DrCheese

£3.1k a year is nuts. We may have loads of endpoints, but we don't reimage *that* much. May have to force myself to carry on with getting OSDCloud to work how we need it.

That seems useless tho as you can still screenshot/save media & access the image files direct/in cache. It's similar to those old "Right click disabled!!" things websites used to do... This is also a bit of a weird one as by uploading images into Ai to hide them from other Ai, it's being uploaded to Ai in the first place.. (Catch 22!)

Yes, I will not comply with giving my ID to access services. It's a *massive* overreach of state control dressed up as protecting children. I don't care what safeguards they pretend to come up with, it *will* be abused & harm free speech. Data will leak, like it already has. It's quite difficult for me to avoid getting super political about this... (Which is banned on here :P) Unsure what this means for us tho - Will we will be able to mark all Adult GSuite accounts as over 16 to access YouTube, to show videos that aren't set as Youtube Kids, but are educationally relevant? I can see a massive pushback if staff had to do it for themselves.

This is it for me, Something's wrong, or I need to push out a change. I can just do it, test in real time & have it done. Intune I have made a change one evening, forcefully tried to sync a laptop in front of me. Get annoyed that it doesn't apply & go to bed. Wake up & it's applied. I just can't work like that, it's maddening. Only other way to "Force" it is to rebuild a device. Yuck.

Fixed it for you 😛

Hah, since I replied to this last we've had two contracts with Kyocera. Devices are fine, engineers are great. I've had to kick off once or twice about parts taking a long time to arrive, or toner levels falling too far without enough stock on site, but no supplier I've ever had has got that bit right. Both contracts have been under frameworks - I can not stress enough how important this is, as a previous non framework company tried to stitch us up at the end of the contract - Completely blocked behaviour in the frameworks.

I wouldn't too much weight into a piece of paper/policy document. Some places have lengthy policy documents, but no real actual auditing/proof they follow them. Others have small ones, but do a metric ton of work/other things that aren't listed.

I asked this recently - Cost was £3,500. It was just as a backup option I strongly agree with what others in this thread have said tho - It's not worth it. On our Bromcom demo site, we did a fresh import from Nova T6 into Bromcom as a test on our final day & it just causes big headaches, that would have required a metric ton of work to fix & even then, would not have been perfect. Because of this, I've banned our timetabler from doing a Nova-T import into the live version & our plan is to use Bromcom native for timetabling for the next academic year. Drag them, kicking and screaming into the modern age

I don’t understand the logic for not filtering staff & locking down the device as normal at home. They are *work* devices; not personal playabout ones. Tell them to buy their own device. It’s not the 90s anymore, laptops aren’t a luxury. I have seen it before in other schools where they weren’t filtered/treat like a normal device and they were riddled with pirated downloaded movies, family photos and games for their kids. You can’t meet the DFE or cyber security guidelines this way. Then you have the inevitable guilt if the laptop breaks and you have to reimage/wipe out photos. It causes a ton more work for what reason? If a staff member downloads adult content on the work device and it then comes up at work, IT will be asked why it occurred in the first place. Honestly, save yourself and the organisation the hassle of having to deal with the mess. Keep it simple, work devices are work. Home devices are home.

This recent reddit thread sums up a lot of how I feel about Intune https://old.reddit.com/r/sysadmin/comments/1tvks8e/intune_is_not_fit_for_purpose/ It's just... rubbish.

Aye exactly. Also, said parent is perfectly free to buy their child a seperate non school device if they don't wish for the monitoring. I say the same to staff. No one really minds if staff use their work device for odd browsing at home, but they need to be aware that whatever they do may be filtered/monitored. If they are unhappy with this, then they should buy a personal device. I am massively pro Internet freedom when it comes to personal devices, but work/school devices are fair game.

Yes - We have all school owned devices fully filtered & monitored when on or offsite. Logic is, we provided them. Doesn't matter how you word any home use contract, the moment a student accesses inapproriate material on a school owned device you will be held responbile. If the worse happened and a student was groomed, you would have provided that device to allow that. If you are happy to defend that then fair enough, but it wasn't something we was prepared to accept. We do this even on laptops that in theory are owned by the student, eg ones provided by the virtual school or LAC funding. When they leave, we do a reset on them and they then take them from there.

Yes, this is what I can't understand. MS have built intune ON WINDOWS primarily for 1:1, because that's how they function. In their world, shared PCs aren't really a thing. So it doesn't matter if changes aren't instant, they'll hit the user eventually & then it's done But even tho, not being able to whack out changes quickly is incredibly painful. For starters, it makes testing & refining a config really painful/long. I'm sure we've all sat in GPO before, rebooted/relogged a PC to watch our changes hit. Intune you sometimes have to wait for hours, even if you try to force it. It's just stupid - As you say, iOS is instant. Google can do it also with Chromebooks (Those are a thing of beauty) & sending a command will apply straight away. I discovered all these issues people have said above in 2020 when we rolled out our lockdown laptops with it. I held off doing it on our normal PCs back then, hoping all this would improve but it really hasn't - It's still a hot pile of garbage. That they haven't fixed Machine level NPS yet is also insane (How you can't have an intune only device join a local WiFi network with NPS)

I found this as well. Got the SMB team who said they could help me & quoted me some devices. I wanted a different model & was told I could only purchase if I was in education. Which er.. given my email address and email signature showed that I was. Was then passed over to the education team & didn't get anywhere, even after chasing a few times. Ended up going to a reseller for other kit instead. It's really annoying - One of the best things about Dell is you can work directly with them & easily configure/purchase kit via their premier stuff. Lenovo you go on their website & everything is forever listed as out of stock or you get bounced around. The kit is great, but the sales experience isn't.

We have a few Airtames for this in our conference room & SMT. Good little devices, but admittedly quite pricy. Classrooms are hard wired.

Looks like some of these are being exploited in the wild

We have NetXMS, which is free. It can send email/telegram/teams message for alerts. Also have all the "Entra ADDS Health connect" stuff installed & Entra will automatically send alerts if it detects a problem with your AD, including internet outages (Sync failures)

Um... sounds a bit salesy - Brand new poster sings the praises about an Ai model. It's just a ChatGPT reskin, with a whole load of prewritten personality about UK schools added in before the prompt.

I wouldn't allow this to be installed, as it can be setup to allow unattended access. We do allow TeamviewQS (Quick support) to be ran when needed, but this needs admin rights so users have to contact us first before it works. (& Applocker stops users running .exe's we don't know about)

Remember - SARs only have to be reasonable searches. To search the data in SIMS you'd need to pay up for a new contract, which would be unreasonable. You can't release what you don't have access to.

ICT Direct are great, enabled me to refresh a whole bunch of non Windows 11 computers that aren't "High Prority" for very little. Kit was/is in great condition as well.

Ah, we gave notice on schoolcloud and went to school booking, which syncs to bromcom via group call. Needed a bit more than what bromcom had built in. https://www.schoolbooking.com/

Discovered this last week - What a pain! Access is Access, not Edit or Save in the IT world. Why Bromcom counts "Access" as these despite having seperate permissions is beyond me. I want staff to be able to view a group, but not screw it up/rename it.

It's always bugged me that staff accounts aren't automatically linked via SSO. When we first rolled it out we had to send instructions to staff on how to link. Such a pain in the backside and aye, same with students. We gave up and made a power automate that emails students lost PINs but they should just be SSO'd

Only way we managed to block these was to push uBlock out to Edge. Has been working for 2 or so years now, but aware that eventually MS will kill off old style extensions like Google did with Chrome. I genuniely do not understand why schools can't just buy Youtube Premium through Gsuite. Darn Google.