PiqueABoo

I've got one of those and although charitable and non-profit sometimes apply to my actions, it's just a personal play thing and I expect most of them are the same. I've yet to work on any mail domain changes where I haven't succesfully explained that having your new address as a primary and your old address as an alias/proxy pointed at the same mailbox for a few years is by far the best strategy... old mail addresses have a habit of persisting in other folk's address lists/mailboxes for eons... and one day someone will probably use an old address for something mission critical (which if you talk to users during a 5 min outage is absolutely everything they get sent).

Oh, sorry misssed that.. but do you not get the same kind of issue (imperfect deletion) with that Guest User profile deletion?

There is a GPO setting to delete profiles at logoff, but in practice it tends to leave lots of typically empty profile folders behind. I imagine XP cleans up the profile but some sluggish/irksome app or other stops it cleaning up properly. Another vote for delprof2 @ computer startup.

Default config is fine for me too. Something else it does (or did for me when I tested it last year) by default is opportunistic TLS i.e. when sending to or receiving from another mail server with that capabilty the mail will travel across the net encrypted via SMTP over TLS.

The command you need to tweak that kind of stuff is set-user .. there's a little bit of overlap with set-mailbox e.g. you can change a display name with either cmdlet. It's your perogative but I feel compelled to ask: Are you happy putting that kind of data/detail in the potentially more vulnerable 'cloud'? Compromise one account and...

But what about the alleged facial recognition logons (or is that just an API for 3rd parties)?

Nope. Was it the 1500 limit? Only some do have that 1500 limit now but others are still stuck with 500. And some that had the get-throttlingpolicy cmdlet don't have it now. I've given up trying to make sense of what any given tenancy should look like at any point. PS: A whole school e-mail to a single distibution list (containing everyone) in the GAL shouldn't count as more than 1 message.

The politicians stood in front of TV cameras and announced intent to make legislation about this and other things, IIRC around election time.. the Bill kicked off in Feb 2011 and it's clear by the debates etc. that plenty of interested parties got their concerns into the right peoples hands. This is how the system works and you had ample opportunity to: a) Notice there was new law in progress, b) Write to MPs, committee members etc. Again the basis for this is consent: I'm a parent, my child is MY responsibility and some school tech (or headmaster) should not get to decide whether MY child should surrender personal data or not. I don't think there was a single voice from any party or indeed anyone opposed to that, it's uncontentious, the issues were over whether you needed all parents or just one to consent etc. That said whether the child should be able to override the parental decision was one of the hot topics, especially whether there is a too young angle. You have to go read that to see the justifications (there are some proper ones). Irrelevant, they're not choosing what catering/whatever system you're using. Are schools required to ask/tell parents before introducing a biometric system? The law doesn’t require that parents are consulted before an automated biometric system is installed, only that parents be notified and that consent from at least one parent be gained before their child’s biometric data is obtained or used for the purposes of such a system. It is up to schools to decide whether they think it is appropriate to consult parents and pupils in advance.

Ugh.. didn't realise that is the last FAQ in the draft guidance: Is parental notification or consent required where a child uses or accesses standard commercial sites or software which use face recognition technology? The provisions in the Act only cover the processing of biometric data by or on behalf of the school or college. If a school or college wishes to use such software for school work then the requirement to notify parents and to obtain parental consent will apply. However, if a pupil is using this software for their own personal purposes then the provisions do not apply, even if the software is accessed using school or college equipment. Murkiness: There's a difference between what I thought/said and what this says e.g. if teacher says go and do some project on your class trip without specifying precisely how then, the pupil could on their own initiative decide to upload that class photo somewhere that does biometrics, and they'd be doing that for school purposes. You want to encourage rather than take away pupil initiative surely, so I think 'own volition" (or not) has got to be the intent and answer here.

"On behalf of the school" means speaking or acting for the school and I think that would include teacher instructing kid to use a biometric wotsit in any scenario. If kid does it of their own volition then probably not.

Depends on how you perceive the law - it's not saying biometrics in schools is unconditionally evil, the "problem" is consent, failures to inform and obtain consent, mixed in with human rights, child rights and so on. Quoting numbers about how many folk don't give consent is only part of it, what you can't tell me is how many people gave consent but would have been seriously put out if you hadn't asked for consent. Sprogette is my (Primary age) child and although the stream of consent forms is a pain at times and I've yet to say no, I definitely do want to see and sign some of them.

Not entirely sure what the query is but from Hansard (Lords): I know that my noble friend is concerned that these provisions should not apply when pupils access commercial websites or software systems that use face recognition to control access. I can give reassurance to my noble friend that the provisions in Clause 26 cover only the processing of biometric information that is carried out by, or on behalf of, the school or college.

Simply not true and Biostore happens to be where I got some of the information we weren't getting from the DfE - they certainly know users of their fingerprint-based systems will be subject to PFA 2012 on 1st Sep 2013. You'll find an article about it on their news page.

I guess you didn't read my dismissal of the same claim you made in the thread at the weekend when I said that is what they more or less all do and very definitely is "biometric information" according to PFA 2012.

Hadn't seen that thread but it's at a tangent to what matters. Having satisfied FoI law, if a school has biometrics I then suggest [you|whoever] reads that draft DfE guidance and if necessary send them a response.

Sorry, you missed the chance to have that argument. PFA 2012 is the new law and you'll need to be respecting it by 1st Sep 2013 (which is when it takes effect). There's also CCTV guidance that will eventually be made via PFA2012. Big Brother Watch are busy FOIing schools about use of both biometrics and CCTV right now.

DfE have finally pulled their fingers out and said something (two weeks after Protection of Freedoms Act 2012 gained royal assent): Parents given power of veto on schools There is a link to consultation docs at the bottom of the page - this is about the DfE's draft advice (Annex A).

I was playing with an upgraded to (a single) 2010 system where there's a very slight touch of doubt about the Public Folders. But everything works fine in user-land and I eventually thought I'd run the BPA just in case. It says unconditionally, on the non-default tab: "The default public folder database is remote ... The default public folder database for mailbox database '' on server isn't local' Which bothered me given that they'd been moved to the local system from another earlier Exchange box.. perhaps something about that hadn't quite worked? So I scoured the net, read this read that, spent half a lifetime poking about with ADSIEdit and so on getting nowhere - it, specifically where msExchHomePublicMDB was pointing, looked correct. So finally I decided to look at the BPA XML to try and figure out what it was doing and it was essentially this: Does the string "CN=PUBLIC FOLDER DB,CN=DATABASES,CN=EXCHANGE AD..." contain "CN=SERVERNAME,CN=SERVERS,CN=EXCHANGE AD..." Which it clearly doesn't, and by and by I tried it on a fresh E2K10 VM and got the same error for the same reason: The BPA "local" rule is apparently testing whether the public folder path points to part of AD where it does not live on a (single) 2010 system... not on the orginal system... not on a new one... not on another I eventually got to check. I have a feeling that if you've spent much time with PFs on Exchange 2010 (which I haven't) then this is one of those "Oh, didn't you know that?" things, but no I didn't and if it's on anyone's blog, in a forum or noted somewhere in some MSA blurb, then it's bleeping well hidden. But that's an aside - sanity checks are supposed to be sane surely?!?

Probably a reaction to how you configure Windows - should have given her a non-admin logon and locked it down enough to stay reliable.. ;b

Sorry, but that's not different - templates are common to every system I've tripped over, they don't make the (legal) issues go away. For instance in that (rather dated) ICO doc: A subset of the unique features of the fingerprint are extracted from a scanned image and converted into a biometric “template”. This template, a binary number, is checked against the template generated each time a person places his finger on the scanner. Full fingerprint images are not stored and it is extremely unlikely that a usable fingerprint image could be generated (“reverse engineered”) from the template. You're 100% wrong. "Biometric information" is very abstract, here's the shiny new legal definition: (2) “Biometric information” means information about a person’s physical or behavioural characteristics or features which— (a) is capable of being used in order to establish or verify the identity of the person, and (b) is obtained or recorded with the intention that it be used for the purposes of a biometric recognition system. (3) Biometric information may, in particular, include— (a) information about the skin pattern and other physical characteristics or features of a person’s fingers or palms, (b) information about the features of an iris or any other part of the eye, and © information about a person’s voice or handwriting. (4) In subsection (2) “biometric recognition system” means a system which, by means of equipment operating automatically— (a) obtains or records information about a person’s physical or behavioural characteristics or features, and (b) compares the information with stored information that has previously been so obtained or recorded, or otherwise processes the information, for the purpose of establishing or verifying the identity of the person, or otherwise determining whether the person is recognised by the system. It doesn't matter what happens between a fingerprint reader/iris scanner/whatever and the system deciding someone is Fred Bloggs.

Talk to the vendor about it before handing over your money and possibly choose another vendor if they can't give a convincing answer. Also ensure the SLT have read sections 26 - 28 of the Protections of Freedoms Act 2012 (they're not active yet and might not be until next year, but if you're implementing a new system I suggest you start off the way you will have to continue re. "consent management" and providing reasonable alternatives).

Two sides to that one: TOH was called "the best I've seen.." when training (independent assessment from another PGCE institution) and OFSTED always think she's Outstanding and she doesn't do anything she doesn't always do for that i.e. works hard. But the internal assessments usually have her as middling based on feeble, typically wrong, nit-picking... I'd like to believe that's some cunning SMT plan to keep the teachers striving to improve as opposed to resting on their laurels, but it's actually about local incompetence. I've had to do quite a lot of the 'only respect respectible opinions about you, discard the rest..' stuff coz it always puts her in serious career changing mode.

Very bestest advice: STOP until you completely understand why all those use objects don't have the inheritance tick. I don't have a script, but one reason for inheritance being blocked is the adminSDHolder stuff discussed in KB817433 which has a Microsoft script in Method 1 to fix that issue (I've used it in the past and it worked for me). There are clearer explanations of the adminSDHolder story in other places if you net-search. If you have a different cause then it's clearly possible to adapt that script to just reinstate inheritance on all users under a given OU or similar, but don't look at me because VBS just isn't my thing and I'd probably mangle the syntax and delete your AD. That said at a glance I think you just need to change the oCmd.CommandText query to point to the right OU, lose the adminCount condition, comment out the SetAdminCount line in the while loop, plus if you're a really tidy type remove the redundant bits and change what it tells you it's doing, but it's VBS so get an expert...

You ask for a serious 'business case' that considers educational value?!? :: gasp :: faint :: thud :: Well pat yourself on the back because I'm getting a little weary of schools where despite the economic gloom the case very obviously reduces to: School X has Y, so we must have Y too. And on a really bad day I suspect it goes something like this: Shiny! Me want!

:: Disappointed :: Was expecting a rousing call to depose Kids from their unprecedented position at the centre of the universe and get 'em all back to sweeping chimneys...