pete

Get some background info. Is the parent basing their concerns on their experience of data protection/privacy laws in mainland Europe? Perform due diligence the same as any other product or service you buy into. Your DPIA that you undertook before implementing the solution should have covered this. Including checking retention limits (and adjusting where necessary) and explicitly opting out of any "we store data to improve the product, it's anonymous, honest" T&Cs. Plus research into the company and any past security incidents and how they handled them. Education software providers do tend to be a bit more slack when it comes to security (a search on Edugeek will reveal a couple where the vendor went completely toys out of the pram when called on their questionable development decisions), so making sure the school has done due diligence is a valid query. Safeguarding does not trump GDPR. GDPR does not trump Safeguarding. You act with consideration to both, sharing only the information necessary with the people necessary to achieve your aim (protect the kid). (Yes, I would like to hunt down the safeguarding person who started the X trumps Y idiocy).

I tend to do a logical diagram (double-checked against LLDP data) and then a physical diagram like @jthompson suggests that highlights rooms 1-12 are fed back to cabinet X. For "exactly where does that fibre run go through in the building", I'd create a wiki page with photos of transition points (into manholes, moving between wall and ceiling, from roofspace A to roofspace B) and a map with routes in different colours per run.

It is possible to do it with powershell (search-mailbox). Microsoft are very likely to rate-limit you though. How much of what A3 offers would be useful to your school? "In order to do X, it costs Y, but it also includes $list_of_useful_things, so it makes sense."

If the camera supports PTP (most of ours do - you may need to amend the settings) they should appear as a camera (with pictures) and not storage.

Compatibles, usually from FS. We keep a 10Gb and 1Gb original around for those "see, it's the same problem with a branded transciever" moments when support insists on ticking a box on their script.

I haven't done it myself, but if Salamander don't say "yeah, we can automate that by making old teams (linked to classes) read-only and flushing them after a year", I'd be very surprised. Give them a shout. The only caveat I'd put in would be some sanity-checking and an "I'm about to delete these Teams" email to IT in advance in case your SIMS admins are a bit cowboy-ish.

We're feeding data from various MIS into PowerBI. While it works, it's inelegant, the process is brittle (scheduled task > command reporter > CSV > hot folder > power automate > Power BI). We already have a lot of that data in Wonde to sync to third-party services, so I'm asking Wonde about pulling data (across all our schools) from Wonde > Power BI to cut out a lot of the faff and unnecessary steps. Has anyone else done this and how did it go?

Considering using publicly valid certs. Either LE if I can get reliable automation of RenewCert > Import to RADIUS server or pay £10/yr for a not-LE cert (but then have to deal with the daftness from vendors).

Where are you sending email from? That second IP resolves to mailanyone.net, which is (I assume) a bulk mailing service so I'm inclined to agree with Google.

Cant help with the offers, but that Groupcall report definition file has been created (by Groupcall) to sQuid's specifications. My guess is the sQuid are perfectly capable of asking Groupcall to create another report definition file minus staff details but are unwilling to do so. That unwillingness may stem from their platform being unable to handle imports with those missing fields, or not wanting to pay Groupcall to create an alternative report, but this isn't a problem created by Groupcall.

Post-incident reports go to the appropriate headteacher (and/or CEO, depending on impact). Typically a "this happened, this is why it happened, this is the current mitigation in place to prevent, this is (if applicable) additional mitigation being put in place". Major changes (ISP swap, big migration etc) are communicated to headteachers ahead of time and they get a post-change report (typically any variance from planned changes).

It's pretty trivial to migrate the config to a supported OS. Below is a decent guide: https://www.azure365pro.com/migrate-azure-ad-connect-to-a-new-server/

My tip would be to use "Adults" rather than staff so it's clear that it applies to governors and other people who may visit the site. (yes, that's another example of how AUPs have sections devoted entirely to things Bob did)

Not NW, but https://this-museum-is-not-obsolete.com from the person behind Look Mum No Computer and the Furby Organ. GCHQ do work with Manchester Digital (https://www.gchq.gov.uk/section/culture/education-and-outreach) Cloud Imperium (Star Citizen) have a studio in Manchester.

There was a recent mailshot (blog?) about making it easier* to work across N+1 tenancies: https://learn.microsoft.com/en-us/microsoft-365/enterprise/plan-multi-tenant-org-overview?view=o365-worldwide https://practical365.com/multi-tenant-organization-m365/ *For values of up to 5 tenants. Currently in Preview. Possibly for a "Microsoft's house of perpetual musical chairs" value of easier.

Or, rather than recreating the account, pull them out of the AD recycle bin. Get-ADObject -Filter {displayName -eq "Joe Bloggs"} -IncludeDeletedObjects | Restore-ADObject 365 will just relink the account.

We've found the opposite. Lots of things can pull data from SIMS but (because of the general awfulness of SIMS) getting data back into SIMS is painful (beyond a couple of items such as email addresses). When shopping around for a HR platform, most of them said "if you weren't using SIMS we could do X".

Try Krystal (Krystal.uk), though you may need to open a ticket as the automated system doesn't expect .sch.uk when doing domain transfers.

If recovery is linked to any legal proceedings (actual or potential), I'd get a third party recovery firm to do the work. "I need a 20 year old email" usually means something's being disputed. Look for edb > pst converters such as https://www.systoolsgroup.com/convert-edb-to-pst.html Work from a copy on a decent spec computer and be patient. (I'm assuming you don't have a backup of the exchange server config - if you do, then Veeam B&R may also be an option).

Looked at it but the CE auditors made very dubious noises as it's just two lots of unchanging information that can be intercepted/shoulder-surfed without the user realising. The second factor should be something ephemeral (regenerated every 30 seconds) or hard to get hold of in a way the user wouldn't notice.

Considering it with pre-seeded tokens at the secondaries. The attrition rate (based on how frequently locker keys are lost) might be a bit high, but it avoids the phone debacle.

Y7 logins are handed to the appropriate teacher the day before the students arrive (which is Wednesday for us). Some years there's a dedicated "fill the IT rooms with Y7 pupils and get them logged in" lesson, other times it's done in their first IT lesson. New Y12 students pick up their credentials from the admin office along with everything else (the admin office is in the sixth form common room).

We create them in advance via Salamander (other middleware options such as Ruler is available). Y7 accounts are created once the record is sufficiently complete in SIMS (though I do have to remind admin staff to set their status to "admitted") and incoming Y12 accounts get created a week before they're needed. Same for new staff - created a week before their official start date. -- Y7 students for September are typically in SIMS and correct before the end of the summer term (maybe a few missing UPNs from the more slack primary schools). This did take some nudging from IT, moving to electronic student record forms (for parents to complete) and initial bribery using chocolate and ice cream, but now it's just part of the procedure. -- You may get some pushback of "but what if the student doesn't attend?" variety. It's trivial to delete students who don't turn up and shouldn't be a blocker.

Nope. I checked everything was fine the previous afternoon and we're contactable in real emergencies so there's no need.

Currently the retention policy has: Internet Access Logs (from the filter) = 6 months. Logs related to an incident are (if exported) retained until the conclusion of said incident and a brief summary may be held in safeguarding platforms until the student reaches 25yrs. Network logs (anything not the filter) = Up to 2 years. (The policy doesn't differentiate between network/firewall/webserver/blah logs)