pete

When we were running SIMS, we found the index optimizing routines here useful: https://ola.hallengren.com/sql-server-index-and-statistics-maintenance.html

Most of the students coming in for discussion (vs just collecting and celebrating) are of the "Help, I didn't get what I needed" or "I did better than expected, can I change my Y12 options?" We open the doors at 08:00 and most results have been collected by 11:00, with the occasional straggler in the afternoon.

"No student should have to rifle through drawers looking for a crumpled certificate when they're preparing for a job interview," Skills Minister Baroness Jacqui Smith said. "This app will give young people instant access to their results whenever they need them while freeing up teachers and college staff from unnecessary paperwork." That's Jacqui "ignore my husband's taxpayer-funded pr0n purchases, why not make everyone get an ID card and store their DNA perpetually just in case" Smith. Better a drawer than a half-baked government national ID project masquerading as a benefit to schools and students that will very likely fail when needed.

^ You can configure big honking alerts that email the whole of IT and SLT if an account is used. You can supplement those with a Canary Token or two: https://docs.canarytokens.org/guide/ (But as suggested above, definitely get it written into policy that misuse is gross misconduct up to and including dismissal).

Not Cinderella's R-Type

Limited deployment so far, but no issues that we wouldn't get with 24H2.

Dear Headteacher, I would like a pony for my dept. I will call them Geoff. I will hug them and kiss them and feed them only the best carrots. Geoff and I will spend the summer holidays having marvellous adventures together that I will then use as assembly topics until my nickname among the students is "enumclaw" and there's a safeguarding investigation.* Lots of love from Teacher who didn't lock their computer (left as a draft and then lock the screen) *Do not Google enumclaw on a work device, especially in conjunction with equines.

You might get more mileage out of the Zero Trust Assessment docs/tool: https://techcommunity.microsoft.com/blog/microsoft-security-blog/the-microsoft-zero-trust-assessment-helping-you-operationalize-the-hardening-of-/4468729 https://learn.microsoft.com/en-gb/security/zero-trust/assessment/overview Microsoft also sent an email round about migrating some (all?) of the secure score bumpf to Baseline Security mode which does (or shortly will) live at: Microsoft 365 admin center > Settings > Org Settings > Security & Privacy > Baseline Security Mode. ....until someone at Microsoft needs to rearrange it again to justify their employment.

I did, their reply was "you have to do it".

I hadn't spotted how bad the price hike had got until I saw the Ars article (https://arstechnica.com/gadgets/2025/12/after-nearly-30-years-crucial-will-stop-selling-ram-to-consumers/) this morning:

Yeah, we got the emails for our schools too. If you're using the enterprise dashboard (enterprise.wonde.com) for managing N+1 schools, you can't change the license there via the "manage school" option. You have to use (or create) an account in each school before the licensing option appears.

This is one of the few times I let electricians (heavily supervised) into server rooms. (It helps that we've got certified electricians on staff.) We run a separate breaker box in the room from the main school feed with a dedicated breaker for the hard-wired UPS. Commando sockets aren't a bad shout for future-proofing (add a couple). The UPS should have come with an EPO relay that you can connect to a big red button (with mollyguard) mounted just inside the room so you can safely kill power in an emergency.

If you create, test and then delete a Paxton user manually, I assume you can re-use the token? (We can, so I'd expect you can too). Worth having a chat with Salamander to see if you can amend what it calls when deleting/archiving a user. They've picked a safe default - don't assume the employee handed back the token so make sure it can't be accidentally reactivated - but there may be other options they can call (disable the account instead of deleting, for example).

^ Is that instead of or as well as any mileage claims relating to business use (other than commuting to/from work)?

We're using these people: https://zapvehiclecharging.co.uk/ who have chargers from 7.4 to 22kw and they have a list of schools here: https://zapvehiclecharging.co.uk/schools-completed/ I've got a pending "so...Paxton integration?" query for the RFID auth side of things.

@Edu-IT - How's the TAP Electric management platform from a usability point-of-view? We've had funding confirmed for our schools and our finance and estates teams will be using it. @EssentialRug - Our installers (installation pending) are being very twitchy about installing in conservation areas or near listed buildings, which means we can't put chargers on the front car park at one school (the public part of that site). The turnaround time from "have vouchers" to "we can start installing on Wednesday" was very short.

OP: Is this a "people are doing daft things on the website and they need reining in" query? We have an "informal until it becomes very formal and you get told off" style and content policy enforced by headteachers, CEO and I that can be summarised as: Do not faff with the site template, branding, logos or menu structure without signoff from the CEO The headteacher owns the website otherwise - they have final veto. Out-of-the-ordinary requests should be run by them before it gets to IT. With the exception of image-based logos, text in PDFs must be selectable (works in a screen reader.) Image-based banners should have the same information available in readable text. Submitted text should be spellchecked and submitted photos should be at least 1 megabyte in size unless it's a logo. Department and Faculty leads are responsible for ensuring their content is accurate. You will be prompted (repeatedly) and then the ticket will be escalated to the appropriate headteacher until a response is received, even if that reponse is "I've checked and everything's correct" Make sure you have photo consent for people in photos.

I'm buying PC Gamepass via the Amazon vouchers route and so far it's still decent value for me (vs buying games I'm only likely to play once on Steam). If that's no longer the case at some point, I'll cancel it (or cancel it until enough decent games have built up again for it to be worthwhile).

Yes. We require staff to use the student's full name at least once in an email thread discussing them because unless I interact with MJ on a daily basis and can distinguish that one from all the other MJs, 50% of our staff don't have the context to realise who's being discussed. An email that states (for example) "MJ has brittle bones and if they trip over it's a serious matter needing immediate intervention by an adult/first aider" tells me nothing beyond we're failing to adequately safeguard the child by not making it clear who's being discussed.

Provided you've set a defined maintenance window in agreement with SLT (and told people about it) and the Action1 prompt gives a logged-on user enough time to notice (or delay) a pending reboot, don't worry about it. Other than 0-days, our maintenance window for disruptive updates (needs a reboot and/or thrashes the CPU) is Thursday lunchtime for primary schools (their choice) and Thursday from 16:00 for secondary schools). If someone regularly works outside 08:00 - 16:00, they can ask for a later reboot (or we'll do it automatically if we know). Try not to set your maintenance window on the same day that governor/trustee/SLT meetings are held - those run late. Security updates have a deadline of 16:00 on the days 2 weeks after the release date. Action1 can be a bit reboot-heavy until the device is fully patched, but thereafter it should calm down. Just check that it's not defaulting to "reboot the device" after every patch.

^ Ah, the Ian Tyler/Olivia Kincaid problem. Yeah, had a couple of those. We use solicitors for advice for the more.....tricky.....SARs, especially those with additional context bubbling away in the background. But it's not a routine thing (most are straightforward without a lot of interleaved personal data).

^ Just spotted that, they're on AWS - https://sitereport.netcraft.com/?url=https://login.jamfschool.com - which would explain the flakiness.

When trying to login to Jamf School, I'm seeing a new login box which gives the option of enterprise auth (but isn't labelled as such) or Jamf School auth. Clicking through and using Jamf School login, I get a 401 "access_denied" error when trying to login to either of our instances. The URL for the error is a bit more helpful and contains "Failed to get OrgRegion for connection". Occasionally if I refresh the page, it'll load the Jamf dashboard. Anyone else from the UK mind testing it? I've put a ticket in but this was fine on Friday, so I suspect they've made changes over the weekend. cheers Pete

For "that's a device holding confidential data that didn't use bitlocker" cases, we use a pillar drill (with the guard down) for mechanical disks/hard-shell SSD. For laptop/desktop SSDs we use bolt croppers.

I've got the 8Bitdo Ultimate (v1) for use on Windows, Switch, iPad and (very occasionally) Android. Does Bluetooth and wireless dongle and can store 3 different profiles / button maps.