Primus

Ok - post back and update the thread on how you get on.

You'd need to look at this further - failover replaces the need to use split scopes. I doubt that option policy would make a difference however the DHCP servers should all be identical - you're probably going to need to do a bit of digging in DHCP here. You could do some testing with just 1 DNS and 1 DHCP server over the holiday period - shouldn't be any major drama to simply shut the other DNS/DHCP servers down unless you've got other stuff running on them?

How is your DHCP configured? Eg. split scopes, failover? Is your DNS correctly replicating? Could you possibly (temporarily) run with just 1 DHCP and 1 DNS server in order to try to diagnose the issue further?

What is providing the DNS and DHCP for the network you're running the Unifi setup on? Does this network have any other DNS or DHCP running on it? Is it completely isolated as a test environment from your main environment?

Honestly this has to be related to your environment - I've got quite a few Unifi installations and I've never seen this or read about anyone else having this problem on their support forums.

@Bev if you want any further details feel free to PM and I'll supply my work email.

We've used them extensively for lots of things and they've been brilliant. We've always been really happy with their pricing, professionalism and ability to deliver.

Is this a spoof?!

Aspire

Try this

You can both hide the group from the directory and apply a routing policy to prevent students emailing them at all. Show/hide in the directory Prevent students emailing certain groups

So the Unifi switches not being layer 3 does not mean there are options missing - sure if you want a layer 3 switch they won't do the job but for our setup (which is the same at every school I've worked at/visited) we do all our layer 3 routing at the core so have no need for layer 3 at the edge. They're not layer 3 switches so to expect them do layer 3 makes no sense???

What options did you find were missing?

We've had no issues with ours with spanning tree.

@Ditto - our students don't get the option to put their number into their account. I can't actually find a setting that controls this but under directory and then profile editing we only allow them to change their photo. Where are your students entering their mobile phone number? When staff or students here go into the my account section of Google they don't get any options like what you are talking about.

No ours is the same - turned off. Do you have the option turned on for students to be able to recover their account (different to change password I think).

Have you got Login challenges turned on in the admin console?

This has to be a setting in your admin console - we simply do not get these issues.

Sorry - the login challenge we get for students is simply the captcha style one. There's no need for students to have phones. We set our passwords using AD and sync them to G Suite and prevent students changing their G Suite password because the two would get out of sync. Have you got it set so that students can recover their own password?

The login challenge tends to appear if students repeatedly get their password wrong. I would turn off the ability for students to enrol in MFA. You can prevent students from editing the details in the Google account already in the admin console.

Just to revisit this, my current working theory is UE-V so I've disabled it for now.

Yup SSDs - this is the very first logon where the local profile is created, sometimes it takes no more than 1 minute - other times it hangs and takes up to 5 minutes - pressing ctrl-alt-delete then cancel seems to get past it tho.

No we don't but I wouldn't be at all surprised if it's trying to get out to something Microsoft based and hanging as a result - it's just another avenue for us to investigate.

Any further info on this? We've been seeing intermittent issues on 1803 with long first logons.

We wasted loads of time with their other solutions and by the time they'd offered the online virtual machine we'd made the decision to sack it. For an organisation that relies on the goodwill of schools to get their data they really need to think about how difficult they're making this process. Also my understanding is that the UK agency has had to come up with their own online system and are themselves banging their heads against a wall with PISA themselves over the matter.