ITGuyWestMidlands

If your Windows devices are hybrid Azure joined then sign ins will appear in the Azure audit logs

Stick them on their own vlan perhaps. Printers are chatters.

I'd ask your MSP to open it for a specific subnet. Waste of resources tbh, inspecting guest traffic

Just change the default Gateway that DHCP is dishing out to the new router.

This is the correct way to deal with this, bur ensure all other users aren't able to write to that folder too

Not with NPS, but you can with freeradius

Have a look into Dreamspark

Trouble with CCTV is that the traffic is normally lt udp. If it were tcp, you could use permit tcp any any established to only allow traffic that is in response to an established tcp connection from another VLAN. Obviously you can restrict the destination VLAN to just your work station vlan as needed.

For analysis. So much to be learnt from doing analysis on electronic versions. I.e repeat offender's, issues with certain staff, dangerous areas. Also, from a GDPR perspective, easier for data retention management.

PupilAsset or Bromcom perhaps?

Typically broadcast domains. But, many solutions offer broadcast restrictions on the APs, which only allow them when and where they are needed.

How does this work please? Does each site have a VPN link to the cloud XG?

If you have wireless windows devices, ideally, you should have a PKI for your wireless authentication

dont use ubiquiti at the core, but a good solution at the edge with a spare in the cupboard. Look at Aruba modular switches for the core if doing inter-vlan routing

You should look at splitting it up futher with VLANs, especially for your phones, wireless devices and CCTV. No reason to to go bigger to factor in growth.