jthompson

Definitely take a look at building your app to make use of Wonde - https://www.wonde.com/app/developers/ I think Wonde themselves will even take care of onboarding the customer school on your behalf, to get their MIS data flowing in. That would provide you with a single API to build your app around, regardless of the MIS your customer schools are using. Even if a school switched MIS, their data would be available via Wonde in exactly the same way.

We're using DokuWiki.

What is the 2FA for, though? It's not like you can get at any MIS data directly from the school account side of things. From an app devloper account, yes, but I don't think that's what this Basic vs Premium thing is referring to.

Our monitoring system is one of my permatabs and it affords me a massive amount of peripheral awareness about the systems, but I'd struggle to make one single screen on the office wall all that useful now, tbh. The value for me is in being able to interact with it to drill down as needed (was the power out anywhere last night? when was the Net2 service last not running?) rather than a declarative dashboard viewed across the room.

There are several PowerShell executables, which I believe would all need to be blocked. I'm using that GPO option to block each of these: %SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell.exe %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell.exe %SystemRoot%\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe %SystemRoot%\system32\WindowsPowerShell\v1.0\powershell_ise.exe

Use AppLocker to enforce rules that prevent students from executing scripts from any locations that they are able to write to. (https://learn.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker). You can also use FSRM to set a file filter on user areas that prevent students from writing .bat or .cmd files (and others) to their user areas, just to drive the message home.

I would say it's worth marking them as inactive, yes. It prevents those accounts from potentially being able to access the MIS. If using trusted auth (i.e. linked to AD accounts), it's a little more secure if those AD accounts are then disabled, but I've run into problems in the past with a long list of trusted auth accounts in SIMS linked to no-longer-existing AD accounts. Some SIMS db cleanup patches failed on me because of the missing AD users, and only worked once I'd marked each of them as inactive within SIMS.

Automated provisioning/deprovisioning here, so anyone entered by HR as an employee of any kind will get an account. Otherwise they would just be provided with a least-privileged generic account, to mitigate the risk of any named accounts not based on MIS data being left open indefinitely.

Google-based here, so we have a single generic coverteacher Google account and they are each supplied with a Chromebook to deliver lessons. Gmail, Chat and Classroom all disabled on that account, but it has read access to a shared drive containing all of the cover work being set for that day. No MIS access, so registers will be done on paper.

I've not done this and so can't offer the required specifics, but I would have thought that Sharepoint would be worth exploring. It's likely to end up having the Sharepoint 'look' to it rather than a bona-fide blogging platform, and I can't say for certain how the approval mechanism can be set up, but you'd have all your 365 auth stuff there to be leveraged, and you won't need to run any extra servers.

PrimoPDF is a PDF printer utility that gives you control over the output quality. Just watch that you opt out of any naffware during the installation wizard.

Maybe everything in the edutech sector should be forced to adopt Ofsted terminology. Wonde Good Vs Wonde Inadequate.

Paperclips are absolutely not what we want an AI getting involved with... https://www.decisionproblem.com/paperclips/index2.html [there's a lot of unused screen space at the start of that game, but it all gets used in the end...]

Create a new OU called something like "Parents Event" Devices > Chrome > Settings > Managed guest sessions > select your new "Parents Event" OU. Select the "Managed guest session settings" tab. Give a descriptive name for the session (e.g. Parent Guest) and maybe some suitable pages to load on startup if that's helpful for people. You can have the session automatially start and also automatically sign out after a set period of time if that's suitable. Parents won't need any creds to sign into the devices. With the MGS configured, move the relevent devices into that OU. They will pick up the new settings almost instantly and be available for your parent guests to use. After the event, move the devices back to their original OU and they'll revert to their previous setup almost instantly, ready for regular use again. You can then retain the MGS setup for use in the future: just move devices into the relevant OU to make use of it.

I would be worried about a Streisand effect there.

I knew you would say that.

We had a similar thing a while back with a hotspot using the same SSID name as one from our UniFi APs. We monitored the timings of which UniFi APs were detecting it, and cross-referenced that with timetables to narrow down a list of student names. The MAC address also checked out as being a Razer phone, which narrowed that list down to one.

1 donf knce VVhat gou rnean,

We've had a staff member just this week looking into purchasing a livescribe pen. I think it's one of those areas where any product is going to have a degree of naffness about it. Personally, camera capture into a note management app (preferably one that's already baked into a productivity suite, a la Google Keep) feels like it offers the best chance of staying useful.

Google/Chrome also checks against breaches as well now.

It presumably ain't gonna work in Maggie's server farm no more.

The main reason I'd give for reommending a dedicated password manager over using built-in browser password management is that a dedicated password manager will allow you to store all the other information associated with accounts, such as MFA details, PINs, descriptive notes, certificates, answers to security questions, etc. and can work more easily between browsers. Built-in browser tools only store URL, username and password, and are obviously less browser-agnostic. Also, not every password or account is for a website. If you're considering a non-cloud based manager, such as KeePass, then Syncthing seems a popular choice for making your data available across multiple devices without having to rely on a cloud service. Not used Syncthing myself, but it looks neat.

Any password manager, basically, as long as it isn't LastPass.

Would a good starting point be to simply shut the VM down, but leave it in place so that you can fire it up again if needed (perhaps with any NICs disabled on it as well for good measure)? As time passes, you'll be able to batter guage how much it's still needed.

New service from the US National Center for Missing and Exploited Children (NCMEC). Available to under-18s worldwide. Allows for removing/blocking nudes and other sexually explicit images on participating platforms, whilst preserving anonymity in the process. Worth bringing to the attention of safeguarding leads. https://takeitdown.ncmec.org/ From the site: Facebook and Instagram are participating platforms.