (and also whether you need to keep "Bob worked here from X to Y in role Z" basic info perpetually to help deal with Teachers Pensions idiocy - we do.) MIS Data on Parents / Next of Kin Backup retention (once deleted, how long does it take for data to fully rotate out of the backups?) Print logs (if you anonymize logs after X days, include that too) CCTV Recordings Telephone Recordings

More like: Them: But I like ChromeX IT: Trust policy forbids enabling or funding facism, use Edge/Firefox. ....and woe be to the DfE wonk stupid enough to say "schools rejecting facism is a political position and you shouldn't be doing that".

^ Whatever your retention policy says. If you're writing that section of the retention policy, ours is: Home folder: Archived for 13 months then deleted. Student Email: Mailboxes are active until 31st August after the leaving date (or October if a student's daft enough to use a school email address for clearing and remembers to ask in time). Mailboxes are recoverable for 180 days after that. Student OneDrive: As above. Timeframes based on historical student behaviour and they usually gives the students sufficient time to remember their only copy of X was saved at school. Examplar work (with identifying info removed) may be requested and stored for longer.

I read that legislation as expecting / wanting an immutable snapshot of the attendance for each month that independent of the MIS and then keeping that snapshot for 6 years. A "live" copy of X years attendance data can be tampered with by an SLT wanting to manipulate figures (for example). Yes, that dodgy school in your local area that you just thought of. Edit - notably that "6 years of monthly backups" isn't mentioned in the guidance accompanying the legislation: https://assets.publishing.service.gov.uk/media/66bf300da44f1c4c23e5bd1b/Working_together_to_improve_school_attendance_-_August_2024.pdf The overall retention is, but not the snapshots.

How are they planning to pass safeguarding during the Ofsted inspection if they have a single person willing to throw SLT under the bus?

A dept at one of our schools have (some time ago) moved from individual Google Drives shares to a Google Shared Drive so permissions can be more sanely applied. However, they neglected to mention an intricate web of inter-document links that point back to the old individual Google Drive shares. Those links work for most existing staff, but for any new staff they're broken (you need to request permission). Assuming appropriate permissions to the new and old locations, has anyone come across a way to update the links in bulk / flag up where a needed file doesn't exist in the Google Shared Drive?

We're using Coconnect across 5 schools and (so far*) they don't suck. They're pretty good actually, we've had them for a few years now and they haven't gotten complacent. *as of 04-03-2025. Not guaranteed after that date.

My point wasn't "don't try anything new", but "don't accept a half-baked substandard tool just because someone decided to throw one into the MIS package on a whim".

Sorry, missed this. Yeah, used as a forwarder MAT-wide (no adult content or malware) and also (where we can*) set as connection-agnostic DNS for devices that roam. It's the "filter of last resort". *can cause problems if a guest network at another school blocks use of third-party DNS and not all OS support a "use this DNS regardless of where you are".

I was promised SIEM integration in 2016 (/forums/smoothwall-direct-support/172292-do-you-use-siem-security-information-event-management.html) But seriously, just an "username at IP/DNSname triggered an alert (don't need the details)" fed into Graylog/Wazuh/Windows event log forwarder would make log correlation across N+1 systems much easier when investigating the more serious incidents. Reviewing safeguarding alerts to make sure they're DSL-friendly too. Especially for blocked web searches where the search term isn't broken out clearly in the report. Redacted example below. I can tell they're searching for tobacco products and (given the context of the particular child) that it needs dealing with, but a more obvious "term searched for" field would greatly improve it.

Nope, nope, nope. That functionality will be the least maintained and most overlooked section of a system that's already torn in multiple direction by competing demands, government whim and limited development time. It'll be worse than the abandonware that is SIMS' Exams Organiser.

Smoothwall, backed up by Cloudflare and MDM-specific (Jamf in our case) filtering options.

They did. The compliance side is tolerable but the HR side (which is a newer product) is slow, poorly designed, the alerting is unreliable and the MFA implementation is flaky. Every are not responsive and the documentation is poor. Unless you have a lot of political capital with your staff that you're willing to burn, pick something else.

If 32bit Chrome is installed, I've seen 64bit Chrome install itself in the same folder as the 32bit version if you install over the top (vs remove 32bit, then install 64bit).

We stuck with MyConcern for the time being because it can directly ingest alerts from Smoothwall Monitor, allows easy data transfer between schools (that use MyConcern) if students change schools and has a built-in redaction tool for subject access requests.

We use Every. Don't use Every. The compliance side is mostly inoffensive, but the HR side is grindy, slow and the permissions backend (compliance and HR) is not designed with a MAT in mind (very much "bunch of schools" with some mat-level logic plastered on, rather than top-level org with sub-orgs). Anyone working at the MAT level is going to get annoyed fast by the round-the-houses paths they have to take to access things in individual schools. It got noticably worse after Iris took over.

Backups and upcoming things (deadlines, projects, number of laptops needed for exams vs number of laptops you've been asked for). The first week is vibe check and the more obvious WTFs. Second week is poking the WTFs with a stick.

I mean, there were less of us and it actually required some work and knowledge to do things, so the majority of the awful people were still being analogue awful but....

We provide laptop sleeves unless someone specifically requests a bag. Typically something like these: https://www.amazon.co.uk/JETech-13-3-Inch-Waterproof-Briefcase-Compatible/dp/B076ZQQTYR/?th=1 Our lot usually have a bag already and don't want an extra bag just for something the size of 1-2 stacked A4 pads.

Are you using Kinsta.cloud? If you are, check the alternative names on the certificates in the chain via https://www.ssllabs.com/ssltest/analyze.html A web browser won't necessarily care. A HTTPS-intercepting proxy might (way more pedantic about cert problems).

Yes. Assuming Windows Radius, go into NPS > Policies > Network Policies and make a new policy ("AD Computers" or whatever) and on the Conditions tab add "Windows Group" (or machine group) and pick a group the laptops are a member of.