jthompson

Sadly it's not possible to do that with Google Workspace. None of the Context-Aware Access stuff will enable you to say that 2-step can be bypassed. The end-user ticking "trust this device" when signing in is the only bypass mechanism going, I believe.

We give staff the ability to create shared drives on Google and essentially leave them to it. Works well, tbh. A bit messy to begin with whilst people figured it out (when to create a shared drive vs just sharing a particular doc normally, etc.), but after a year or two it's matured and stabilised to the point where we're not seeing many new drives being created now.

Or just refer them to Google's own guidance for bulk senders, given that Google and Yahoo! made a point last year of requiring DMARC and TLS of bulk senders. https://apps.google.com/supportwidget/articlehome?article_url=https%3A%2F%2Fsupport.google.com%2Fa%2Fanswer%2F81126%3Fvisit_id%3D638555207111666668-2699043947&assistant_id=generic-unu&product_context=81126&product_name=UnuFlow&trigger_context=a&fragment=zippy%3D%2Crequirements-for-sending-or-more-messages-per-day%2Crequirements-for-all-senders

Try that again but in the style of Jar-Jar Binks.

If their domain is suffering deliverability problems, there may welll be reasons why. Those will be reasons to not allowlist (we should avoid the terms blacklist and whitelist IMHO) their entire domain. Consider instead flagging them for review.

I'm not sure the fact that it's installed on a school-managed device would have any bearing there. They can fall foul of that just as easily using their own device.

As long as the DC that holds your PDC emulator FSMO is syncing its clock with an Internet time source, other DCs will sync from that PDC emulator, with everything else in the domain syncing from any of the DCs. I believe that's how time sync in Windows domains is designed to work: the PDC being the authoritative time source for the entire domain.

They can avoid those beeps upon opening SIMS .net by reading (or at least marking as read) all of thier unread messages.

Keep you Mac awake by running caffeinate in a Terminal window. This avoids having to adjust system settings or using a third party utility. Various options, such as caffeinate -t 3600 to specify a number of seconds to keep from sleeping.

If your affected DC is a VM, check also that it's not having its clock set by the hypervisor. That won't be reflected in any W32tm settings in guest (DC) OS.

I may not be remembering this exactly right, but you can do this by placing the AutoHotKey executable (it's a portable exe) into a suitable network location, with a .ahk script file alongside it. Then use group Policy to set a user logon script that runs the AutoHotKey exe with the script as a parameter. An example script is here - /forums/windows-10/205602-disable-taskview-multiple-desktops.html#post1771391 In that case, I was interception Win+Ctrl+D, Win+Tab and Win+Ctrl+left/right to prevent students from abusing the multiple desktops feature. You can adapt that to intercept Win+Ctrl+Shift+B instead (#^+D in AutoHotKey parlance).

That one installs to the user profile I believe. Not sure exactly where. We've also noticed that HTTPS inspection breaks the connection to the servers when attempting to sign into it. Haven't noticed that behaviour, so maybe something in your environment (AV?) is impacting the installed software at some point following installation.

I appreciate the point about security updates vs feature updates, but MS have specifically warned (in the context of Win11 on unspported hardware) that monthly security updates may just stop. I'm not sure what mechanisms would be involved there, but even on LTSC it would still be a sudden death scenario of a month-by-month watch for whether CUs are getting applied.

Would that not have the same issue with regards to older hardware not being officially supported?

Maybe the assumption is that the shortfall is made up for by you ingesting the ropey ones whilst you work.

This just reminds me of any number of Apprentice episodes where they put on their business suits and hair nets and toy about in a development kitchen before sending their recipe off to a factory. "Forget the guidance on ratios, I want to put more chalk in these sausages to bulk them out and reduce the unit cost! Let's GO!!"

Between, Win11 hardware list, Win10 22H2 LTSC EOL dates and ChromeOS Flex verified hardware list, I've even in my desperation actually looked into deploying domain-joined, GPO-configured Ubuntu desktop to older hardware. I got quite far with Ubuntu infairness, until I came across the design decision that users' home folders are readable by all other users by default. Which was not supposed to be a thing any more, but apparently is. So I don't fancy deploying that even though the hardware is supported for many years to come.

When we were originally purchasing Veeam ( few years ago now), our supplier suggested Nakivo. They reckoned it basically did the same thing as Veeam under the hood, but at a lower cost.

And all the content of helpdesk tickets, surely?

Buy some stickers and don't give them to them if they're noisy. You could crank it up a notch by replacing the stickers with Haribo. To respond more directly to your original query, no, Google Nest or other brand of smart speaker assistant is not going to be able to be adapted to that task.They're too inflexible. A smartphone, perhaps. You'd need a dB meter that can determine whether noise levels are sustained above a certain threshold for a certain period of time (rather than just momentary peaks), to then trigger some event. Is the Tasker app on Android still a thing? Even if you got it to work, I'd argue that you shouldn't want it to. Always better to be rewarding positive behaviour than to be bashing the bad, I feel. Kinda joking about the stickers, but still worth a try.

No experience of charging lockers of any sort, but we do have a number of Zioxi trolleys (15-bay, MDF construction) which are very practical with some well considered design elements. If I were in the market for charging lockers I would definitely be considering theirs.

This is the official matrix - https://edu.google.com/intl/ALL_uk/workspace-for-education/editions/compare-editions/ Resellers will likely have some room to price more competitvely. But yes, you do have to purchase enough licensing for your entire organisation - you can't purchase just a handful. Even with it, I'm not sure you'd want to block non-managed devices. How will students do their work outside of the classroom? If the root concern is a safeguarding one around in-classroom videos ending up on WhatsApp, then removing the camera functionality from devices in the classroom (assuming mobile phones are banned in class) is the neatest way to achieve that.

You might want to suggest restricting use of the cameras on the school-managed iPads, if there isn't a specific requirement for them, so that the teaching staff can be confident that there are no cameras in classrooms. I'm assuming that you'll have some MDM tooling to manage the iPads accordingly.

You could use context-aware access (Admin > Security > Access and data control > Context-Aware Access) to prevent users from accessing certain things from devices that aren't school managed. That would likely prevent anyone from doing their homework though, unless you're handing out 1:1 devices. I don't think that context-aware access requires extra licensing. -- EDIT -- It's not available on Education Fundamentals, only on Education Standard and Plus. The MDM tooling built into Google Admin does have support for some iOS-specific controls to prevent work data from Google Drive being able to be shared out via the iOS sharing functions, but I believe that that requires the user to have a GWfE Plus license assigned.

Yes. Sounds like there's not really a tech issue, just a behaviour/responsibility issue.