pete

We have a trust-wide onboarding process that's a result of lessons learned and things that annoy new hires and hiring managers. It's not perfect and we're still iterating on it, but it's better than the "Bob appears outside the IT office looking hopeful" that used to happen. After some home truths and the resulting toys out of prams, our rule is "No MIS entry? No access." It took a while to get there and we're lucky that we have a fairly stable team of supply staff on call. Being in* the MIS means: Someone has completed vetting and barring checks on you - you're not just a rando. Accounts are automatically disabled when the contract ends. HR/the school have accountability for account creation and expiry. The school you're based at has emergency contact info for you You will get alerted to school closures before you set off to work AD, Entra, Google Workspace accounts, group memberships and licenses will be automatically assigned. Third-party tools that use SSO for authentication will work You can use the canteen to buy food, should you wish. We can assign you cover work and a timetable. ...and many other things that hook into our source of truth. *Just the basics: Name, contact info, QTS, Start date, End date if temporary. Adding them here doesn't break any HR functions that aren't male cow output excuses.

In Iiyama Share, turn on permission mode to require in-classroom acceptance of connection requests.

^ The obvious rarely-used bell sound is essential. It must sound noticably different. Not "we'll make the usual noise last a bit longer" as staff will assume someone's messed up bell timings and/or "maybe we're on fire and should assemble on the field". Failover modes when people are on holiday/ill/offsite/herding a class and they can't fulfill any lockdown responsibilities. Or when people change jobs? Can staff lock themselves and children somewhere secure? Are there enough keys? If you're part of a MAT: Can the estates/IT team from another school access your CCTV and provide access to police to track the situation? Have you got a central phone system? Are there site plans available of each school? Are they up to date? How will inter-school visitors know it's happening? What about people en route to the site? Especially if they're a regular visitor (estates/IT/catering/HR etc) who just badges in as usual - they won't have necessarily phoned ahead.

Assuming the internal network is up, we'd send a message via Netsupport to powered-on devices. Most management platforms should have similar functionality.

Service plans are here: https://www.findmespot.com/en-gb/products-services/service-plans#spot-gen4-plans (180 euros/year or 14.95 euros/month). GTC also rent out the trackers for £6.50/day with a 7 day minimum term.

Something like this: https://gtc.co.uk/products/spot-gen4-satellite-tracker with the track progress function turned on?

^ I'd concurr with using the webclient behind Azure (now Entra) Application Proxy: https://learn.microsoft.com/en-us/entra/identity/app-proxy/application-proxy-integrate-with-remote-desktop-services If your devices are (or can be changed to) hybrid joined or native Azure look into the Global Secure Access (currently in Preview): https://entra.microsoft.com/#view/Microsoft_Azure_Network_Access/GetStarted.ReactView?Microsoft_AAD_IAM_legacyAADRedirect=true while you're at it.

Similar to @Michael. Network hardware/appliance-ish things get a time.ourdomain.whatever CNAME that points to a couple of DCs and uk.pool.ntp.org if they support DNS names in config files*. *some network hardware will do a nslookup if given a DNS name and then put the returned IP in the config. But not tell you this.

I'd also examine the docks closely and the quality of the power in that part of the building. I know that doesn't explain the wireless clients though. At one of our sites, USB-C docks work more or less flawlessly in the main buildings. In two satellite buildings (across a public access road and on a different overhead power feed/meter), docks* are unreliable (HDMI flicker/drop, occasional network disconnects) unless fed via a UPS. Powering the docks (via a USB-C brick) may improve it a bit, but won't eliminate the problem. Look at USB power-saving settings too. *all brands.

Desktops or laptops? Same hardware as everywhere else (make/model, but also firmware) or different? If you move one of those people to another area for testing (ideally with the same laptop), does it improve or stay the same? Has anything happened that would just affect that area/the people in that area? Do the inhabitants use software that you wouldn't typically have running? Or use it in a different way? Got any memory leaks?

Yeah, I have a 2019 DC that's definitely exhibiting higher-than-normal memory use for lsass.exe. Not as bad as the 2022 DCs, which anecdotally seems to leak faster / be more of a problem. I have a tiny 2022 DC (fewer than 50 users) with an lsass.exe consuming memory faster than on the 2019 DCs serving 1000+ users.

If your primary school parents order (from a set menu) and pay for meals online, what platform are you using and what's it like? We have primaries schools with ParentMail and ParentPay (predominantly ParentPay across the trust), but we're not using or paying for the school meal ordering modules. Looking for something that's reliable, has usable support when necessary and creates minimal complaints from catering managers, finance staff and parents. I don't need cashless catering integration (food will be pre-paid and pre-labelled ("Bob's sandwich")).

^ I'd add the "if it's a SQL server for SIMS (or cashless catering), stop any third-party (or SIMS) services that interact with SQL" caveat. As one of them won't stop properly when it's asked to for the patch to install cleanly.

~160 iPads across 4 schools under 2x Jamf School instances. ~£5/device/year if you want a pool of licenses that you can allocate to any device or ~£12 for a perpetual license for a device (but is tied to the device). One instance (secondary, 1-2-1 for a specific subject) uses Microsoft 365 login for everything. Unwrap iPad, connect to WiFi, login with school email + password and iPad configures itself. Separate instance to make setup seamless from boot. The other instance has 3 primaries with 1-2-1 for the staff and shared for the students. It's decent IMO and you can have N+1 Apple Schools linked to the same instance with per-school sub-accounts.

We're (5 schools, 2100 users, 1000+ devices plus ~300-ish BYOD) averaging 3.32 GB/day or 103GB/month. 3 of those schools are primaries though.

It should be free for .sch.uk domains, but because school.region.sch.uk is weird (compared to collegename.ac.uk, for example) automated systems don't always get it right.

Clubs, awards, cool things he's done at school, volunteering in the community. Treat it similar to a UCAS application in terms of selling himself. If it's the first job and the line manager's open to hiring 16-18yr olds, they're basically looking for honesty, punctuality, asking questions before doing anything daft and not being a liability to themselves or others. Character reference from form tutor or headteacher probably wouldn't hurt (provided your son hasn't burned any bridges there).

Yup, also getting hammered with emails about it from mailcheck. Assuming Google have messed up and mailcheck will take a while to catch up once it's fixed.

At present we have ~10 production SSIDs across the MAT (but no more than 3 at each site). This is.....problematic for non-technical users who unexpectedly visit a location where IT never expected them to roam. I want to consolidate that down to 3 SSID: MAT-owned devices (domain/Jamf/InTune joined) Student BYOD (owned by individual students, radius auth) Guest (randos - WPA2/3 personal that's rotated and/or a captive portal token that's valid for X hours) None of the schools care about having their school initials in their SSIDs. Anyone done this recently? Any unexpected pitfalls (beyond making sure the SSID info is pushed out to devices well in advance of changeovers and that any certs presented to clients are publicly trusted)? Pete

We use Krystal (https://krystal.io) as our registrar for domains. I recommend them. The transfer process for a .sch.uk domain will be manual (open a ticket) but fairly painless.

Currently the Konicas phone home (directly via HTTPS, no terrible software involved) for everything but staples. The Kyoceras use some awful software (locked to the VM's mac address) that has to be communicate with all the copiers and then it might order consumables. It frequently breaks. They are via a reseller though, not Kyocera direct. The Canon is manual ordering, but they don't get through consumables fast enough for it to be a big problem.

I've had a couple of users report (and one demonstrate) that when they try to access a shared mailbox via the "Open another mailbox" routine in Outlook Web Access, it simply opens another version of their mailbox. If they open a new tab and go to https://outlook.office.com/mail/[email protected] the shared mailbox opens fine. Permissions are correct, worked yesterday, 365 broken things list doesn't mention anything related (though that is usually delayed). Anyone else had it this morning?

Thanks everyone. Follow up queries: Does anyone have copiers that auto-order replacement staples (I suspect this is a unicorn, but...) RISO kit - how fixed is the ink these days. Google (and many university "here's how to use a RISO machine" help pages) imply it's still more like newsprint. RISO again: If I need to print a lot of full colour, are they still feasible?

We're up for renewal on our copiers. Currently mostly Konica with a solo Canon and a few Kyoceras. Looking at: Canon (but have concerns about reliability) Kyocera (have some, seem decent and robust. Probably not using the same supplier though as evidence of mis-selling and stupid print accounting software) Ricoh (maybe, Ricoh direct messed us about with a trial and likely ruined their chances) Sharp (no experience, but heard good things) Toshiba (as above) and what I care about is: Hardware reliability Parts availability. Functional, robust supply chain. Working back office functionality (billing, ordering, account manager competent and contactable) PaperCut compatibility. Decent Postscript drivers Ideally integrator has experience of PaperCut with N+1 sources of truth for authentication. I'm happy to go direct to PaperCut with queries if need be, but since I have to pay the copier company for PaperCut support it would be nice if they could provide it.

Classroom teachers = 50 minutes. Classroom teachers that I find logged in and unattended? 10 minutes until their line manager has had a word with them.