pete

Yeah, wall-powered with the built-in grid on these ones - they're the old, annoyingly indestructable ones. Considering how many IWBs we've got deployed across the schools I'm surprised we haven't run into it before, but looking at the maps very few areas have an IWB intersecting the path to the closest AP.

We have a classroom where the closest AP to a teacher's desk is in line with a (typically powered on) IWB*. We've had complaints of poor signal in there, but not elsewhere in the general area. Walls are the same construction throughout the building. AP <> IWB (within 2 m of the AP in the corridor) <> Laptop on desk while we plan to take the board down in the holidays to test if/how much this affects wireless signal, has anyone come across IWBs in the WiFi path affecting signal noticably? *old-style Promethean.

If they're in a MDM (I'm guessing they're not, from the "they have signed up for" rather than "we got them X with plan Y"), you should have options for content filtering there. DfE guidance says they should be filtered / monitored on-device regardless of where they are: https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges/filtering-and-monitoring-standards-for-schools-and-colleges So I'd flag it up with the safeguarding lead to at least risk assess it / sign off the risk.

Is the device already pre-registered with Azure AD (you/reseller have imported it into Azure before the box was opened) or does Azure know nothing about the device?

We've found 4 years is about the sweet spot for cost vs reliability, provided you've properly sized copiers for the load. That plan may not survive contact with the history dept (have beefed up a couple of copiers this refresh cycle), but it generally works.

So, follow-up. Someone had the same model chassis (open box but never used, manufactured late 2019) in their warehouse and I grabbed it for a nominal sum. It's arrived today, has just passed testing and is sat waiting for an agreed downtime window to swap with the current unit.

@PotNoodleTech Currently looking into that - may have the option of a never-used chassis via another route. Yeah, I like the Eaton Lithium-Ion models, but *waves at the current state of educational funding*.

So, follow-up and to address a couple of comments. Skip a few lines if you've come here from googling part numbers and hoping I have a solution. We're a MAT. IT spending and risk management is mine to deal with / manage. Interested parties were kept in the loop and informed as soon as the problem was identified. However, it's a temperature-controlled environment, the UPS is designed to run without that fan for a while and so it's not a critical risk. The fan is a replacable part and we have two electricans on staff. Plus the opportunity cost for a comparable unit is £8K, so I have to check parts availability. Future Googlers You can't get the replacement part any more in the UK - there's none in the channel It looks to be on perpetual back order in the US. RS Online doesn't have a good third party option and there are (as mentioned up-thread) the insurance implications even with a qualified electrican installing it. What you can do, is give the fan mount two firm flicks of your finger (as you'd flick a marble) and it'll start up again, clear the alarm and keep running for ~24hr so far. That's clearly not a permanent fix - we still need to replace the UPS, but it gives us some breathing room.

So the UPS is currently running still (have dropped temps in the server room to compensate) and the power modules have dedicated cooling fans which will help push air through the unit. I'm reluctant to power it down to remove and inspect the fan until I have a known-good replacement fan to hand (or a fresh known-good UPS). It's a 4-pin fan. The part APC were using is a Comair-Rotron FE12H0X-039453. RS Online have a few similar-ish parts but the original isn't available as a part in the UK channel at least. I'm trawling eBay and RS at the moment for likely parts.

Yesterday evening we had a system fan (the one at the rear above the network slot) fail on an APC Symmetra RM 6000. It's an 80mm fan with a custom pinout, APC part code #490-0024B. So far I've found it in Canada with a 12-15 day lead time (which typically translates as "we'll try to get it, but it's unlikely"). Anyone got a reseller that handles niche APC parts? So far most are restricted to network cards, cables, power and battery modules or (if they do have a good part selection) handle heavier datacenter-grade kit. (And yes, I've already nudged Dave at ICT Direct to have a ferret through the warehouse).

^ One thing we did was to change the organisation name on the tenancies to school/trust initials. Our lot aren't precious about what things are called - YMMV. So rather than "C:\users\Bob\OneDrive - Eric's Marvellous School" you'll get C:\Users\Bob\OneDrive - EMS" For the local path to update for some users you'll have to unlink and re-link their OneDrive (or wipe their profile, depending on if it's an assigned or shared computer). This has mitigated (somewhat) our history staff and student's habit of "use the essay question as the document filename".

Alice Bell's Displeasure Island. Island murder mystery. Not my usual fare, but I took a punt on it based on her writing for RPS and her first book. Enjoyable holiday read.

Just tested it on one of our spare domains and checking against this guide: https://developers.cloudflare.com/dns/dnssec/ you appear to be correct and Capita need to pull their finger out. Alternatively swap your registrar for someone competent. I like Krystal (there's a few threads on them around here) but others are available.

Is it all / most Hotmail/Outlook emails or just some? If it's just some, do they (ignoring the subject under discussion) share similarities with spam emails?

With regards to preventing students running powershell scripts, set your execution policy (Get-ExecutionPolicy/Set-ExecutionPolicy) to AllSigned on OUs with computers that students can use, then use a copy of the script signed by your inhouse certificate authority. Note that if any of your remote management (or other) tools use powershell scripts stored on the local PC (assuming RemoteSigned), it'll break their functionality. Could the students get a publicly-trusted code-signing cert via something like Sigstore*? Sure, if they're sufficiently motivated or skilled and willing to provide identifying information to Sigstore for a malicious purpose. But simply marking the Fulcio CA as distrusted via a GPO solves that and ultimately the cert can be linked back to a verified person. *https://docs.sigstore.dev/signing/quickstart/

If you publish a full desktop (via .rdp or the HTML5 webclient) does SIMS also behave erratically? (We're trying to nail down whether launching SIMS as a remote user is a problem, or whether launching SIMS as a published application is a problem).

Sorry, not an answer to your question - we don't use the PaperCut client here apart from reprographics staff. But I am interested in seeing how you're getting on - I'm considering similar across 5 schools, but the sparse information on the KB article has sent me looking for other companies/schools that have successfully implemented it.

We had a few of the earlier versions of those patch leads (they send out free demo packs). Back then, the filament protruded enough from the patch lead end to cut into your hand.

With my "has to prevent misuse/loss of personal, financial and other confidential data" hat on? Absolutely idiotic and tone-deaf. "It's super secure provided no-one compromises the credentials used to log into the user account on the PC". Well that'll be fine then, won't it? Oh wait, no. People are lazy, choose terrible passwords and then re-use them. So [email protected] has the same password for every other website out there. But worse, you're now taking regular snapshots of things that no sane person would screenshot and retaining them for a rolling 3 months. So a compromised set of credentials is immediately more valuable to a bad actor because financial data/credentials in a screenshot will be fresh and yield more revenue when sold on. Also telling that there isn't any up-front "you can turn this off if you don't want it" or "this defaults to off and you have to explicitly turn it on and we make it explicit what it's doing beforehand" messaging. TLDR: The Microsoft PR teams are all in the pub plotting how to dispose of the marketing teams.

One of our schools has reported an ActivPanel (age unknown, but at least 6 years) that after powering on will be fine for 30 seconds and then the screen flickers on and off every 2 seconds or so. This will happen regardless of anything connected and power to the room / socket is stable (it's like the backlight goes and comes back on). We're going out there to have a look next week, but I suspect it's on it's way out. Anyone had this and it was something daft? cheers Pete

We try to alternate patch panel and switch. We'll use cable management bars where appropriate, but not to excess (I'd rather retain the rack units and manage down the vertical posts). While you're rearranging, buy a pack of Rackstuds (the Duo ones). Your hands will thank you and they're easier to use than cage nuts. They're rated up to 20KG and we've hung PoE 2930Ms with all the bays populated with hardware without any concerns.

365 (or at least A3-licensed 365) only has an external senders tooltip. My kludge doesn't scale particularly well for a large trust with a lot of managers/budget holders (there's a character limit on the rules) but it's less work than cleaning up after someone helpfully buys Amazon gift cards.

I'd suggest a rule that quarantines any email that pretends (display name, first.last@, f.last@, firstlast@ etc) to be a manager/budget holder/etc and comes from a free domain (hotmail, gmail, etc). So [email protected] = delivered. [email protected] > quarantine. It's not foolproof, there'll be a few false positives but it catches the low-effort scammers. If your CEO, CFO and headteachers have relatively uncommon names, quarantine any variation of their name from any domain that's not the work-related one.

Bromcom will migrate additional years for a nominal cost. We require 7 years.

Overhead (from telegraph pole) or directional drilling and a direct bury cable? Round here (Lincolnshire) nearly every telegraph pole has sprouted a fibre termination box at the top of the pole so other than a ladder to get up the roofline to attach the cable, I don't see a need for digging up the garden.