AlanD

The trouble when a student forgets (apparently) their password - is that they have to invent a new one almost instantly....and they do this badly ...with no system in their mind....and while they might remember it for a few minutes - remembering it the next day is almost impossible for them.

...I'd want to know if anyone and been meddling either before - or after things went wrong. Nothing worse than "have a go jo" moving a few cables around before you get there...because that might make me change my strategy..and be more inclined to disconnect everything..and reconnect things once I knew they were working...Sometimes it can be an errant switch or even PC somewhere else more remote from the cabinet. We had a PC that somehow was managing to take out a whole building until it was turned off.

For all "domain" computers - I would use Active Directory Authentication....I do use AD authentication. Can't see the merit of IDEX for these devices. Remember you will need a certificate on all the PCs (via GPO or whatever) otherwise smoothwall can't see https traffic. For BYOD devices - I recommend using smoothwall as a radius and DHCP server for the wireless newtwork. This allows users to do a 802.11x logon to wireless and smoothwall knows who they are from that first moment of connection without pop up screens or whatever....In fact...Apps don't generally open a browser window which you would have to do otherwise. For school wireless devices (not on domain) ....well a captive portal with a timeout set to something less than the length of a lesson is probably the best way to go. You should understand all the options and pros and cons...becuase smoothwall installers don't necessarily understand your environment - so you need to think it out before hand.

...must say...I am enjoying this drawn out saga.....

I think you are onto something here. I'd like to see - well at least parents (if not schools) - always having permission to see and read all social media of students under 16... And perhaps school should be able to see anything posted during the school day...by law. I think pupils do need monitoring and guidance...and to be taken to task over what they post...and both schools and parents have a role to play. Social Media companies need to think hard about how this can be achieved...without waiting for governments (which are always behind the curve on everything from tax evasion to waste disposal) to catch up and enforce something they might not like.

I, for one, possibly the only one, have never understood the addiction that some network managers have for hardware warranty. When the manufacturer's warranty runs out on my car..I don't make any effort to extend the warranty. In fact...as you would find out should you ever need something repairing while its under warranty...the list of exceptions ...and allowance for "wear and tear"....rarely means they give you new for old on anything. The original warranty on my servers run out years ago....but even if I had extended them...the best it would provide is someone on come on site to tell me what I already knew...."sorry the main board has failed". Would they replace that....almost certainly not, because the boards ceased to be made in the year following the server purchase...and what stocks there were have long gone. Yes...they would offer me the cost of the new board against a new server replacement...and no the processors and memory could not be transferred to a new board - because all the new boards are a different socket type. And lets face it...its not rocket science to run up a new HyperV server box (or VMware if you must) and reconnect it to a SAN to get all your virtual servers back. And even if you had to pay for an engineer for a day - I bet it wouldn't be the annual cost of warranty for just one of your servers. Now there may be an argument for a small primary school with limited budgets to struggle to unexpectedly find the cost for a new server - and so they might choose to pay a warranty cost (although...as I describe...they are still likely to end up paying for a replacement,,,because no warranty offers new of old on servers...). But for larger schools ...it needs to be covered by a general reserve and the Bursar/accounts staff need to understand this risk....which statistically is always going to work out in your favour. And warranty just to cover the things that are likely to fail....like RAID drives certainly aren't worth it....much cheaper to buy a spare drive ready for the moment one fails. And same goes for Power supplies - and I've only seen one of a pair of server power supplies fail in in a server in a period over 30 years - and never a server motherboard. Yes - inclusive warranty on a new product is a nice bonus if you are not paying extra for it....but extending your warranty doesn't somehow prevent a server breaking down....nor prevent the disruption its going to cause you - and that is the "real cost" or a failure... Often school spend money on these products...and fail to replace the batteries in their 3 year old UPS...so a power outage causes the hard disks to corrupt....or become careless about allowing staff connect via VPN/remote desktop from ransomware infected home computers....or bringing in infected pen sticks only to discover that their latest virus update doesn't protect them against that strain. Server failure (hardware wise) is unlikely - very unlikely if you ignore hard disks and power supplies....certainly not worth paying warranty for....

...when you say repair.....what do you mean....the controller has gone/failed? (easy to replace...but you will need to pay SMART for one)....but if you have damaged the board itself...I'd be surprised if that was possible to repair. (We have canablised old small 600 boards - one of which had surface damage...the other other displaced by a much larger board.....and put their controllers onto board that failed....in our case ...it was a water leak which damaged the controller...) Always worth checking you have the latest formware...as some of the early firmware doesn't allows allow proper calibration of the boards

1 GB... no SSD. .... is not going to run windows well....in fact its going to run badly...Yes you could upgrade 1GB to 2GB (well...guessing you could)...and you could put SSD in place of the hard drive...so for a £100 each ...you get then them running Windows 7 .. which is fast approaching end of life.... and Windows 10 would struggle with only 2GB - or certainly would if you were using 64bit version..and you probably wouldn't want to run AV on them because that can be a surprising impact on old PCs....and not running AV wouldn't be advisable either. And I'm guessing wireless is single stream "n" ...so thats going to be slow too. But you have to ask yourself whether its money well invested...to get something running...that still isn't going to run well....especially when £200 might get you something much better - albeit something refurbished....

Oh...I'm interested and curious about this. "Transparent" filtering - as I understood it - simply means there is no need to direct your web traffic to a proxy...although there may be (and probably is a transparent proxy in line). But I don't understand how such a filter could possibly see "google searches"...or youtube...or any kind of https traffic for that matter without a certificate installed on devices (which might be pushed out automatically to desktops...but has to be a manual process for devices). The only other means of filtering would be DNS filtering....which still wouldn't let you see the traffic - but you might redirect it to a blocked page. Can anyone else confirm that filtering is possible in this "transparent" way without a certificate ... and if so ...how does it work?

I think I am correct in saying that MicroLibrarian is now owned by Capita. And such companies hoover up sources of cash - like Microlibrian - and invest very little in the way of development and support...and as customers fall away they make up for the shortfall by increasing charges. Users are often reluctant to move away - or at least in the short term - (because change costs money - if only in terms of effort and time) and so such services provide a great source of revenue for their grossly overpaid and numerous directors.

I think I'm correct in saying that you need RM unify (to provide user identity) in addition to the broadband service itself. And RM unify isn't cheap with annual charges and setup charges. And if you use wireless - say for staff - I'd be interested to know how well it works with personalised Apps - like social media ones...and whether it works at all with Android 8 (as that won't allow intermediate certificates to inspect https traffic).

There may well be safety issues with WiFi. Often quoted is the Stewart Report...which looked "only" at heating effects of wireless radiation and concluded there was no significant evidence of danger associated withy it. But....and wait for it..... it specifically excluded results from young children - because there were unexplained "outlayers" in the results...and so the conclusion was that it was safe for adults ...and the unwritten bit implied that it might not be safe for young children....and I think mobile phone suppliers still carry warnings about this in their small print. There are some the query the potential of danger from the electromagnet effects of the wireless...but there has never been any significant evidence of this....but then there has been limited research too...because much of the research is/was funded by wireless vendors themselves (a bit like when health effects of smoking was carried out by those that the made cigarettes)...so there is scope for concern, and there are clearly lots of concerns about low level exposures to lots of things....diesel and petrol fumes, tyre wear, etc ...which although seemingly tiny amount to significant long term problems. The reality is (and perhaps this shouldn't be an excuse) is that its almost impossible to avoid wireless...from other peoples WiFi, Other phones as you walk down the street, etc. I doubt whether having wireless in the classroom adds significantly to the exposure...and like smoking ...there is a no evidence to suggest more exposure means more risk...in fact if there is evidence it is that any exposure can offer risk.

Sharing iPads, or any kind of tablet is not going to work well. They are not designed as multi user devices...and while there are tools and facilities to allow a number of users to share a particular device (such as family members at home) they are less than ideal in school. If a student uses an app and either logs on to a service (google or O365) the next student picking up the device may well end up with access to delete all that data without having to logon. And data stored locally in an app is even more vulnerable. Yes, there are activities, often web based, which work fine when sharing...but once you start using apps the problems with keeping data secure becomes critical. Tablets are essentially “personal”devices. And I thing I’d be using a £150 Android Samsung tablet before considering iPads....not least all because I could buy a lot more. And I’d you are using Apps, or intend to use apple’s classroom feature to share iPad use, go for units with lots of memory..at least 32Gb...otherwise once 5 or 6 users have used the tablet you find there is no memory left.

We are an RM school, and therefore use their Portico product. Cant help but think the best long term solution is only allow one Drive both in and out of school. Remote Desktop access is known to be very vulnerable to attack from external compromised PCs.

If it’s a new build ...I would want to certain that there are two cat6 ...or better...cables to the centre of every ceiling of every classroom....and if you are going to use 4x4 stream ac2 devices...and I can’t see why you wouldn’t remember that 802.11af POE isn’t going to allow the to fully work...you need swtiches that will deliver 802.11at.

Yes, You might be allowed to buy an iTunes...but I’m almost certain you can’t play them to a group of students useless you buy additional rights...I think there are licences schools can register for... and you need to record each an every use of a track.

Glad you said this, because I was thinking the same. Better to use a single SSID and use AD radius to allocate radio profiles accordingly. Yes, maybe a second one, for guests or testing....but the significant impact of broadcasting SSIDs needs to be really pruned back.

Words of wisdom here...and I concur with them, in That filtering for tablets...android or iOS ....And allowing access to a range of apps...and it’s not just social media ones....is to many practical purposes..impractical. Or at least not if you want to achieve even a basic level of monitoring which it would seem schools are required to do. As gshaw says by the time you have included a long list of exceptions and bypasses including access to potentially unmoderated sites where various apps turn to store their content you may as well not bother with a web filter for mobile devices. And by the time Android 8 arrives which I’m told won’t even allow a MITM certificate...what little visibility sophisticated, lightspeed, and smoothwall provide will be closed off.

Apple’s own MDM, confusingly called “profile manager” is probably the way to go. I’m told it works ...and it’s free. No it probably doesn’t have all the bells and whistles of other MDM solutions like Meraki...which by the way is no longer free at all...or at least not for new implementations. We use configuration 2...which I have described as the worst piece of software ever....and I’ve seen a fair amount of rubbish. It’s fine for a clean install but as soon as you have a mixed bag of iPad connected up...well you will probably decide it’s easier to wipe everything and reinstall...which apart from anything else might take 2 days to complete. I keep meaning to set up profile manager..but I always end up in some cul de sac with some problem or other.

Well if I added up the money I spent on repairs and replacements it would not come to the amount I would have to spent on warranty cover....so unless you get a really good deal on a warranty I'd question its worth....and it certainly wouldn't make me stop using stuff if I couldn't extend its warranty - although I might start looking around and shopping for I might replace it with should there be a need to. Usually its just replacing a hard drive in a RAID, or maybe a power supply and network fibre adaptor - easily covered by keeping those items in stock for a lot less than a warranty.

To be honest, only you can evaluate your own needs based on size of school, numbers of PCs etc. We do have a 10g loop between 4 cabinets that make up our core switches. But if it was only 1Gb I very much doubt anyone would notice....not least of all because it’s really difficult to get 1Gb/s out of a SAN/ server ...unless you are largely SSD. We try to use 2x1gb/s LAGs between core and edge switches, not only to provide some overhead on bandwidth, but to provide some redundancy. And some of our old fibre runs ....really old...work just fine after getting them reterminated with new fibre tails welded on. I’m guessing lots of schools will eventually have 1Gb/s internet links in the not so distant future...some do now...so 1Gb/s links isn’t very future proofed... I think lots of schools have two Physical VMs to provide continuation of service should one fail, but the reality is that hardware failures are not that frequent, and VMs don’t protect against configuration problems...nor ransomware...should a one server solution fail, a new server can be on site and working within 24hiurs using VMs.

I’ve seen problems with lights in a room stopping a remote control working with a projector.

Well, these faults rarely get better by themselves. I’d be swapping the RAM chips...or if there is plenty, just unplug one strap at a time....then change Ssd...

Ive never quite understood why hardware warranties are taken up by schools. If a system board fails in a 3 year old SAN ...or a motherboard in a server, then you are not going get them replaced under a warranty..because even a year is a long time in the manufacturing process and no guarantor of warranties are hoarding and stocking spares. The best the warranty usually offers is the price of the failed component offset against a new, and often overpriced new replacement of a new server or SAN. Better to up the warranty money over the years, and on average you always come out on tops even if you do have the risk of an unexpected replacement one year. ..... but there is good chance you would end up paying most of that cost even if it’s in warranty...as there is no new for old policy if replacement parts can’t be sourced. In fact you are better off finding a replacement part of ebay or something. Yes, if they are offering 3 years warranty for free when new, it’s worth having, but when there is lots of kit in a school on average you are better off negotiating with management a contingency fund to cover unexpected failures.

I use CAE .... but I'm not convinced they understand the Microsoft licencing structure for schools...but then I often wonder if Microsoft understands them.