pete

@Koldov My guess is they've brought your site up on a server presenting a cert that's missing your domain as a SAN. Or they haven't got round to renewing the certs with Let's Encrypt (possibly because LE rate-limited them, depending on site density on the server) and because they're using HSTS (your browser knows there should be a cert because the server told it so previously) the browser's aborting the connection. If I recall correctly they mash a lot of sites into each cert. -- As a Greenhouse customer (who's not affected) these do seem like avoidable schoolboy errors. Loading site data from backup/shared storage onto another server with spare capacity should have resolved this within a couple of hours.

You can also use Let's Encrypt for internal sites provided you're not using a .local or a .internal. We do if we know awkward devices may need to access them.

That's good to know. 15 hours of CPE/year on cybersecurity is useful to the trust - they can do it during work hours and it lets me protectively pad the training days calendar. We'll reimburse the $50/yr renewal as we benefit from them having the knowledge.

Looking around for training options for my team, I came across this (and the post on here by @Kitkatninja). Is it decent? Running through the sample test questions, I'm getting a CompTIA vibe of having to give the "wrong*" answer in order to pass. *especially around risk mitigation while still being able to do business.

If you're using Azure AD as your authentication source for Google Workspace, whoever gets the "that broke" emails from Azure re GCP provisioning will see something like this (message cleaned up) about getting 400 errors. Message: The remote server returned an error: (400) Bad Request. Web Response: "access_not_configured";error_description: "You can't access this app until an admin at your institution reviews and configures access for it. If you need access to this app" https://admin.google.com/ac/owl/requestapp . Login and allow the App (search for "Azure") to restore sync.

"Employ" is me paraphrasing. I'm reading it as gig economy role with the organisation acting (in all other aspects) as an employer pulling an Uber to reduce costs and liability.

Reviewing terms and conditions for a service we may now be sourcing elsewhere I spotted the following. Online tutoring platform that employs uni students with decent grades to tutor primary and secondary students. Requires: Said uni students to act an independent data controller Register with ICO as a data controller Comply with SARs Have in place security measures to ensure the security of personal data I'm not the only one thinking there's no way uni students will register with ICO and this is just the platform abdicating responsibility, right?

InTune or similar would create the least friction. We're assuming you don't own the building and whoever does just provides DHCP, DNS and an Internet feed, is that right? What filtering is in place at the building? Can you point the laptops to your usual filtering? OneDrive - just make sure files-on-demand is configured. Depending on how secure the building/laptop storage is and if staff will also be using then - Bitlocker the laptops.

In addition to Techsoft, Epilog are decent too: https://www.epiloglaser.com/en-uk/laser-machines/fusion-maker-laser-cutter-engraver/

How much of an issue is that where you are though? Our kids see staff first names, but they don't use them until they've left school and are old enough to buy said staff member a pint. The only (incredibly daft, or trying to win a bet) child I can remember attempting it picked our loudest and most performatively angry PE teacher ("alright Gary, keep your hair on") and I heard the results from the other end of the school field.

'Whatever you want, but if it's inappropriate you're getting a detention. The IT dept aren't on the detention rota so we have no incentive not to be trigger-happy". Seems to work for the most part.

Readily available accurate and properly maintained documentation organised coherently in one place. Change modelling/reporting before making the change. If I change X, what's the impact on Y and Z? Does anything change that I wouldn't expect to? Current config vs baseline config comparison. How much drift? Of that drift, how much is against best practices/deprecated/problematic? Is there a better way of achieving something now the product/feature has matured a bit?

Definitely agree with the "assumes all people are adults" defaults, including the "why haven't you turned on MFA for ~1800 children" nag screens. However, the "these are children" options (Teams, for example) are too restrictive for older students doing video interviews with prospective Uni/apprenticeship/employers. It seems like a token effort at best. Other issues include: 365 - Inconsistent labelling of what security options / remediation options cost extra on top of current licensing. Sometimes it's up-front (can turn on a "already have license?" filter), sometimes it's four clicks deep before you hit "you need X license". Configuration drift due to the rate of change for 365 and Azure. Secure settings can become insecure because "we migrated your settings to the new portal and settings X,Y & Z are no longer available / cost money now". Compliance search tools (the ability to search Teams, for example) becoming "paid-for" options with associated impact on safeguarding and budget. Third party suppliers of licensing request excessive permissions (ability to create accounts and reset passwords, for example) within 365 because MS documentation** on the access required to add / sell licenses is awful. Risk of supply chain attack increases. *not that I'm expecting you to solve that - Microsoft have had decades and still can't.

We are looking for a full-time IT Technician to join our support team. Responsibilities will include onsite, remote and telephone support for the IT systems and related equipment within our schools, supporting both students and staff. Based in Horncastle, you will need to have a full, clean driving licence and your own transport to undertake visits to schools within our Trust, for which mileage will be paid. Your range of experience will include network troubleshooting and server administration. Experience of providing technical support to MIS users and maintaining websites would be useful to us. If you are well organised and confident with an eye for detail, take pride in customer service and have a passion for supporting the delivery of education we hope you will apply. This is a permanent 52 week fulltime post, working 37 hours per week. More info Advert (PDF) Job Description (PDF) Application Form (DOCX) Closes Sunday 4th June, with interviews week commencing 12th June.

*waves the Wazuh flag again* https://wazuh.com ELK stack (using Amazon's Elastic stack, which suffers less from dependency hell). A ~1000 user secondary (with GPOs configuring event logs to log odd stuff) should probably assign 200GB of space for six months retention (all servers logging to Wazuh).

^ For the tapes 1) Use a hacksaw and cut through to the spindle on one side. Giving you tidily contained ~10cm strips of tape. 2) Label the tape as "DESTROYED" (so no-one feeds it into an auto-loader/tape drive by mistake) and recycle.

What foldable (laptop converts to tablet) Windows* devices are you using for teaching staff to use in the classroom (wander around class in tablet mode with a wireless connection to the board) and do they work well? *needs to be Windows at least for this refresh interval due to legacy software requirements that just don't play nicely enough via RDS. Removing that requirement would make this much easier to do, but that's not an option at present.

Wally reflector? You don't really need many questions. Perfectly reasonable ones (let me know a time when X is available for Y) can result in tumbleweeds. Hey, can you do X to my laptop? Sure, pick a couple of times when you don't need it for 30 mins so we can make sure someone's available to work on it. *tumbleweeds* *pokes requestor* *pokes their line manager* *Closes ticket* Hey, can you do X to my laptop? *refers them to the initial response*

One person per account and MFA enabled for all adults - no exceptions.

It's been a while since I've had to use KM native device functions (we put PaperCut MF on copiers), but I seem to recall that Scan-to-Email and email notifications were two separate functions and transport mechanisms. Scan to email was annoying but generally worked. For copier status we used SNMP from our network monitoring and alerted through that.

Does wireshark show anything different between a scan-to-email and a notification email (cause a paper jam)? Have you asked one of their copier techs to review the config when they're onsite?

Consistent stable of supply teachers and named accounts. Absences are reported at 8am, first lesson is at 9:15. That's more than enough time to create an ad-hoc account if there's a new supply teacher. We don't provide generic accounts that can access data about people.

Off for shared mailboxes or changes don't propogate fast enough with N+1 users moving things around.

It's a Dorries' bill so it's going to be awful, but your link suggests it's not going through parliament in the current state?

I mean: Only one parent can use a given email address to sign up for a service. Mr Bloggs and Mrs Bloggs usually need to use unique accounts (no shared logins used to access pupil data, regardless of who's doing it), so even if email isn't used for signup it becomes a problem for password resets. Divorce / separation / restraining order. We don't know who has access to [email protected]