pete

I'd sling it in Azure if I was particularly worried, but I can stand it up in ~5 minutes at any of our sites in a DR event or on a laptop via offsite synced backups.

We're also using Dokuwiki with the following plugins: Bookcreator Dw2PDF (dump wiki page to PDF) Move plugin (reorganise wiki while maintaining links) Orphanswanted (flags up orphaned pages and links to pages that don't yet exist) with Azure Application Proxy thrown into the mix for MFA and easy access across schools. I have been eyeing up WikiJS (mostly because it's prettier), but I do prefer DR situations where I don't have to first spin up and populate a database (Dokuwiki is flat files accessible in a text editor).

Short version: Buchanan says the issue also affects the "Snip and Sketch" tool in Windows 10, the app that became the basis of the new Windows 11 Snipping Tool. The old Windows Vista-era Snipping Tool, still included as a separate app in Windows 10, isn't affected by the bug. Images cropped using Snip and Sketch in Windows 10 or 11 or the new Snipping Tool in Windows 11 leave at least some of the cropped data within the file. Exploits exist for .PNG, not yet for .JPG More info: https://arstechnica.com/information-technology/2023/03/windows-10-and-11-get-their-own-version-of-the-acropalypse-screenshot-bug Twitter thread as to why here: Side thread which implies similar issues have been about for a while on Windows, depending on the method used to save a file: Mods: I debated between the Security forum and this one, both apply.

Each cover teacher gets a unique login. We have a list of regulars and if their accounts aren't used for an interval we check if they're still valid with the cover organiser. Ad-hoc cover on the day still has a 50-minute window to spin up an account which, provided no-one else has done anything exceptionally daft that morning, is more than sufficient.

When did you last successfully run the "delete unlinked persons" routine? Have you run the "delete unlinked contacts" routine first? If you select one person and try to delete them, do you get a message in the bottom left of the SIMS window? My suggestions would be: Run database diagnostics (Tools > System Diagnostics > Database Diagnostics) and check the results - see if anything got applied / fixed. Open a ticket with ESS and describe what's happening. There are generic SQL patches available for "can't deleted unlinked persons" and "can't delete unlinked contacts" that can check for and fix common problems.

Remember that an email retention isn't terribly effective for SAR purposes if someone's using Power Automate to save attachments to OneDrive. *grumbles about a finance system that doesn't allow budget holders to search earlier than current financial year*

Group Xporter on Demand (XoD) has a web dashboard (https://manage.groupcall.com/SchoolPortal) that'll tell you exactly what information is shared and with whom. Your username is "ESTAB-DFENumber (So ESTAB-7891234). Either nudge your SLT for credentials or trigger a password reset and look for an email mentioning "groupcall" in the inbound mail log to see who has the passwords. Wonde has a similar dashboard (https://edu.wonde.com/login) with a list of applications/organisations and the permissions involved. All you need to get in is add an email alias for anyone who historically had admin access.

We have a couple of Remarkable users (they bought them) who appear to like them instead of paper notes. It's still early (few months) days yet, so unclear how much of that is "I spent X hundred on this, I'd better use it". One of them did go from carrying 6 inch-thick A5 notebooks in their bag to just the Remarkable, so I suspect that one will be more likely to succeed.

Konica: Currently with Konica at 4 schools. Onsite technical support and general reliability is excellent. Backend services (parts delivery, accounting, account manager being empowered to improve things for the clients) are awful. Recently had a lot of "are you sure you need a new drum / fuser?" pushback on parts which makes me think they've got shortages as well. Wouldn't recommend. Kyocera: One school (just joined the trust) has Kyocera through a reseller and it's a little too early to tell if they're decent. I haven't had any complaints from the school or our finance team, but I haven't really had to do much with them. Ricoh: About to trial a copier at one of ours schools to see how they perform.

An apprentice / relative newbie to IT is an excellent test of your documentation. Get them reading it, checking it's still valid and highlighting missing steps or context that the rest of your team assume "we all know that". I'd carry out more frequent reviews with them. Nothing formal, just more of a regular how's it going, what went well / not so well so you can adjust early on. If you're the IT manager/lead, don't be the apprentice's mentor - by all means contribute on topics / shadowing, but their main mentor shouldn't be you - it'll consume too much time early on.

My general rule is: "Enough to do the tasks you're asking them to complete, not so much that they can cause unexpected overtime for their colleagues." ...then increase access as they develop / demonstrate they're not going to cowboy it. -- A lot of it depends on the aptitude and attitude of the apprentice. There'll be a lot of shadowing initially and explaining why things are done a certain way.

(Using Jamf School as the example). Automated Device Enrollment Token - Obtain from Apple School and insert into your MDM of choice Volume Purchasing Token - Obtain from Apple School and insert into your MDM of choice Apple Push Certificate - Create CSR from your MDM, login to https://identity.apple.com/pushcert (using a [email protected] account**) and request the cert. Insert generated push cert into MDM. (Optional*) SCIM Token for Azure AD - Obtain from Apple School, insert into Azure AD. The first three must be renewed every 12 months. The SCIM token is good for 24 months. *wherever possible (assuming 1-2-1 iDevices) we tie authentication into the Office 365 identity. **don't use a person@school or it@school email

^ Definitely email. The DfE tend to email catchall mailboxes that may no longer exist (or are predominantly spam), so it's easy for the missive to be missed. Turnaround / confirmation time is pretty quick. We had Confirmation of Acceptance within a week. The network asset form will ask about the make/model/age/warranty remaining of existing kit, so I'd gather that info while you wait for the initial response.

Can the forced join 75k actually be spent on hardware though? The lower amount for taking on a RI school (~£50K for a non-forced join) can't be spent on hardware. Or couldn't in 2021-22 at least - software, services and labour was fine, hardware wasn't.

It's worth pointing the SSL Labs checker at your domains: https://www.ssllabs.com/ssltest/index.html Proxies that perform HTTPS interception, even if they're just checking for a valid cert, will apply a stricter standard than a web browser. Make sure you don't have any chain issues.

On a computer (in this example a 2019 VM used for remote desktops) with Onedrive installed on a per-machine* (vs per-user) basis, you should see something similar to this: *https://learn.microsoft.com/en-us/sharepoint/per-machine-installation

Get the .admx from a computer with OneDrive installed. https://learn.microsoft.com/en-us/sharepoint/use-group-policy

Microsoft recommends that enterprises that have break-and-inspect proxies or other scenarios involving TLS server certificates issued by roots not in the Microsoft CTL to proactively test with the policy enabled in Microsoft Edge 109 and report any compatibility issues to Microsoft. In Microsoft Edge 111, we plan to remove support for the MicrosoftRootStoreEnabled policy. So anything that's performing HTTPS interception (transparently or otherwise) will be affected unless Microsoft realises / supplies a workaround. Looks to be linked to an earlier announced change in Chromium: https://blog.chromium.org/2022/09/announcing-launch-of-chrome-root-program.html Potentially more info here: Ctrl+F to "Enterprise CA Owners" https://chromium.googlesource.com/chromium/src/+/main/net/data/ssl/chrome_root_store/faq.md

Yup, we redirect desktops to a subfolder of their homedirs and forcibly make it available offline via GPO. Does that mean they store endless rubbish on their desktops? Yes. Is that their problem to deal with, provided I know it's safely backed up? Also yes.

I've found resellers usually offer better pricing and more flexibility on that pricing than the manufacturer's reps. At least in volumes up to ~200 or so desktops. They're usually more responsive too. If I were regularly buying thousands of units, I might get a better class of account manager from the manufacturer who has access to better discounts, but that's not likely in my current role.

Lockbit ransomware and backups deleted: https://www.ft.com/content/2ab26050-6b17-4b10-96d1-faeb664f4501 https://cyberplace.social/@GossiTheDog/109677167129278376

Salamander here too. It does require the MIS data to be correct and entered in a timely manner. You'll also need to define a "staff & student accounts should be created X days before they turn up", as the default is the morning of the start date in SIMS. But other than that, it's more than paid for itself.

Depending on how good those schools are at keeping documentation / handling things not directly related to teaching and safeguarding, MAT guy may not even know you exist. Getting hold of an accurate supplier list from new schools is more painful than it should be. As @Ditto mentions - introduce yourself and mention the work you've done and where your strengths lie. Assuming MAT guy is the IT lead, making his life easier by proactively sharing technical documentation on said schools rather than him having to start from scratch for every new school that joins, will earn you significant brownie points.

As a guy from a MAT.... They likely have a preferred supplier with a track record (with the MAT) of consistently doing work to a good standard and they will get economies of scale if they're scheduling work across multiple schools. That's not to say you don't do good work, but that's the reason we have preferred* suppliers that we require to be used across the trust unless there's a good reason** not to. Plus the prospect of losing regular work at multiple schools does generally promote more attention to detail. *We look at who all our schools are using and pick the best (quality of work, responsiveness, ease of working with, knowledge, capacity and price) one. **Specialism the preferred supplier doesn't have. Noticably better pricing without drop in quality. etc

We updated the base OS in MDT to 22H2 (from 21H2) recently purely for the longer support interval. 22H2 (Edu/Enterprise) EOL is 13th May 2025 21H2 (Edu/Enterprise) EOL is 11th June 2024 21H1 (Edu/Enterprise) EOL is 13th December 2022 (next week) We went 1909 > 20H2 > 21H2 > 22H2, updating the build environment once we were happy so we were always imaging with an OS with maximum supported time.