jthompson

You can't stop people using their own test kits on themselves. Would be a weird/worrying state of affairs otherwise.

Well, the first images from Webb have been released. That first deep field image in particular is blowing my mind. I know that the universe is incomprehensively vast, but still, to have all of that in such a tiny region of sky (a grain of sand held at arm's length) is dizzying. It reminds me of when I first entered the galaxy map in Elite Dangerous. Up until now that was the best demonstration of the vastness of the cosmos that I've experienced. To think that that entire galaxy map of the Milky Way in ED is repeated in the way the deep field image from Webb shows is... yeah, mind blowing.

FYI, you may find that AutoHotKey is perfect for little customisations such as this. https://www.autohotkey.com/boards/viewtopic.php?t=75553

DHCP option 006 is what you're after, I suspect.

CNAME aliases are best avoided, as Kerberos gets upset with them. Better (and simpler?) to add a new alias onto the new file server using PowerShell: netdom computername fileservernew /add: where fileservernew is the hostname of the new server, fileserverold is the hostname of the old one and internal.school.org is the AD domain. That will take care of all the required DNS entries for you as well. Simples.

Staff laptops here remain domain joined and use cached credentials and local profiles, to allow for continued use away from school. A mix of VPN, Google Drive for Desktop and Google Chrome sync helps with continuity of workflows between home and school. In fact, all our school computers use local profiles, with folder redirections set for student users. I can't think that your option 2 (unjoin from the domain and use local accounts) has much to recommend it, tbh.

I'm sure gam could manage this. You'd need a query for the delete drivefile command that effectively matches any and all files. You could then run that against a csv of usernames, or against a group, ou, etc.

This has got me thinking quite a bit, as we use dymo-type labels on a lot of our computers and I'd like to make them more vandal resistant. I wondered about whether there was some type of glue that could be used to form a clear hardened covering for a label, so that little fingers can't pick at the edge of the label. As soon as a label becomes a bit dog-eared, it's likely to get removed by some little darling. I've also come across these library book label protectors, and wondered how suitable they would be for use on Chromebooks and other devices.

There's certainly a debate to be had there. A debate almost as old as SIMS.

I think we're all in agreement that banning the use of already purchased and installed equipment without any security-related reasons for doing so would be... strange. So strange that I can't see that actually happening.

He wants you to want it and to buy Chinese to get it.

Might the argument be that Hikvision and Dahua have built up their businesses significantly off the back of such camps, and been more complicit in them than simply "hey, some people purchased our cameras. What they do with them is none of our concern"? If they were chasing contracts to supply systems to "re-education centres", that might be more problematic? I don't actually know, obvs, but that might be why these companies are being singled out from any other incedental tech suppliers that might be being used.

I knew you'd say that.

With the user signed into Chrome, check that they have the relevant bits enabled for sync in chrome://settings/syncSetup/advanced, since they may have sync turned on but with passwords being omitted. Hadn't noticed the export option until pointed out by @Accura2k7. There doesn't appear to be an complimentary import option, though, which may swing things in favour of Chrome sync.

Bulk AD Users is another powerful option. It'll allow you do a CSV-based update. A CSV with columns for sAMAccountName, givenName and sn should do the trick.

For durable labels, I suspect you need more of a handheld label printer, like a Brither P-touch sort of thing - https://www.brother.co.uk/labelling-and-receipts/p-touch-durable-label-printers. Address label printers are probably only going to offer paper labels with adhesve suitable only for sticking to another piece of paper. Sounds like you might be wanting plastic labels, or at least a clear plastic patch large enough to go over a paper label and hold it in place.

For anyone not aware, you can view this info for your enrolled devices in Google Admin. The field/column is Auto-update expiration.

That's interesting. I've tried a few of our non-Hikvision ONVIF compatible cameras with the Hikvision and Dahua NVRs, and whilst I can get a live feed on some of them, motion-detection based recording isn't available, which is a bit of a deal-breaker.

Particularly if a ban wasn't just a ban on new sales (the wording of the BBC article is a ban on sale and use of their equipment). Interoperability between brands seems to be in quite a crummy state, which really makes any purchasing decisions a headache. I don't know of any off-brand cameras that Dahau and Hikvision NVRs are able to perform motion-detection with, for instance.

I'd like to ban them for user interface violations. We've had a Dahua system in for a while, and it's a big of a pig to use, and probably will need to be ripped out once IE mode is no longer a safe prospect. When we decided to expand our CCTV system to include more cameras, we opted to go for something other than Dahua. We now have a shiny new Hikvision (!) NVR just installed. Whilst better than the Dahua system, it still relies on having a proprietary exe running on Windows in order to view camera feeds, won't let you paste into the login form (weeelll, who wants to use a password manager, anyway?) and footage downlaods aren't regular browser downloads, no: they end up in %USERPROFILE%\Web\DownloadFiles for some strange reason. \rant Are there any normal, properly modern-browser-friendly (and therefore not reliant on Windows) CCTV vendors that people can recommend?

I was hoping there'd be more philosoraptors out there. So I made one.

I appreciate that, which is why I say that any specific classroom management issue here exists on top of the more general issue of getting application allowlisting in place. Application allowlisting isn't there to address student timewasting necessarily, and you'd want it even if all your users were reliably well behaved.

I'd say it's a technical issue in as much as it's a matter of application allowlisting being needed. Any classoom management problems then sit above that.

Just for the record, I've landed on the following workaround. After installing the LocalServiceComponents 'plugin', remove the corresponding reg item from HKLM\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run. This prevents the automatic launch of LocalServiceControl.exe. That takes care of the annoying UAC prompt for any user signing into the computer. When a user needs to use the HikVision webui to review CCTV footage, they will need to manually launch LocalServiceControl.exe. The UAC prompt can be dismissed, as enough of it is left running for video feeds to actually work in the browser. No shim required (it made no difference anyway).

If you've got AppLocker you could block executions by default, but then have a supplementary GPO applied to your Computing computers that includes the rule(s) needed to allow it on those machines. That would mean that AppLocker, rather than FSRM, is providing the restrictions to prevent students running their own executables, except for when they're on Computing machines.