pete

So, we met with Wonde the other day and gained access to some test data. Within a couple of hours our data person had a PoC against the test data that mirrors what we currently pull via Command Reporter and (judging from the level of excitement in their email), there's a fair amount of scope for more adventures. You're looking at signing a developer agreement, a £250 setup fee (only needs doing once, regardless of how many schools) and then £10 per month per school for access to the API.

Try Gavin at Active Networks - they go all over. Terrible website, decent fibre and copper work: https://www.activenetworks-it.co.uk/ Email his name at the domain name.

The general thrust has been answered, so I'll address this bit: ...and say you likely need to have the "Tough, it's a work device subject to work filtering - it's not a substitute for buying a home computer/tablet" conversation with them. One person's "stuff you would normally search for at home" is another person's Rule 34 / HR complaint / safeguarding concern if done on work devices. Want to do perfectly legal adult stuff on the Internet? Do it on your personally-owned device in your own time on a Internet connection of your own.

Try Sonja at Utility Rentals (http://www.utility.rentals). But make sure the school has a backup plan for parents unwilling (or unable) to subsidise the school's IT infrastructure or (if able) unwilling to allow the school to install MDM on a device the parent's paying for. - - - Updated - - - Try Sonja at Utility Rentals (http://www.utility.rentals). But make sure the school has a backup plan for parents unwilling (or unable) to subsidise the school's IT infrastructure or (if able) unwilling to allow the school to install MDM on a device the parent's paying for.

You can, but I seem to recall a thread that implied you paid a time penalty for doing so. Right, found the post I'm mis-remembering: The sub-thread discusses some (disproportionate) processing overhead through the use of Azure Groups. A few posters are only seeing that with dynamic groups in Azure AD (which I'd expect to be a bit more grindy), but others are seeing it with static groups as well.

For those of you deploying via Intune, how are you handling software that doesn't (or shouldn't due to licensing constraints) need to be deployed everywhere? Google suggests targetting deployments using Azure AD Groups is noticably slower (to realise something needs installing/membership has changed) than using a device characteristic (is laptop, machinename = "fred") - anyone seeing that?

Did anyone in the Bromcom PR dept question the wisdom of a case study from a Trust who (clearly) didn't do their research before switching MIS the first time round? Or did marketing sneak it onto the website without asking? That isn't a case study I'd have authorised. With Arbor for years and then switched? Sure. A trust hopping between 3 MIS inside of a couple of years? Someone's making poor decisions and (even if Bromcom is the correct decision for them) their judgement is suspect.

If it's a small-medium sized primary, I'd bump it to 100/100. If it's a large primary or a secondary, go to a Gig-capable line and throttle it to the price/speed that does the job at an affordable price. Also, check to see if the school's eligible for something like the Midlands Gigahubs project that'll pay for the cost of installation.

I think I did try a couple of episodes, but someone (host or guest) set my teeth on edge. Current playlist is: High Rollers DnD (Yogscast) Three Black Halflings Dimension 20 Oxventure (Outside Xbox & Outside Xtra crew) Not Another D&D Podcast (very funny, very NSFW).

Used to, picked up a bit over lockdowns, but haven't for a while and mostly get my fix via podcasts (naddpod etc) Quite enjoying the Natural Six episode 0/0.5 at the moment (https://www.youtube.com/@NaturalSix). Combine the two and you've got LARP.

Primary students (when of an age to have an individual account) use preferred firstname.lastname currently, since they can usually remember that. They can only email internally. Secondary students have some combination of year of entry + name or year of entry + admission number. I'm leaning towards retrofitting them as: XX-23YYYYY(etc) Where XX is school code, 23 is year of entry and YYYYYYYYYYYYYYYY is the existing unique thing at a school level.

We still use WSUS (I don't yet have a better dashboard for easily verifying patch compliance across the trust) with a 2-week patch deadline for clients and servers. Servers are patched in 3 waves (WSUS groups). Test VMs and/or not-user-facing. Downtime doesn't affect production, so we can test patches anytime. Redundant services (DCs, DHCP (assuming N+1 in a failover/HA), etc). Can be rebooted and patched in the working day provided the patches have been tested Things that hold user data. Needs a known-good nightly backup done before patching and can only be rebooted 00:00 > 05:00. Once patches are released to servers, they install and reboot according to their "active hours" setting.

Mods, any chance of adding this to the useful links posts? It'll save a lot of repeat threads. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/data-sharing/a-10-step-guide-to-sharing-information-to-safeguard-children/#step-1

As the title says really, just want some input. Currently at SchoolA it's turned off in Google Workspace. In schools B, C & D it's in the default state. School E doesn't use Workspace. I understand that it's useful for end-users across N+1 devices, but the failure modes that are most obvious are: End-user logs into work Google account on personal device, all saved passwords synced across increases the risk a household member accessing work data (on non-MFA-capable sites) or an unpatched browser leaking authentication data. End-user logs into work Google account on personal device, they or other household member does perfectly legal adult stuff in their own time that then (open tabs, bookmarks or history) gets synced back to work devices and causes HR issues. edit: additional context. This is Chrome on Windows/Apple devices, not Chromebooks.

Off the top of my head, the following functions still require a mapped drive for certain processes (there may be others that I've forgotten/don't have to touch): Exams Organiser (expects an EXAMIN and an EXAMOUT folder etc) Census - requires a mapped drive for saving census and reports Nova T6 (Timetabling) - loading .spl files A2C Exam entry upload / result download (unless you're using a centralised config adjusted to use UNC paths)

Our is based on the IRMS Toolkit for schools, with amendments for exam regulations and specific local stuff that doesn't fit neatly into existing sections of the toolkit (such as IT log retention). Where there isn't a legal or regulatory minimum/maximum, you look at operational requirements and pick something reasonable, for example: Administration of medicine to students Why do we keep this data? So staff know that Bob in 7B had 2 paracetamol today already at 11am and to record the authorisation from parents about the administration of not-prescribed medicine. Or (conversely) so we know Sarah in 8G refused to take her prescribed medicine for X and we need to inform parents. How long is the information useful for? Maximum 1yr. Use case is proof of authorisation, prevent overdosing and having data for medical staff should it be necessary in an emergency. What do we record? Date, time, student name, medication, dosage, any pertinent notes (parent authorising paracetamol, for example). Where is it recorded? (Spreadsheet)

Electrical work (Lighting) could be covered under a Condition Improvement Fund bid, especially if you have other electrical works done at the same time. If you have a lot of old (non-LED) lighting around the school, you may qualify for a SALIX loan that could also be used to refurbish stage lighting. We use these people: https://www.s2e.org.uk to help write our bids.

We are looking for a full-time Deputy Digital Development Leader to join our IT team. Responsibilities will include liaising with staff to identify innovations, assisting with managing projects and line management of IT Technicians. You will be a member of a team who deliver onsite, remote and telephone support for the IT systems and related equipment within our schools, supporting both students and staff. Based in Horncastle, you will need to have a full, clean driving licence and your own transport to undertake visits to schools within our Trust, for which mileage will be paid. Your range of experience will include network troubleshooting and server administration. This is a permanent 52 week full-time post, working 37 hours per week. Details here: https://www.horncastleeducationtrust.org/Deputy-Digital-Development-Leader/ OK, official blurb out of the way. The role is deputy IT lead for a trust of 5 schools (2 secondaries (817 & 605 students), 3 (~50, ~50 & ~170 students) primaries in Lincolnshire, all within 30mins of each other (10 mins walk in the case of the secondaries). You're replacing someone who left (on good terms), but the role has been expanded to improve the bus factor of me and to give my team (4 people currently, you would be the 5th) an escalation point that isn't just me. PM me if you want a chat about the role / more info. If there's anything generally useful I'll post in the thread.

No real issues, beyond checking relevant domains they wouldn't get HTTPS intercepted. They're using transparent filtering. I assume you've gone through the KB article: https://help.verkada.com/en/articles/4132169-required-network-settings

Running it here for a class full of students. We're on a gig connection with ~20% utilisation and it's taking ~20 minutes for the site to load. One of my techs reported seeing a "2000 connections reached" or similar notice. My guess is the outsourced provider either didn't properly load test before the actual testing cycle or is auto-scaling rather than pre-loading and then scaling back if need be. https://www.ox.ac.uk/admissions/undergraduate/applying-to-oxford/guide/new-arrangements-oxfords-admissions-tests

Currently reading "Legends & Lattes" by Travis Baldree. So far it's enjoyable. "Orc adventurer finishes her last job, hangs up her axe and opens a coffee shop"

You're also the legal owner of the device he's using and don't need anyone's consent to filter it however you choose. Schools do need that consent if we're monitoring devices we don't own and it's a very unwise school who isn't explicit about the monitoring on any school-owned devices that enter homes. We need to make sure that what we're doing is proportionate. Why? So when $daft_school in your local area does something stupid with surveilance tools, your response is "How we monitor students is in the info pack to parents and there's also a copy on the website", rather than scrambling to find unexpected landmines planted by colleagues, such as this recent one: https://www.techdirt.com/2023/10/16/aclu-calls-out-school-surveillance-programs-in-latest-report/

Is your print server joined to / aware of Azure AD? Can it check that you/your laptop is allowed to connect to it? It sounds like you've chopped the DC out of the network and the print server is still trying to find the DC to check who's allowed to access printers. Assuming the guest account is disabled (it should be), "Everyone" = "people the print server can see have valid accounts". Depending on what sorts of printers you have to tolerate and the complexity of your environment, maybe consider something like PaperCut's Mobility Print instead.

Yup, it's not reasonable to expect people to check websites on a regular basis just in case a policy/T&Cs have been updated. We (MAT) have 44 publicly-available policies at the trust level. Individual schools have ~10-15 publicly available policies (attendance, uniform, home-school agreements etc) on top of that. A basic "hey, we changed policy X, here's the summary of changes and a link to the new policy" email protects the staff member and the employer.

Yeah, that's the killer feature for me - portability between schools. I want our data people having adventures in data, not faffing about trying to coax it out of MIS in a sane fashion.