jthompson

Looking again at how we can maybe use winget as our main app deployment tool (all via group Policy). Currently still relying largely on MSIs deployed via GPO, but managing updates is obviously not fully automated. Is anyone doing this successfully and/or willing to share any pointers? For instance, can winget commands be happily run under system context, etc.?

Been looking into winget here recently, too. I found that it wasn't working properly when run in an elevated prompt as an admin user. It couldn't pull anything from the winget source when run as that admin user. Worked okay for my regular non-admin user, but then that's not how I want to be able to use it. Signing into the machine as the admin user did something to nudge the DesktopAppInstaller appx that underpins things. Winget commands then work okay as that admin user, either under its own sign-in or in an elevated prompt from a regular user session.

Similar here. The candidate attempted the launch pretty much bang on the original start time of 11am, but the page sat loading for 10mins before I killed it to try again, only the test had disappeared from the current test list for her. Reappeared when refreshing after 1130 though, so hopefully your candidate is on now, too.

You'd have thought knowing how many candidates across how many centres are sitting what tests at what time would be useful information for capacity planning.

ELAT test has been delayed from 11am start to 1130. We have one candidate who has now been able to launch that one after waiting until 11:30. The broadcast chat message on the site was updated to mention the delay to the start of the ELAT.

If I were a betting man I'd put money on it being a typo of the domain name. From your address, send a message with both of them as recipients, and ask the external sender to do a reply all as a test.

Good, it's not just me then.

Isn't dist-upgrade what you'd use to upgrade the OS to the next release (i.e. distro upgrade). I tend to use apt update and apt upgrade rather than apt-get. Can't remember what the difference is but I did find that it works better. The unifi repo sometimes needs to be adjusted when a newer version of the controller gets released, and I think apt update will catch that whereas apt-get update doesn't necessarily.

At least it's neatly cable-tied. Or is it a Banksy?

I'm not sure where you stand on application allowlisting, but I'm pretty sure that it's the right thing to be doing. There's a nuisance aspect to this, too, which has been discussed several times in other similar threads, which it would seem reasonable to consider.

I'm not sure that it's even a minimum viable product yet. When I try it, it doesn't appear to 'do' anything more than just present staff and student names, contact details, etc. in a webpage with no option to edit (it either doesn't inherit privileges from SIMS .net or is in some kind of read-only mode for us). Other features on it's homepage generally click through to a 'Coming soon. Register your interest' type page. We're on SIMS Connected and can launch SIMS NextGen from the home screen in SIMS .net. You might find this article helpful in terms of knowing what features are available in it now. https://customer.support-ess.com/csm?id=kb_article_view&sysparm_article=KB0051793&sys_kb_id=a4989f951ba9b550408d8557d34bcbfa&spa=1

I think the burden of proof here is to demonstrate why VMs are not an appropriate solution. They need to be tried in earnest before any determination can be made on any performance impact. The words "severely affect perfomance" smell to me of a misconception on their part, or experience of them in a poor configuration. In my experience, prank/bad scripts running on a host can bring it to its knees and necessitate an ungraceful reboot in order for it be become usable again. If those kinds of scripts are run in a VM, the host is not at risk and can still be used normally. As others have said, sandboxing things in a VM is pretty much essential. The things you've mentioned in your OP demonstrate that. Ideally VMs with no network connectivity. We use VirtualBox with immutable disks and no networking. Students home folders are shared into the VM, so that they can open/save their scripts. Scripts which can't be run on any of the host systems due to application allowlisting. Similarly, the teacher use a VM to inspect and run the students' work. They can't run arbitrary scripts directly on their host machine either. There's another advantage to sandboxing which I think you ought to promote. That of students feeling confident to experiment, knowing that they can't break anything, either on the host or the VM. The only risk is a student accidentally trashing their home folder contents, which is no great shakes.

It might be that it's an option that follows course creators, so that courses they create subsequently will start that option off with whatever they last used. There was some behaviour along those lines with turning guardian summaries on or off, iirc. That's still unlikely to help you much, particularly if your classes are automatically provisioned in some way.

Still rocking a Kindle 3G, the one with the keyboard. Call me old-fashioned, but there's something comforting about an old e-reader: the way it feels in the hand, the feel of the perfectly weighted mechanical page turn buttons, the hairline fracture of the bezel plastics, the smell of non-touch, un-backlighted e-ink.

Worth noting that if your devices are Azure hybrid joined, recovery keys will be available in the device record in Azure also. At least, if the device is hybrid joined when encryption starts, it'll upload it automatically, but can be manually backed up to Azure after the fact if not.

I'm not seeing anything related to that option in the Classroom API, so I don't think you'll be able to automate that at all. It's always annoying when an option in the GUI isn't available via the API.

I've a feeling that that was the sort of duration we were seeing when we were running SIMS on prem. I think maybe the VPN aspect of SIMS Connected is proving to be a substantial bottleneck in this regard.

IME people don't generally read instructions, so I've found that a little "Laptop" flag label does the heavy lifting on that front.

That's weird. I would expect it to manage the group okay, assuming that the group address matches. In the past, when I've changed a group address in AD, GCDS has created a new group rather than updating the address of the original group. With users, GCDS makes use of GUIDs to link LDAP users to Google users (so that changing someone's address doesn't result in a new account being created), but that doesn't appear to be the case with groups, which is why I'd expect it to manage the group okay if the address matches exactly.

Don't know of any way for GCDS to 'adopt' groups like that. I suspect there'll be some group IDs tucked away in whatever local database GCDS utilises. Does GCDS add new members to those groups? If so, you can empty them and let GCDS go from there. If it doesn't do anything with them at all, I suppose you could rename the existing groups with suffix of ".legacy" or something, create new versions of them via GCDS and manually add the new groups into their respective legacy groups (removing any existing manually added members, so that the legacy groups only contain their corresponding new groups). You can then use gam to hide the legacy groups from the directory, which will help you to phase them out. Also, you'd want to prevent anyone from adding members to the legacy groups.

Yep, similar here. Each file share will have a corresponding pair of "fs_sharename_r" and "fs_sharename_rw" security groups. The only things that get added to those groups will be "role_" security groups (e.g. role_staff, role_student, role_teacher, role_finance_officer, etc). Users are then members of role_ security groups as required. For admin tasks needing higher privileges, signing in to something (either a server or workstation) with a different account is probably going to be needed. The "Run as" mechanism in Windows is designed to behave a bit differently where Explorer is concerned, so you can't really 'elevate' from your regular day-to-day account to do fileshare admin tasks.

In addition to using a spreadsheet or something like Netbox to document patch panels, you could add some overlays to your floorplans which show a zone for each cab, so that you can see at a glance which cab a room or area runs back to. Labelling of your modules and patch panels should hopefully then match up sensibly so that you don't have to document them in minute detail.

My regular user account has read privileges on student user areas and also read privileges on some other file shares that I'm not personally needing to write to. I've found that the majority of issues only need something to be looked at anyway. If I need to do any file management tasks for somebody, I'll do that from a secure admin workstation using a higher privilege account, so not necessarily having to sign in to an actual file server.

Similar to this we've used RackTables.

Vivaldi has/had one, too. A cyberpunk siderunner iirc.