jthompson

Yup. More than once I've Googled a problem and found the solution on here. Posted years before. By me. I'd be happy to pay myself handsomely for that sort of service.

Why do I get the feeling that when the legacy settings are shuttered, I'll lose the ability to enforce MFA for certain users only (i.e. staff) without needing a premium license?

Users can't share externally, but selected staff can do after they've completed a data protection discalimer form. Those extra privileges are applied by adding the relevant staff users to a dedicated security group, which is where those extra privileges are applied. Staff can create new shared drives, students can not. Shared drives by default are limited to internal members only. Some select shared drives are able to inlcude external members as required. That's achieved by moving the relevant shared drives into an OU where the extra privileges are applied (we have OUs specifically for shared drives).

Sounds like Excel might be giving you an autorecover file from a previous report. File > Options > Save. Find the path of the AutoRecover folder, go to the folder and delete stuff (possibly all the contents, but maybe Google that first) then try your SIMS export again.

Would be interested in recommendations for Chrome tablets with nice low price tags. I wouldn't expect (or really want) them for as low a budget as £120 though. Android tablets seem more achievable for that kind of money.

SIMS? Design?

Google emailed out a link to this article today - https://support.google.com/chrome/a/answer/6334001 The email itself is referring to some upcoming changes (Feb 2024), but the linked article might help with troublshooting your Chromebook sign-in issue.

Our data manager has always said that this is a flat out no. For various reasons that I can't remember accurately.

Stick Man is my favourite of the ones that I'm reading to my little-uns each night. Zog is also a good-un. The Gruffalo is an outstandingly good one, though. I think it's prominence is in part due to the title: it can't be confused with anything else, but is also a nice short title so as to fit on the ever-present "From the author of The Gruffalo" sticker. It can be read fast and lively, or you can slow it down towards the end to induce sleepiness in the child. Julia Donaldson books tend to have an excellent flow when reading them, which is what sets them apart from other children's storybooks imho. The Gruffalo and Stick Man in particular. Another favourite of mine is The Cat in the Hat, which is great fun to rattle off at speed.

Our data manager did contact EduLink support about it, who were able to provide some more granular data on how long the sync of various different types of data were taking. IIRC the lion's share of it was exams related (entries and timetables for current or upcoming exam series). Not too much you can do about that, I shouldn't think, but our data manager did subsequently clear out historical records of pupils and parent contacts that were no longer needing to be stored, which I think may have imporved things. Presumably just from speeding up db queries rather than reducing the volume of data heading to EduLink. TLDR: EduLink support should be able to point you in the right direction and give you an idea of the sorts of questions you can ask of ESS support.

I haven't crunched the numbers fully, or tried in anger with W11 deployment, but there's always ChromeOS Flex! We've quite a few 4th and 6th gen still in service, but we're pretty much at the point now where basic teacher workflows are all able to be done without Windows.

I'd urge against sanctioning that involves disabling access to mailboxes. An account with Gmail disabled will reject delivery of messages, so it can get messy. Abuse of a mailbox account should be covered by the school's existing behaviour policy and dealt with in those terms, rather than as an IT thing as such. Technical measures ought to be reserved for only the most pressing cases IMHO, and not as a standard response. We've had a few cases where our DSL has asked that certain combinations of students can't email one another, and one student whose mailbox did need to be disabled indefinitely, but other than that, mailbox availability is assumed to be constant.

Something else to get acquainted with before you have a need for it is to note down how you'd delete an email from students' mailboxes using GAM. If you assume that there's an inevitability about a student or member of staff sending an email to students that really didn't want to get sent, you'll want to have the tools to hand to purge it from students' mailboxes asap. Installing GAM in Google Cloud Shell - https://basuta.com/posts/installing-google-apps-manager-gam-on-google-cloud-shell/ Bulk deleting emails using GAM: https://github.com/GAM-team/GAM/wiki/ExamplesEmailSettings#deleting-trashing-or-untrashing-user-emails gam all users delete messages query rfc822msgid:[email protected] doit

You can, after a fashion. We do it using a content compliance rule for sending messages where "Recipients header" has a regex to match any email address, with a minimum match count of 31 so as to limit the max number of recipients per email to 30.

I'm not sure that you can proactively monitor it really. Set up suitable retention rules in Google Vault (the default retention rules may be fine, but worth chacking) and familiarise yourself with how Google Vault works for searching email content. If you have Google groups set up that you don't want student being able to send to, set up suitable content compliance rules to reject messages sent to those groups from students. See /forums/cloud-services/224024-google-gmail-allowing-teachers-send-year-group-distribution-lists.html You'll probably want to have Google Chat disabled for your students. That's now a separate app from Gmail, so you can disable that for them easily enough in the Admin console. EDIT: Given that your staff accounts on on a different platform with a different domain name, if you have student Google groups that you wan tyour staff to be able to send to, you'll need to configure the group settings hand-in-hand with content compliance rules. The group(s) will need to allow anyone on the Internet to send to them, but the content compliance rule(s) will need to reject any senders to those groups that aren't from your staff domain name.

If you're running Windows and opting for one big display, the FancyZones feature of PowerToys may be helpful in jazzing up the window snapping options. I'm used to using dual displays, but with Windows window/desktop management deatures gradually creeping forwards now, one big display seems more viable.

A fully painted base with an unfinished model on looks more okay to me than a fully painted model on an undecorated base.

If you find that you're needing to roll your own solution, a decent platform for that is Google AppSheet..

Only ever used APC devices with the PowerChute software installed on servers to handle shutdown commands. It works, and the UPS devices themselves have worked well. We get a lot of power cuts here. You'll want ones with a network management card installed. That'll allow you to have it send you email alerts, makes the PowerChute stuff possible and also opens the way to monitoring battery level, estimated runtime, etc via SNMP.

I think any sync agents relying on using the SIMS .net client on the server will need a server reboot after SIMS gets upgraded. Not just Wonde. I always did that as part of the upgrade process.

Bit of a long shot suggestion this, but assuming you have Azure AD Connect running on-prem, it may be worth looking to see if there are any sync issues relating to those users. If you've deleted and recreated their local AD accounts, their corresponding Azure accounts might have the grump if GUIDs haven't been realigned as needed. Whether that would result in hybrid-joined computers treating signins in the way you've described, I don't know.

I remember getting a Voodoo 3 card back in the day, which had a copy on Unreal bundled with it. The main part of game was fine but the thing that I really got hooked on was the deathmatch mode as you could just play it locally against bots, which was quite unusual back then for a deathmatch mode. That then gave rise to Unreal Tournament, which I absolutely loved. Never played it online, just locally against the bots. It felt like a better, more controlled challenge. That's my ideal FPS experience! Years later I got Star Wars Battlefront (because it's Star Wars) and really just wanting to be playing offline rounds against bots rather than having to be online against random gamers. Buy once to own for unlimited offline play clearly doesn't provide the same returns for games publishers.

Do the affected users have unusually long names or unusual characters in their name? Also, is there any AzureAD stuff involved, or is it all just on-prem AD?

I don't like playing anything online against strangers. Too stressful and the best way to ruin any prospect of fun. In all the hours I put into Elite: Dangerous, I never once played it on anything other than solo. I grew up with multiplayer being a nice addition to a game where you could play it with your actual friends. Even then it's about enjoying one anothers' company more than winning at a game.

I was thinking of staff using Google Authenticator to secure whatever range of accounts they use for work, not just their Google Workspace account. MIS, exam boards, etc. Having their authenticator codes for those synced by their Workspace account seems sensible enough. 2FA for their main Google Workspace account does need to not rely entirely on being signed into the account though, you're right there, so having it installed in the work profile would be problematic without them having an alternative method set up.