pete

We updated the base OS in MDT to 22H2 (from 21H2) recently purely for the longer support interval. 22H2 (Edu/Enterprise) EOL is 13th May 2025 21H2 (Edu/Enterprise) EOL is 11th June 2024 21H1 (Edu/Enterprise) EOL is 13th December 2022 (next week) We went 1909 > 20H2 > 21H2 > 22H2, updating the build environment once we were happy so we were always imaging with an OS with maximum supported time.

Nintendo Game & Watch? Not Zelda, probably Mario?

One of our schools uses ePraise, which appears to work well for the students and their parents. Another is a bit more ad-hoc (email from form tutor or subject teacher, postcards occasionally) depending on where the praise originates from. The others put "Bob in Class $whatever did something awesome (proceeds to describe the awesome thing)" in their weekly newsletter. Assumingly reasonably well behaved and diligent students this won't scale past ~200 or so kids.

Guest WiFi with transparent filtering and instructions on how to create a shortcut that calls Chrome or Edge with the --no-proxy-server switch. If they need applications other than a web browser to access the Internet, they should ask the LA IT support team to configure the issued equipment so proxy settings can be adjusted before their next visit.

Filtering the CSV by Win 11 and devices not owned by us (we have predictabled and reasonably unique name prefixes), about 4 of the latest 12 devices to register on one of our tenancies were affected. Whether some of the kids are paying attention when prompted but a small amount aren't I'm not sure.

@KK20 - we don't force encryption for registered devices. They're encrypted at install with a clear text key in Windows 11 (and later versions of Win 10) if there's a TPM chip present on the device. It's not clear what the behaviour is if someone upgrades from Win 10 > 11. Once Windows has a place to store a recovery key safely off-device (by someone using an account registered with Azure AD for an Office install and not clearing the right checkboxes) that clear-text key is replaced with a real encryption key. Now it's encrypted. Regardless of any policies set to "don't touch devices we don't own". There's an /r/sysadmin thread reporting similar problems: No. Affected devices don't appear in InTune, or admin.microsoft.com > Devices. They only appear in Azure AD > Devices. Look at the list of devices, pick something you don't recognise running Windows 11 (version higher than 10.0.19045) and look to see if there's a Bitlocker key.

If we still hold contact details for the student (left within the last 7 years/not yet 25) we'll verify the request with the student / their parents and provide the info. If it's longer than that, we likely don't hold the information (contact info or the information requested) so it's down to the person making the request to a) prove who they are and b) hope there's a teacher around who still remembers them.

We found the SNMP support to be at best rudimentary and it doesn't age out the data like you'd expect if you're used to RRD backends that store fewer data points per interval as you move into the past. Disclaimer: We already had access to better tools for SNMP monitoring, so we may be a bit more picky.

Doing it in Apple School Manager will give each staff member 200GB of iCloud storage for backup purposes (assuming they're logging in as [email protected]). Depends how many "the only SEN evidence photos/school play video were on the iPad that's now full of jam/tea/red wine" incidents you get. Can Mosyle sync accounts from/to ASM to avoid double-entry?

And it's typically the only place they're saved too. @KK20 Kid goes to stay at Gran's house for the weekend. Kid uses Gran's laptop to do homework. Kid installs Office365 using school account to complete homework. Kid says yes to "Allow My Organization To Manage My Device" Device Encryption key on Gran's laptop gets changed from the clear default to an actual value. Key gets uploaded to kid school's Azure AD. Gran's computer is now encrypted with a key only known to the school. Gran unaware.

Assuming an aggrieved ex-employee isn't threatening to drive a bulldozer through your server room and this isn't management hedging their bets until plod catches up with said ex-employee..... I'd ask what's driving them to half-arse it in 2022-2023. It could be a contractual clause from a new client that they didn't budget for in 2022-23 and the client's now asking for the evidence. Is management's plan: FY 2022-2023 - Build 2012R2 DR mirror at $remotesite at X/hrs + incidental costs FY 2023-2024 - Rebuild DR mirror at $remotesite at X/hrs + licensing cost on 2019 or better or FY 2022-2023 - Build 2012R2 DR mirror at $remotesite at X/hrs + incidental costs FY 2023-2024 - Lie to clients (and insurers) that they have a functional DR site after October.

A few easy methods: Drink coffee in the staffroom at breaktime. Make it clear it's your coffee break too, but if people want to chat about developing their dept it's fine. Get your techs to keep their ears open when working in departmental areas. Look around - are they Heath Robinson-ing things when there's a better way? Suggest it - "Have you tried X instead?" We've saved weeks of work for staff just by realising they're taking the long way around and suggesting a better way. IT talks to everyone and goes everywhere. We know who has the cool new toys and who's willing to share in exchange for biscuits. Attend their dept meetings. Ideally just the first 10 minutes of the schedule - (verbally) prod them for anything they want/concerns. Interrogate headteachers, deputy heads. "What're your needs Y1/2/3?, What's driving that? Explain how budget planning works. We need to know what you want so realistic figures get put into budgets in advance. Last minute whims without a plan/pricing get ignored by the accounts dept Feed them biscuits occasionally.

For our frequent fliers who really do have problems remembering passwords, we check that their phone has a PIN / fingerprint lock set and a notes application (or similar). If so, we suggest they put their new password into the notes app until they remember it, protected by the phone PIN/biometric lock. Then we send a: Bob in 7B has problems remembering their password. To make their, our and your lives easier, Bob has been encouraged to save their password as a note on their phone (protected by a PIN) until they remember it. They may briefly get their phone out when logging in during lessons. Please let them do so, unless they're clearly taking the mickey. IT email to the "Teachers of Bob 7B" distribution list.

and your second biggest is resource constraints (staffing, funding, time). My query would be "knowing the RDS box is compromised and would have been used as a beachhead to compromise the rest of the network, why did you leave a potentially compromised network connected to the Internet?" Plug the router into a spare isolated PoE switch, offer basic WiFi for priority people and get SLT to deal with any whining. (I mean I know the answer is likely 'due to whining by staff/SLT when that was proposed', but FFS)

Leeds-60. Removing the YouTube advert content mod (with a caveat email that staff pay attention to what they're viewing on screens/projectors) has mitigated the issue. But yeah, we block the adverts for a reason.

Functionality similar to a PAC file (qustodio getting out of the way if the device can reliably detect it's at school, otherwise on) would be where I would look. If the school has a webserver with a publicly valid cert (https://qustodio.int.school.org, not https://qustodio.school.internal) that's only reachable on the school network you could use that as the check. Participating (verified) schools publish the record in DNS for integration into Qustodio.

We use MyConcern for investigating behaviour incidents (and safeguarding incidents). Cut-and-dried things (student caught using phone in class, phone confiscated, handed back at end of day (provided strike count not exceeded and parent needs to collect it)) are entered into SIMS.

The certificate chain on the website is incomplete*. It probably wouldn't prevent a web browser accessing it, but Smoothwall (in HTTPS intercept/validate cert mode) is a lot more nitpicky about the server config being correct. Adding the intermediate cert to SW *may* resolve the issue if it's missing. * https://www.ssllabs.com/ssltest/analyze.html?d=www.thinkuknow.co.uk (and it was renewed 10 days ago, which may have introduced the behaviour)

We're in the market for some sliding doors (2-3 to begin with, equivalent to a double-entry once fully retracted) at one of our sites to make it more accessible. Standard door with sensor/button/reader options, out-of-hours lock, fire alarm integration in an appropriate colour, nothing too fancy. Finding a provider (we're based in Lincolnshire) who can survey, provide a quote and organise installation in a timely manner is proving a little frustrating. Who have your schools used that were good (hardware, installation, product knowledge, responsiveness)? Could you quiz your estates/site manager please. cheers Pete

https://www.gov.uk/guidance/meeting-digital-and-technology-standards-in-schools-and-colleges/cyber-security-standards-for-schools-and-colleges.

The (Nasstar-authored) emPSN incident report is now available, so nudge emPSN if you haven't received a copy.

Document the network at a level such that a suitably technical person could (should you win the lottery) step into your shoes with minimal faff. Then add the bits that @carlin_w from the future will appreciate that you've written down as it's 6 months since they last touched it. Lots of people like OneNote for personal notes, I prefer a wiki (dokuwiki is what we use, there are others). The important thing is that the documentation exists in N+1 places and (should you win the lottery) someone else knows it exists. I tend to have a page per device / application / service. Include what it does, dependencies (things that depend on it working, things that it depends on), serials, support contacts, configuration and datestamped changes (not so much "installed October patches", more "changed configuration from X to Y as per ticket #1234") We follow the retention policy (disable account, add alias to appropriate mailbox (depending on role), retain for 180 days for staff). Your school should have a retention and destruction policy that details how long you keep certain data and why (often linked to specific legislation, DfE best practices or school policies). Bear in mind your retention limits should be reasonable (short version, a judge can say "nope, you can't delete emails after 2 weeks even if your policy says you can"). There are templates out there - the IRMS Records Management Toolkit for Schools is a good starting point: https://irms.org.uk/page/SchoolsToolkit.

I'm in the market for headsets for our reception staff and wondered what you were all buying? Looking for: Bluetooth Noise cancelling Mix of single and double-ear (for "my colleagues are noisy and I need to get this done" purposes) Easy to use (base unit = charge cradle) Not ridiculously priced

As others have said, provided: the information exists elsewhere (say in MyConcern so the deputy DSL and the rest of the safeguarding team can access if necessary) the mailbox is protected with MFA you've turned on alerting for odd logins and you review those logs staff have undergone cybersecurity training recently (RPA customers, this should be ticked) I wouldn't be too concerned. Police, local government child protection teams and others will continue to send confidential data to DSLs via email. The important part is the rest of the safeguarding team are in the loop. With regard to very short retention periods, especially for someone wearing a DSL hat, that's a great way to cause a data breach by deleting information you're supposed to retain. It is non-trivial to present (usually several months long) email threads about a particular child in a coherent way uploaded to MyConcern that isn't a) painful for others to review b) likely to be useful in court.

We currently have it, I'm not impressed (backend reasons) but we need something similar. What other similar services are you using in your schools?