pete

We're using Avast, mainly to avoid Typhoid Mary* problems. *https://en.wikipedia.org/wiki/Mary_Mallon

After playing with this briefly yesterday (before I suspect the service died under a post-BETT load spike), it looks interesting. One thing that's not as granular as it could be is the "Contact Can See Only Self" options under SIMS Parent > Settings. @PhilNeal - does the SIMS Parent Lite respect the court order flag in SIMS? When I quizzed the helldesk about this for Options Online, they dodged the question on the basis that "Parents don't have access yet".

^ It's not just viewing in SIMS though. You need to check Groupcall Exporter report definitions in SIMS to see what data is being pulled from SIMS into other applications / services and whether the fields are appropriate and necessary. (Reports > Design Report > Existing Report > Categories > Groupcall Xporter) I've spoken to a couple of suppliers who've attempted to blame unnecessary (ethnicity, for example) extra fields on Groupcall. Checking with Groupcall (because the supplier excuse seemed unlikely), any reports they build are to the customer's spec and they've had quite a few customers amend their report definitions for GDPR compliance.

I'm still using Intel NUCs. The newest is restricted to 32GB RAM, (older is 16GB) but with a couple of SSDs they do everything I care about and don't clutter up the office. Base hypervisor is VMWare on one and Ubuntu on the other. Currently playing around with Docker swarm when the mood takes me.

As described? Boy cow waste. As @Katy mentions, a SAR could encompass staff personal email accounts if there's evidence they're dumb enough to use personal email for school business (not to mention safeguarding / accountability issues). But there's no reason kids shouldn't know and email work-provided staff email accounts.

Aren't you in danger of breaching ADA? Unless you've got "if Bob logs in, put the theme back because he needs it" logic built in. Wouldn't it be better to reset the theme to a sensible default on user logout / login?

Hawaii Emergency Management shows news crew around office in PR attempt to make amends for missile blunder, makes things far worse by confirming they store passwords on monitors. Hawaiian Emergency Management Officials Hold Interview - Have Post-It Notes of Legible Passwords on Their Computer Screens Wonder if password also lets you make spurious missile alerts?

It's a risk assessment. If you (school) know your staff do daft things and education (or lack of enforcement) doesn't fix the problem, then yeah...you need to do something. I'd say you at least need to make it harder for people to do daft things. Set staff default printers to those in staff-only areas, for example. Providing you're keeping event logs for long enough, you should be able to work out who printed something (assumes everyone prints to a shared printer hanging off a printserver), but something like PaperCut does make that much easier. You should be able to set user box codes on each copier and your copier vendor should have tools to replicate those settings across all your copiers.

Try Bitlocker Network Unlock? Provided you've got a TPM chip, it provides an "if I'm connected/can talk to the domain network, boot normally, otherwise prompt for credentials" option. I came across it when moving our laptops to Bitlocker but haven't had time to play with it: https://docs.microsoft.com/en-us/windows/device-security/bitlocker/bitlocker-how-to-enable-network-unlock and I'm not sure if "VM on server with TPM chip" counts as meeting the requirements.

Last written: Roof repairs 5-6 years ago. Last received: Interest from solicitors when they held my house deposit, ~9 years ago.

Can anyone replicate this? RSAT running Active Directory Users & Computers. Changing a user homedir path from netbios (\\server\share\username) to fully-qualified* (\\server.domain.whatever\share\username) causes the MMC to lock up and not respond for a minute or so. If I make the same change with RSAT on W10 1607 or Win7, the change is instant and shows no CPU spiking. Changing display name (for example) doesn't provide the same performance hit on W10 1709, which makes me wonder if it's something odd in DNS for W10 1709, but not earlier versions. *troubleshooting stupid software.

Students can email staff. They can't email distribution lists (unless they're a member of the list - say peer mentoring group) and there is a recipient limit set for daftness reduction.

So, we're discussing changing how student sick notes are handled here and it'd be interesting to see what other schools are doing. If you wouldn't mind letting me know... How do sick notes come in at your school? (Phone/Paper/Email/TXT) Does phone/email/TXT require a physical follow-up letter? (If policy says "yes", but reality is "no", I'm interested in that). Who is the parent / student supposed to send/hand them to? Where are they stored? And for how long after the event? Are paper notes scanned / transcribed into SIMS as linked documents? What's the thinking behind your school's method (beyond interia/tradition)

We use Icinga for up/down/service outages/weird notifications, Observium for trend graphing mostly, though it also does up/down/outages and automapping using CDP/LLDP) and Wazuh for log aggregation and host-based IDS. Observium's nicer and easier to configure, but not as flexible as Icinga - there's few things you can't monitor in Icinga if you're prepared to faff for long enough. On the other hand, the Observium fork called LibreNMS is more receptive to user feedback. Wazuh's lovely, but they lag a bit behind ELK versions so you need to be cautious when updating.

Bright - I liked it, though I thought they could have gone a bit more Shadowrun.

We have HSM Securio B22 models. They're not bad for paper. The manual says they can shred CDs. It fails to mention that the shredded CD will have a 40% chance of exploding inside the mechanism, requiring dismantling before being able to shred anything else.

We thought that initially too. You already have an idea of teachers are likely to hold (markbooks, school trip info, absence notes (medical data), SEN assessments/cheatsheets etc). The question is whether they'll realise those count as personal data.

How will staff be able to assess the data they're responsible for if they're supposed to audit / clear out before they've had basic training? Have they already had a cheatsheet to work from? (I'm assuming someone's not been crazy enough to volunteer to go through every department's stuff and do it for them). We've done basic (Data Protection Courses and GDPR course via Educare) training for staff and we've also had in-person meetings by department where we give them actionable things to do and how to apply the training (with prompts and examples of data they are likely to hold/need to assess).

Ars did a board game guide the other day: https://arstechnica.com/gaming/2017/12/ars-technicas-ultimate-board-game-buyers-guide/

*cough* - Internet access is a yes/no option on the parental consent form here, mirrored in SIMS. The HOY will contact the parents to explain the heavily-filtered nature of school Internet provision and how a lack of Internet access will affect their child's education and participation in class activities, but if the parent refuses consent we abide by it. Admittedly, we've had a few interesting parents with odd ideas about the Internet in the past.

Maybe look at the slimline Pelican laptop cases?

How should this be assessed though? I mean, I keep my hand in with DP law (and now the implications of the GDPR) because I need to for the job (IT, CCTV, SIMS herding), but there's nothing on paper beyond maybe some appraisal documentation and a few completed online courses. When we and other local schools have had people do/go to GDPR / Data Protection courses the feedback has always been "I already knew that" or "it's too simple" or (looking at you Capita) "terribly misleading".

BGInfo with the /taskbar switch? The user has to click it for it to display the info, so assuming your use case is a teacher prowling around checking Fred isn't logged in as Eric, it doesn't really meet the need. Build an .exe that runs on launch, pulling the value from AD and runs minimised in the taskbar, with the window title set to the value you pull?

We've been using it on W10 for a couple of years now and I don't recall doing anything in particular to make it work. Assuming you've gone from Windows 7 32bit to Windows 10 64bit, did you make the ODBC connections using C:\Windows\Syswow64\odbcad32.exe?

Dymo labels for things like "R73-X01" (first (going clockwise) Windows 10 machine in Rm 73) on the front and back. However, actual asset recording is the model and serial into AD via a script that runs post-domain join.