pete

You can get USB-over-IP boxes (Digi make them) for dongles. They come up on eBay occasionally, but are otherwise rather expensive. There is, but you have to enable it (it's off by default). You can push it out via a GPP reg entry or scripting wevtutil. Application & Services Logs > Microsoft > Windows > DriverFrameworks-UserMode > Operational log

They've got three alternatives already (remote access, school-issued encrypted laptop with offline files, OneDrive), so I'm not spending school money. This is a "if you insist on using a stick on a Mac, here's a workaround that you can use/pay for yourselves". - - - Updated - - - It'd be write access, just because I know I'd get the "but I couldn't save X hours of work" problem otherwise.

This is very much a "would be nice" on hardware not owned by the school, since OneDrive pretty much replaces USB sticks for all but those staff members living out in the middle of rural heck on a chicken farm*, but.... I know, I can install dislocker and mount Bitlocker volumes via FUSE. That's fine for me....less so for people who aren't even aware Terminal exists. The other option I've found is M3 Bitlocker Loader for Mac at $59. The trial version appears to work OK. Is there anything else you've found?

If you don't want to faff with Let's Encrypt on Windows (we use it on Linux, but we'd don't use it for Java or IIS), go to Namecheap and spend £7 on a cert. We use these for single-domain things: https://www.namecheap.com/security/ssl-certificates/comodo/positivessl.aspx Or these if we want to use alternate names: https://www.namecheap.com/security/ssl-certificates/comodo/positivessl-multi-domain.aspx

But obscurity (having to kick in 5-6 identical doors before finding the right one) may help plod arrive and scare them off before they've nicked the servers. We're not relying on it to keep them secure, but we also don't leave clearly-labelled high-value targets lying around.

Download the application compatibility toolkit from Microsoft and run it against the .exe to see what it suggests.

What happens if you modify the .exe to run as an administrator? Does it then work?

What're you using for the fingerprint registration? Straight into MLS or some form of middleware (Biostore, for example)? I'd test it using ProcMon and the Windows Application Compatibility Toolkit. The latter can create a deployable "shim" so it works as a regular user.

^ While that usually works, it doesn't always. There's a DBDiagnose script called "Contacts_but_not_of_students_v2.sql" that you can request from Capita that'll produce output that shows why an apparently unlinked contact hasn't turned up in "Unlinked Contacts". The version will probably have incremented since I last requested it.

Poking around, the BBC article here: Lincolnshire Police clear 150 canisters in mustard gas search - BBC News thinks the local RAF did a less-than-stellar job at site cleanup. Around Woodhall Spa there's lots of reinforced concrete underfoot from WW2 in the woods if you go down the bike/foot paths.

Locally, some herberts unearthed canisters of mustard gas from what's assume to be a Home Guard cache and it appears they fiddled with it and ended up in hospital. So that's the current joke around here (provided the kids aren't listening).

We use Duo Security ( https://duo.com ). It integrates with Remote Desktop Services (and a whole bunch of other applications). So long as you've a phone of some description (landline, dumb mobile, smartphone) it'll work. The closest offering to what we have is Duo MFA (we're on an old plan that's no longer available to new customers).

We tended to use steel cable ties through the security loop. You need tin snips/shears to remove them.

We require 2FA for access to SIMS (all RemoteApps, actually) outside of school.

Buying power and less hand-holding/more expectation for the customer to RTFM?

I'd echo the "take control of your external DNS away from the LA". You own the domain, so put DNS where you want. You'll just need the zone file so you can replicate the existing settings with the new provider.

Yeah, we're still seeing intermittent timeouts and 503s today.

Can we back up a bit and ask who owns the device you're filtering? The school or the parents of the child?

Giving them the benefit of the doubt, they were mostly completely down so maybe they switched provider to get up again? Having said that, yes - I've known them to do maintenance in the working day.

It looks like they've shifted provider - yesterday they were on Six Degrees, this morning they're with Incapsula.

Started about 11:44 today, looking at our logs. ParentPay helldesk don't know when it'll be back up. EE were/are also having problems. We noticed issues sending calls through to EE mobiles/towers from our landlines about midday. We route via Chess.

Yes. Ours has this (we specifically highlight the DfE/LA/LRS earlier in the doc):

When we looked into it (didn't go with it in the end), it needed: TCP ports: 2053, 3789, and 443. We're already a Sage customer and (IIRC) I found that either on the support portal or a sales presentation.

There's also this that I spotted the other day. If you have 2012 or better fileservers, FSRM supports PII discovery via regex. https://4sysops.com/archives/file-server-resource-manager-fsrm-part-6-classification-management/ edit: actually works on 2008R2 too, it's just not as fancy.

^ Your form validation chokes on .net email addresses for some reason. It accepted a .com (plus the usual .sch.uk).