notalot

Personally based on what I have heard over the weekend, I downloaded the on-prem software but I'm not stressing about setting it up (bigger fish to fry in September). Worst case the cloud goes down and the AP's will continue to function but wont get any config changes (I have Cambium at 18 sites both secondary and primary). We also only use PSK and epsk rather than Radius. I'm sure Cambium will make a statement soon.

We laid them out on the floor plan (we have scale drawings) then very unscientifically went through and best guessed 50% of them with local site knowledge of the building structure. Along with this we set the auto power settings for all aps to Max Power : 19 Min Transmit Power : 8 Minimum Neighbour : 2 Cell overlap : 50 We had a long call a while ago about the settings and these are a starting point. Without a spectrum analyser its all best guess.

Hi, I use cambium across the trust. The AP's are solid, the only thing that we have found is that if you go for an AP in every room you need to plan to turn off the 2.4 band on 50% of the AP's due to channel utilization and interference from other AP's. We have had a couple of issues and cambium support have been good. We have the full CnMaestro licence currently but we can change that down after our 5 years so that we can continue to manage it. I haven't used Ruckus before but I've previously used Unifi, Meraki and Aruba for the big names and I would say they give the Aruba and Meraki a run for their money without the licence issues you face with them.

We do a very similar process but after we export the data we use a bit of cloud software called Nalytics made by Nalanda Technology. Once imported the software does an additional search with better tooling then allows staff to redact emails and files without too much work. Nalytics has a large bank of names, job roles and other identifying info and does an initial redaction pass, we reduced the amount of work by about 2/3. Its still a decent task but at least it gave some support to our staff. The software doesn't cost the earth either but its not an insignificant price but its well worth it in our eyes.

My understanding is its the number of agents on the system rather than the staff logging tickets.

I'm in the process of settings up OSTicket (used before), same issue not staying with Spiceworks.

Hi, I haven't done it using PowerShell but I know that Schools Data Sync does this as part of the sync so I would assume there is a mechanism.

Hi, below is the config of one of my sites, not much difference in a 3 node cluster between direct attached or via a switch we just set them all up the same but in a 4 node cluster you would need quite a few additional NIC [ATTACH=CONFIG]72995[/ATTACH] My normal config across the sites is Dell Poweredge R650xs 2x Intel® Xeon® Silver 4314 CPU @ 2.40GHz 128gb Ram 6x 2.4TB 15k SAS Drives 2x 980GB SSDs' 4x 10tb SFP Ports (normally needs 2 network cards but can get away with 1) If your building this up your self make sure you get a HBA Card and not a Raid card as S2D needs direct access to the drives to work. Assuming that your not using these for Azure Stack HCI then there is also no actual requirement for the certified hardware. The difference between this cost wise was mad, we got it quoted last year £7.2k per server that we got and it was £36k per server (Dell-AX-640) One small difference that I would do now is to have an internal NVMe for the OS drive rather than using one of the 2.4tb drives. The actual setup of this is very straight forward at a high level Install OS Team Nics Set IP address Join Domain Enable Remote Desktop (if you permit this) Run below Powershell (I'm sure the PS can be improved to do more just didn't get round to it in the deployment schedule) Create Virtual Switch in Hyper-V # Fill in these variables with your values $ServerList = "Server1", "Server2", "Server3" $FeatureList = "Hyper-V", "Failover-Clustering", "Data-Center-Bridging", "RSAT-Clustering-PowerShell", "Hyper-V-PowerShell", "FS-FileServer", "RSAT-Clustering-Mgmt", "rsat-hyper-v-tools" $Clustername = "Clustername" ## Set line 33 for the IP of the cluster (the command never liked setting the ip via a variable) # This part runs the Install-WindowsFeature cmdlet on all servers in $ServerList, passing the list of features into the scriptblock with the "Using" scope modifier so you don't have to hard-code them here. Invoke-Command ($ServerList) { Install-WindowsFeature -Name $Using:Featurelist } #This tests all disks and resets them if something has been written to them or a partition has been created, this doesn't effect boot drives Invoke-Command ($ServerList) { Update-StorageProviderCache Get-StoragePool | ? IsPrimordial -eq $false | Set-StoragePool -IsReadOnly:$false -ErrorAction SilentlyContinue Get-StoragePool | ? IsPrimordial -eq $false | Get-VirtualDisk | Remove-VirtualDisk -Confirm:$false -ErrorAction SilentlyContinue Get-StoragePool | ? IsPrimordial -eq $false | Remove-StoragePool -Confirm:$false -ErrorAction SilentlyContinue Get-PhysicalDisk | Reset-PhysicalDisk -ErrorAction SilentlyContinue Get-Disk | ? Number -ne $null | ? IsBoot -ne $true | ? IsSystem -ne $true | ? PartitionStyle -ne RAW | % { $_ | Set-Disk -isoffline:$false $_ | Set-Disk -isreadonly:$false $_ | Clear-Disk -RemoveData -RemoveOEM -Confirm:$false $_ | Set-Disk -isreadonly:$true $_ | Set-Disk -isoffline:$true } Get-Disk | Where Number -Ne $Null | Where IsBoot -Ne $True | Where IsSystem -Ne $True | Where PartitionStyle -Eq RAW | Group -NoElement -Property FriendlyName } | Sort -Property PsComputerName, Count #Lets test the cluster, warnings are generally ok especially if you are segerating the networks Test-Cluster -Node $ServerList -Include "Storage Spaces Direct", "Inventory", "Network", "System Configuration" # Pause to let you check the results. Pause New-Cluster -Name $Clustername -Node $ServerList -NoStorage -StaticAddress 1.1.1.1 Enable-ClusterStorageSpacesDirect -CimSession $Clustername Add-ClusterScaleOutFileServerRole -Name SOFS -Cluster $Clustername #this creates a new virtual disk for the cluster to use, its had some issues for me so the GUI can do this stage as well so its commented out for now #New-Volume -FriendlyName "Volume1" -FileSystem CSVFS_ReFS -StoragePoolFriendlyName S2D* -StorageTierFriendlyNames capacity #This sets the cluster failure behaviour without this if a host dies the cluster wont fail it over for 120 seconds. (Get-Cluster).ResiliencyDefaultPeriod = 0 Once the PowerShell is done the cluster should be active as well as S2D, if you didn't have luck with the new-volume command then you need to create a Virtual Disk. I will say that I have installed 5 of these and all 5 have had different issues after install, most related to permissions in DNS or AD for the cluster and the hosts. Hope that lot helps a bit.

Hey, I have several Hyper V clusters with S2D setup (3 and 4 node clusters), from my experience it works both ways without too much issue, both ways pass the cluster validation tests. My current setup is to have 2 10gb NIC's teamed for Cluster Communications (and S2D server to server coms) and the rest of the NIC's teamed for Virtual Switches and management. I vlan off the Cluster communication then leave the rest tagged for all the other vlans that are needed.

We gave in this year and brought access to Nalytics it takes the export from a Content Search and will then automatically redact a large amount of the documents automatically, it still needs to be proofed and some bits redacted or unredacted manually within their web based GUI but it has saved about 60% of the time the redactors have been doing. Technically its regex and keyword searching and replacing with a GUI to proof it, it works quite well and does save time.

From memory (going back a few years) if you add a group from the Teams App (not Web) it will add the members of the group, but it doesn't update if the group is updated going forward. PowerShell would be my go to if I had to do this again https://learn.microsoft.com/en-us/powershell/module/teams/add-teamuser?view=teams-ps

Hi, I've done something similar recently to handle an issue with a cluster. If you "remove" the server from fail over cluster manager then the VM is now hosted on the server it was assigned to in failover cluster manager, so one of your 2 VH's (it doesn't delete the VM when you use remove in Failover cluster manager it just stops fail over cluster manager managing the VM), if it was running it will stay running You can then perform a storage move on the local Hyper-V server through Hyper-V manager to get the VM's files out of the Cluster Storage and to where you want them stored.

Hi, Yes this is technically possible but without some serious time to invest you'll regret accessing the database directly. The database for sims is expansive and poorly documented (from my experience). My previous trust did this extensively to create a data warehouse and as long as you don't write anything to the database it wont effect your support (we had it in writing from ESS before it moved). The question is why do you need live data rather than "Semi Live" data, Command reporter whilst also can be a pain is less of a problem than accessing the database as it will run Sims Reports and they can be outputted to local locations without issue. You can then run it as a scheduled task. Just take care when doing this as we get to this time of year the reports can cause Sims to lock up for a while whilst it runs especially when your working with Attendance or Behaviour data.

Hi all, so been working with Schools Broadband with this since the change and still no closer. As Mr.Ben pointed out the PSK is encrypted so cant be pushed out like the SSL VPN was. We looked in to certificate based Auth but this is a per user certificate so would require a certificate authority to be in place which for us currently doesn't exist as some of our sites are Azure joined and not domain joined, I haven't sunk much time in to identifying the requirements for a CA in an Azure Joined domain. Even if we did the VPN still wouldn't be automated and the certificate would change per device. Put bluntly if we ended up having to setup a CA for this we would practically be at a point for always on VPN (DirectAccess). Right now the only option we have is to deploy the tunnel with Reg for the settings then a tech is having to visit the device and add the PSK by hand which is far from ideal but preferred over staff having all the information needed to join their personal devices to our network.

The main issue I have is there is no way to deploy this VPN as its using Pre Shared Keys, most of our staff even with instructions would fail to set things up correctly not to mention the security implications of staff being able to add their personal devices to the VPN. So this requires my teams to go out to every staff device and set it up one by one and for some of my staff they need several VPN's as they access several sites and we don't permit inter-site communication (yet). Has any one had luck deploying this on mass via Intune, SCCM, script or GPO?

My DPO reported it to the ICO on the phone and the short version from that call is below; The very helpful lady on the phone said that it was the decision of Classcharts as to whether they felt that this met the reporting threshold, having considered the risk as a result of the breach. Providing they felt that this could be justified, they just log it and keep a detailed record. Of course, if anyone is adversely affected as a result of this, then of course this would put the spotlight on Classcharts and they would then have a responsibility to evidence their justification for not reporting the breach etc. Seams a little weird but guess there's not much to be done with it.

Last week Class Charts had an IT issue in which the incorrect student record was presented to parents. We had it reported by 3 parents that got information from students not in our schools, it was a random student from elsewhere in the country. It was confirmed at the time it was a wider issue not just affecting my trust. We have chased Class Charts and we have been told that the issue is resolved (great) and it was only for a short period (also great) but that they don't consider it a data breach and its not reportable. The message we got was clearly a stock answer and they refused to release further information. The below is the reply from their "DPO team" We carried out a full technical investigation after we experienced problems from the product update on Monday. I’d like to assure you, this was rolled back and fixed urgently to ensure that the cases of incorrect information being displayed were minimised. Our technical team have ensured any future updates and enhancements cannot cause similar issues. Through all investigations we strictly follow ICO guidance. In line with this, what we experienced is not classed as a data breach, nor is it classed as a reportable incident. I understand the concern and why you have questioned this, but we take this very seriously and always act to ensure full compliance. Due to the nature of the information available, we can not provide further detail on top of what has already been provided. I appreciate that this is frustrating when you are trying to gather the most precise information you can. This is not from us not wanting to provide further detail, but us not being able to provide further detail. I am so sorry that you have had to continue to chase to get the answers you have, and that the whole experience has been far from what you would expect of our service. Also due to the fact they don't consider this a breach I doubt they will sent anything out about it (we had to chase to get any information and we were one of the sites to report it) Myself and my DPO think that given the full name of the student, School they attend positive and negative points, detentions as well as announcements from the school were all visible this would definitely class as a breach. What are your thoughts on this.

It wouldn't take much to use OBS (open broadcast software - Freeware)) to stream this using the webcam idea to youtube.

I would guess your after something like this. https://w5.siemens.com/web/cz/cz/corporate/portal/home/produkty_a_sluzby/IBT/pozarni_a_bezpecnostni_systemy/system_kontroly_vstupu/sipass_single_door/Documents/44422_CM$UM$K44Duo$en$de$se$fr$da$no$fi.pdf Its the installation manual, on page 8 there is a wiring diagram to install the K44. (I have no knowledge of this device just did a quick Google.)

It would be a good idea to speak with citizens advice bureau before setting up a payment plan once you start paying you have acknowledged that you owe the money and it will make life very hard if after the chat you find out you don't.

Thanks to both of you, Psydill - The developer menu doesn't show anything just that the request was started. jinnantonnixx - Thas a massive help. We were using a config that was from a guide and we haven't thinned it down yet just wanted to get things working then look at improving them, as it stands this is in development currently and not live. From your information it turns out that there is a DNS related issue with Google and YouTube but not with any other site I tried. Its a little odd but I would guess it has something to do with the LA filtering forcing safesearch. If I run the DNS on the server through 8.8.8.8 then it works fine but bypasses some of the filtering which I really don't want to do. Now its just a case of working out how to resolve the issue.

Hi, sorry if this is in the wrong place please feel free to move it. We have just finished setting up a Squid3 server on Debian. It works fine 99% of the time but some sites it refuses to load at all, YouTube happens to be one of them. When you browse to http://www.youtube.com the page just sits loading, nothing comes up on screen (I've left it for 30 minutes with nothing loading) and it never times out. We have the same problem if we try to go to Google (even though google is the homepage) it loads google for the first time then doesn't do it again. I have no idea what the problem is with it as I'm still very new to Squid, we have tried a few things. Turning off the Squid Cache Adding the DNS_4_first setting to the config Setting debian to use IPv4 first. Checking that the file descriptors are within limits Looking in the Access.log file the connection request doesn't show up. See below a copy of our config (the cache has been turned back on as it doesn't appear to fix the problem). #Recommended minimum configuration: shutdown_lifetime 2 seconds cache_peer UPSTREAMFILTER parent 80 0 no-query no-digest never_direct allow all acl localnet src 10.60.148.0/22 acl SSL_ports port 443 563 1863 5190 5222 5050 6667 acl Safe_ports port 80 # http acl Safe_ports port 21 # ftp acl Safe_ports port 443 # https acl Safe_ports port 70 # gopher acl Safe_ports port 210 # wais acl Safe_ports port 1025-65535 # unregistered ports acl Safe_ports port 280 # http-mgmt acl Safe_ports port 488 # gss-http acl Safe_ports port 591 # filemaker acl Safe_ports port 777 # multiling http acl CONNECT method CONNECT http_access deny to_localhost icp_access deny all htcp_access deny all http_port 8080 hierarchy_stoplist cgi-bin ? access_log /var/log/squid3/access.log squid #Suggested default: refresh_pattern ^ftp: 1440 20% 10080 refresh_pattern ^gopher: 1440 0% 1440 refresh_pattern -i (/cgi-bin/|\?) 0 0% 0 refresh_pattern . 0 20% 4320 # Leave coredumps in the first cache dir coredump_dir /var/spool/squid3 ############################################################################## ##Auth Settings ############################################################################## ### negotiate kerberos and ntlm authentication auth_param negotiate program /usr/local/bin/negotiate_wrapper -d --ntlm /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=DOMAIN --kerberos /usr/lib/squid3/negotiate_kerberos_auth -d -s GSS_C_NO_NAME auth_param negotiate children 10 auth_param negotiate keep_alive off ### pure ntlm authentication auth_param ntlm program /usr/bin/ntlm_auth --diagnostics --helper-protocol=squid-2.5-ntlmssp --domain=DOMAIN auth_param ntlm children 10 auth_param ntlm keep_alive off ### provide basic authentication via ldap for clients not authenticated via kerberos/ntlm auth_param basic program /usr/lib/squid3/ext_ldap_group_acl -R -b "dc=DOMAIN,dc=local" -D squid@DOMAIN -W /etc/squid3/ldappass.txt -f sAMAccountName=%s -h dc01.DOMAIN auth_param basic children 100 auth_param basic realm Internet Proxy auth_param basic credentialsttl 10 minute ### acl for proxy auth and ldap authorizations acl auth proxy_auth REQUIRED # aclname acltype typename activedirectorygroup acl allowedsites dstdomain "/etc/squid3/allowedsites.txt" acl blockedsites dstdomain "/etc/squid3/blockedsites.txt" acl exceptedsites dstdomain "/etc/squid3/exceptedsites.txt" acl prioritysites dstdomain "/etc/squid3/prioritysites.txt" ### http_access rules # allow unrestricted access to prioritysites http_access allow prioritysites # enforce authentication, order of rules is important for authorization levels http_access deny !auth # prevent access to basic auth prompt for BlockedAccess users http_access allow allowedsites http_access deny blockedsites # Access http_access allow localnet # block all other access http_access deny all I would appreciate any help in getting to the bottom of what's causing this.

Looking at the ERA licence I would suggest not. The licence uses the term "non-commercial educational purposes", Which an open evening wouldn't automatically be covered also later on in the guidance it says; "Showing recordings for entertainment purposes, whether or not the audience has made a payment or donation to see the performance" which I think is the more likely reason which is explicitly excluded from the licence. I would add I'm no expert and just took a look at the ERA guidance.

Unless some one wants the boards the PCB's are gone to PM as well.

Pens gone to PM