Tefters

I mentioned before but just for reference, all this patch does is add NOLOCK to everything to prevent the deadlock from occurring (or ignore it, depending on your way of viewing it) as per the patch notes in the SQL file: -- Date : 23/07/2024-- Comments : PBI117434 - Added NOLOCK statement to prevent deadlock errors. A deadlock occurs when 2 or more transactions are happening on the same table entry at the same time, this is basic SQL database knowledge and essentially kicks one or more of the transactions out to prevent corruption/override at the exact moment. Seems strange that they would pull it unless they were not happy with the bandaid fix.

Because of the Sims summer patch. Well, technically deadlocks have always been there behind the scenes but if your seeing them more frequently on the client side it's because of the update. The problem stems from Sims being *hit and outdated and schools having to use 20 million 3rd party data syncs to do stuff that should ideally be in the application. Syncs used to be overnight but now more 3rd parties are doing live write back such as Iris Reach (attendance) and Class charts which are causing major issues with the database when users are trying to save records too. Throw in Sims Nextgen and you got yourselves a right sh#tstorm of incoming and outgoings feeds along with the client app. Hopefully Sims Nextgen will fix this and offer everything schools need from an MIS in one package when it's fully finished and released in 2040 [emoji1787]

Yup, this has come about in the last 4 to 6 weeks and is causing us headaches also. 1:1 iPads - Student breaks iPad and we give a replacement, old iPad was de-assigned in JamF, erased and trashed. Student signs into new iPad (OOBE) and asks for passcode after entering Apple ID, it's a previous passcode not always the last one. We end up skipping this and they are not properly signed into iCloud. Have checked iCloud on the web, AppleID on the web, ASM and can find nothing in regards to previous devices or MFA. There is one reset option in ASM (can't remember name of top of my head) but it doesn't work. I need to contact Apple for further assistance as something is not right here l. Luckily only 3 affected users so far so not everyone and for now 2 are running with no iCloud services, 1 remembered the old passcode and managed to get into their services. We then had this 1 user set their new passcode and tried a test with another iPad and same thing again but this time with the new passcode so the issue will continue to follow through devices. At first I thought it was to do with IOS 18 but my colleague reckons he has seen it before a few weeks ago. Maybe it's something to do with the new Password manager behind the scenes that has either replaced or works alongside keychain? I don't follow Apple enough to keep up with all the little details but there is defininately something afoot in managed school accounts as no school would want the previous passcode setup either on a 1:1 or shared device setup.

I allow this for 3rd party websites but only through approval on me (admin). Check the websites T&C's about data handling and decide from there. People have mentioned a few bits above on XYZ reg's etc... but if you don't facilitate some of it then teachers will either tell students to sign up manually or throw csv spreadsheets over email with information, then ofcourse there is the end user experience of 1 logon to rule them all. Personally, it's better than having the teachers do their own thing and you can always pull the connection at anytime if needed.

What sort of support / consultancy are you after? Is it possible you could just ask people on here for advice? I specialise in SCCM, not so much Intune but others on here have a lot of Intune knowledge also.

Enforced on all staff, nothing for students. I want to do it for students however have the following hurdles: - Off-site proxies so machines don't come out of our dedicated IP's they come out of the shared proxy addresses for all customers. - I could go down the hybrid joined device route which would work for our 3 IT suites but now all our students have 1:1 iPads through JamF so they are seen as external devices to Azure. - Trying to setup and maintain iPads on a 1:1 level with 12+ year olds is bad enough, add on MFA which would need to be setup beforehand via a computer and then required for the 4/5 user authentications when setting up an iPad and apps let alone when they forget their password and we reset then needing to sign into all the apps again, not a chance! My security OCD shudders at all of this but I can't see an easy way around it. Throw into the mix a no phone policy in the school which is bad enough when teachers keep bringing up the "we shouldn't be using our phones in classrooms, it's against the DofE regulations and advisories" let alone trying to convince it for security with students when we all know the students will just abuse it.

Isolated issue they said [emoji1787]

Correct I can, on paper it should work flawlessly, is it worth the risk for when something goes wrong and I lose a host or have to reboot both due to a patch failure or bug and therefore have 100% downtime, NO. I speak from experience, don't patch critical resources during key working hours. School doesn't pay me for out of hours work therefore non key working hours when I am paid is half-term. I refer back to my previous common sense statement and the Moto "just because you can doesn't mean you should". Even in zero point of failure setups by ISP's and other companies an update has wiped out a router which in turn caused HA not to activate therefore the zero point of failure was useless because it relied on software which was corrupt or failed for XYZ reason causing mega issues.

Awww the good old DofE guidance written by people in cosy offices using the blue sky method not realising the struggles and costs of IT within schools. So they want us actively patching server clusters within 14 days during school term with zero time for rectification should something go wrong, definitely a smart decision that [emoji849] Gave up reading that tripe ages ago and work to common sense best practice trends as best we can within reasonable timeframes.

Glad to hear!

Personally, I would never fully trust or recommend a cloud witness for an on-prem cluster or vice-versa due to latency, isp, firewall, web filter, cloud provider having an off-day, code change by the provider behind the scenes etc... Cloud witness for cloud (in the same region), on-prem witness for on-prem. I've seen some weird setups that make no sense with witnesses as VM's etc which I don't agree with either. A cluster witness is a basic file share that monitors multiple hosts, I usually recommend 2 scenarios, first scenario is also best practise by Microsoft and anyone who installs clusters at large scale (Dell, HP etc...). 1. Physical DC with logon attempts from all clients disabled except for the cluster hosts. Server also hosts DNS. This way if you have to shutdown the whole cluster or have prolonged power cut over UPS uptime you bring this server online first and then can bring up the cluster properly afterwards as AD and DNS are available. Trying to bring a cluster up without DNS while possible is a pain and can cause further issues where you might need to reboot hosts individually afterwards. 2. At the very least just make a cr#ppy workstation the cluster witness and shove it in the server rack. My work setup I killed multiple birds with one stone, slight best practise while at the same time slight cringe. I have a 2 node S2D cluster and then later purchase a physical server as a new backup server (Veeam). I made this server a physical DC, disabled all AD logon requests except for the S2D hosts and installed DNS for name resolution. No DHCP needed as hosts are fixed IP. Finally I made it the cluster witness. I then also installed Veeam and use that to backup the 2 cluster hosts (off server backup, VM's only, to save processing power on the hosts) and then have a job to backup itself so then I have a backup of the Veeam server and the Physical DC itself. I would never usually entertain installing something like a backup management software on a DC (or any other software outside basic AD tools) for that matter but it's only used as a physical DC for 2 machines just to logon if they ever have to power up/reboot. In short - 1 box for physical DC, backup management and storage and finally cluster witness. Ow and before anyone's comment on backups on the box they are also pushed to Wasabi on a 30 day immutable GFS setup with a 5 year retention. *Taps brain and smiles* [emoji1] 45 minute full cluster backup, 10 minutes self backup (with C drive only as D is backup storage) and then lastly 22 minutes to upload it all to the cloud.

Previous people have already mentioned but it's SharePoint Admin or bust but that's more for high level admins like yourself as it gives access to everything! This is a simple case of use Teams and assignments and train staff and students on how to use the different avenues of Office365 properly. The problem with this though is that it's not your responsibility as IT to be teaching them how to use Office 365, that's the SLT through CPD and training sessions and even then people still need to learn a bit themselves as Office365 is so big. I have the exact same issue at my place. They needed to start using SharePoint, Teams, OneDrive etc... because they went iPads but no-one knew what to do. I showed a small handful of people the basics and drew the line at that. Yes I set it all up and manage it, no I am not a teacher nor am paid to teach adults how to use it. My school provide some CPD sessions for staff with the little knowledge they have and muddle their way through but overall do not confidently use it all. The government made a push 2 years ago for all schools to have a digital strategy leader and majority of schools tacked it onto an existing SLT member so not to pay for someone that knew what they were doing or promote a network manager to SLT so... Yeah...

Security, ease of use, integration, to name a few. Sounds like a system you yourself will have little to no dealings with outside of MIS integration (probably through Wonde) and Office365 SSO if you use Office365. I can think of about 10 platforms off the top of my head but how good they are etc... not a clue as it's not something I personally use. Let them choose one (which they probably have already) and just integrate it. I love these sorts of meetings, I just sit there staring into space until I need to say "who's the integrating middle man, Wonde or GroupCall" and "do you want sso with your school logon". Half the time the school / departments just buy a software and then setup logons manually and just ask me to do the sync, I usually sit and laugh for a few days as people non-stop forget passwords and eventually the academic person managing it gets annoyed and calls me to setup SSO [emoji23] P.S. by software I mean online web portal, everything is Azure web based nowadays.

Ideally it would be a physical DC so you could also boot up the cluster properly after a full shutdown and all the FQDN's can resolve.

We don't run BYOD so we have full control over all our kit. They cannot install VPN's. As for packet inspection the Unifi firewall is pretty good and should be able to show you devices using VPN's as it wont be able to identify the traffic. Just looked at mine and its showing me devices using OpenVPN which are our own devices in the IT office if that's any help to you. Had the Fortress released sooner I would of brought that but I am still very happy with the UDM Pro Max thus far.

Patch number 30113

How do you usually update your cluster? Do you have CAU on? I learnt very early on with Windows clustering that completely disabling and removing the CAU config was the right move. I update my cluster servers manually every half term by pausing a node via PowerShell (failing over roles and VM's), pausing storage sync, patching a server, unpausing storage sync and then unpausing the node. Wait for the cluster to re-sync fully and then repeat for the other node. This method has never steered me wrong in the last 5 years since migrating from ESXi.

ESS had me monitor and record a log for weeks regarding this issue to the point they eventually agreed it was happening a stupid amount of times a day and shouldn't be. It was affecting registers and attendance marks and if users were not vigilant we had kids with no marks and caused loads of safeguarding issues. We then had to wait a further 8 weeks for a patch to be created which they just threw at me one day out the blue on an email and immediately closed the ticket. Looking at the SQL code before I ran the patch in it was 2 lines of code to ignore the deadlocks and looking at the release notes inside this SQL file was written by an outsourced company ESS use to write their patches now, no real surprise there! Anyways, it either fixed the issue or just ignores the errors now and doesn't crash the client so you could consider it a win. [emoji2369] If anything, the way the issue was handled left me with less love than I had before for them which wasn't much to begin with. In short - Raise a call with your SIMS support and escalate it straight away. I'll dig the patch number out tomorrow they sent me in case it's any help.

Just in-place upgraded from SQL 2014 to 2022 with no issues, didn't fancy rebuilding a new server with the amount of 3rd party apps, tools and custom tweaks to the server. No issues if done right [emoji106]

So we just got round to installing our new UDM Pro Max last week and wow! The initial setup was extremely easy, remapping ports so our primary WAN is on a 2.5gbE and 2x internal 10gb SFP DAC's. I was a little concerned with moving from a 3rd party router to Ubiquiti but all the networks in Unifi automatically switched to Unifi managed and created firewall rules allowing all networks communication with each other which made further setup easier. We have since implemented basic firewall and Nat rules with ease, a little learning was required for their terminology but with a little testing was easy to work out. Throughput is ridiculous and all our networks are performing much faster when it comes to inter-vlan communication which is over double from our old Sonicwall. We still have a fair few firewall rules to implement over the summer but it's more bulk work now rather than working out. For anyone considering a switch to the UDM Pro Max or Fortress (new firewall/router) I would highly recommend [emoji106]

Just go Ubiquiti. Cheap, simple and very efficient. If you ever had any doubts / concerns then their latest YouTube video will show you a large scale example Also just coming back from holiday I have seen Ubiquiti everywhere in 2 major airports, both UK and abroad. Makes me feel better everyday that I took the gamble years ago and their software/hardware just keeps on improving.

Leg,end! Of course, I didn't think of it as an extension as I saw it as more an add-on or even part of Edge as it doesn't sit in the extension area next to the address/search field but that makes sense now! Will give it a go tomorrow because of course I block all extensions and only allow ones I trust for users by ID.

Afternoon all, Does anyone have the Copilot button in their Edge browser for Work/School accounts in Edge? I have it against my home profile in Edge but not on my work profile and a few people have asked about it. Checked online and not finding any useful information on this when it comes to education tenants.

SIMS is dire at the moment... The Summer patch has really done a number on us. Ours is absolutely pooping the bed with deadlock errors and users being kicked out, possibly related to Next-Gen through SSM (Sims Service Manager) which I have currently got disabled as part of the testing. Third party apps have also caused issues due to the new attendance codes being pushed early and then not being ready. I have an absolute nightmare with it at the moment and am just going through the process of elimination. All this for £25k+ a year licensing and support, GREAT!

I ran the update and it picked something up initially. After that I've tried running again and its gives some sort of access permission error.