pete

Could you begin by telling us what's taking up the space? (using Treesize, WinDirStat, or Wiztee if you're not sure). Is it SQL backups not being cleaned up? SQL temp database gone daft? Developers working in production creating copies of databases?

I assume if the visitor isn't allowed to authorise third parties to install interception certs on their company-issued device, you've got a stack of laptops for them to borrow? I (for example) would be breaching our AUP and data protection policy if I allowed another organisation to intercept secured traffic from my school devices.

We download the firmware and put it on an internal webserver, then point the APs to that (needs to be http link, https doesn't work) via the custom upgrade URL option. It's a bit less of a faff than SSH-ing into each one, but you need to do it for each AP.

Assuming you've verified that they're not rubbish at searching..... Is there a difference between Outlook (desktop client) and Outlook Web Access? A corrupt local cache can cause similar issues. Have you got any form of email archiving setup? Have they themselves been archiving to PSTs on network shares? Things don't usually disappear - someone or something's deleted them.

You also need to ensure policy changes are communicated effectively - i.e posting on noticeboards, emailing to staff the new policy with relevant changed sections highlighted, dicussing in staff meetings etc. If Bob in HR is quietly updating policies in a folder somewhere but never announces the changes, it won't work. Especially if someone's being held to account based on a new policy that was never communicated to staff.

We have 40 users currently (35 accounts actively in use) on the "Business" version (no new sign-ups) which is a bit cheaper than the current offerings. Our renewal (just paid it) was $480. Setup is pretty straightforward if you're comfortable setting up rdp hosts and certs. Most common use cases are well-documented. The main time sink was creating documentation (overview of how it works, how to request access, how to setup and configure it on Android,iOS, OS X, Windows, presentation at staff meeting) for users. The free version supports up to 5 users IIRC, so sling it on a desktop / server as a second factor and test it.

"It depends on the MDM". A whole-device MDM wouldn't stop (for example), you downloading it and then syncing it to Dropbox / personal Google Drive / docs. It could be set to completely wipe the device, (however that's a question to get legal advice/explicit informed consent on before proceeding) but if the device is backed up to iCloud/Google, the person can restore the data. An MDM that used a separate (sandboxed) email program that only allowed accessing downloaded files using another app inside the sandbox and disabled screenshots of apps running in the sandbox, yes-ish. It's more of a faff to read email, but wiping it would only affect school data, not personal files. You'd also need to disable downloading/opening attachments via web browsers on personal devices. --- A sufficiently-motivated individual with access to the files can always bypass this though. At best you're making it tricky (separate phone to take pictures of "work" phone + Google Translate for OCR) to do.

We've been using Duo for a couple of years now to secure a RemoteApp deployment and have had no problems with it. Is there anything specific you want to know?

I concede defeat, but maintain my thread title was better.

TLDR: Czech IT guy breaks down door to a server room after aircon fails and previous incumbent didn't leave keys. Finds man-portable live missile. Whole building evacuated. Hilarity ensues.

I forsee the responsible dept having a 96K budget shortfall.

We shifted to Krystal Hosting, mainly because the previous registrar (LA-affiliated) took 3 days to process changes and frequently typoed the records, even after being sent screenshots of what the record should look like. The caveat is to ensure your provider understands that .sch.uk domains are free for schools and doesn't enabled auto-renewal notices or (if that's not possible), set the auto-renewal date 99 years in the future.

Deploying the Gimp works without issue, but on the first-run after installation it spends ~2 minutes setting up fonts, plugins and what-not. Has anyone got a script or handy method to trigger this as part of the deployment? I can think of a few kludges (calling it post-install, waiting ~4 minutes, then killing it), but has anyone got a cleaner method?

If no-one knows why he's there, why hasn't he been marched off the premises? No-one's paid for a penetration test / audit to see if staff will blindly hand over credentials have they?

What happens at said primary if (for example) there's a safeguarding incident during the holidays and the DSL (or their deputy) needs to be available? Or the school catches fire? What does the critical incident plan say?

We do a rolling ~50 days on the basis that stuff that happens/is noticed in term time (~1100 people on site) gets reported promptly, but stuff that happens over the Xmas (complete shutdown) or summer holidays (~5-10 people) may not get noticed for a while unless it sets off an alarm. Not to mention the lag between "we should check the CCTV footage" and "let's ask someone who can check the CCTV footage to do that".

I mean, unless you're peforming a MITM attack......which nearly every school and large business is doing. Yes, most schools and business whitelist financial transactions as "don't intercept", but what the card providers care about is: Is there any evidence that someone's faffing with the transaction data? Have you taken steps to prevent that? What were those steps and where's the evidence? Until very recently (Nov 2017) Squareup were vulnerable to HTTPS interception on a business / school network: https://www.cvedetails.com/cve/CVE-2016-2402

I'd say more discerning, since it'd be trivial to set a proxy to listen on 5223. Allow 5223 to Apple domains / IPs if you care about push notifications (phone-based 2FA uses them, for example). Then see who yells regarding the rest or break out Wireshark to determine if they're legit.

"We asked a junior associate at $random_law_firm". Typically, junior associates are just about trusted to get coffee orders correct. I think I'd want a little more consensus than "we asked one solicitor and they said no".

Last time round we trialed Canon, Ricoh and Konica. Ricoh had best image quality of the test prints (mix of docs and high-res photos to be printed at A4 and A3 sizes on a range of papers/card) we requested they send. Konica was best overall (quality/price/features). Ricoh wanted the moon on a stick price-wise, so we dropped them. Service calls usually result in an KM tech arriving within 4 working hours and the ones around here are good. Hardware-wise, KM are fine. KM the company does seem to have a problem with internal squabbles/fiefdoms and finger-pointing between depts that occasionally get exposed to customers.

Has anyone else had OCR denying they've received exam entries recently? Or doing anything daft? Our exams officer discovered OCR hadn't received entries despite the receipt within A2C from OCR servers. When she queried this on the phone, the OCR helpdesk person blamed it on SIMS / not their problem, though when pushed stated that another school had the same problem recently. We're going to chase them again, but I'm wondering if there's a wider issue. Other boards are fine and A2C is working correctly.

PCI compliance requires you to ensure the path the data takes (from card reader > bank/payment handler) is secure. A reader on a phone line is considered secure. A reader that uses a 3G/4G connection is secure. A reader that connects via ethernet / wifi to the local LAN (shared with other devices) is not considered secure without extra work/expense (as @m25man mentions). TLDR: The 3G/4G card reader is probably the most compliant and least expensive option.

There's a big permissions spreadsheet from Capita linked within the SIMS client (Documentation button in top right, then scroll down to the link near the bottom). The first page is the "stuff we changed"

I have a StarTech USB31000S USB 3.0 <> Gigabit adaptor that PXE boots HP elitebooks.

I bet you a hobnob that quote comes from someone who also happens to sell such a system. Check out this thread: http://www.edugeek.net/forums/data-protection-information-handling/187764-gdpr-primary-schools.html