AlanD

The puffin academy app is probably save to use - as that only allows users to a selected list of sites. And its free.... But yes, it would be good if education city, mymaths, and others stopped using flash and did everything with HTML 5.

Yes backups are "ESSENTIAL"...probably the only essential thing. More important than having any working service (but that won't be understood by management) Losing records, and data would be - well a sackable offence in my books. Windows server backup (you have to "add it" but you don't need install disks) - works fine - well better than fine really. In fact so well I'm not sure anyone justifies the cost of other backup solutions....and together with a couple of large 8 to 10TB hard disks with a USB to SATA connector.

Make sure SLT understand the that you can't work miracles. By failing to oversee a proper handover they have been negligent - possibly because they don't understand the issues involved. An Audit needs to be done asap. Ages, dates, versions of servers and client PCs, switches and wireless. Windows 7 and 2008R2 support ends at the end of 2019 - which means you need to have a plan in place to replace any of those - probably over next summer. I'd be working with RM - at least in the short term. I know they get a lot of bad press (and I'm responsible for some of it)...but their CC4 product is a good one (even if it did have troubles in the early days). Its worth at least half a technician. Don't try to manage an RM network by using AD and GPOs. This is often a serious mistake made by network managers who don't understand how RM works - and then get really frustrated with GPO and script changes don't deliver what they expect - and they blame it on RM. RM is a safe, solid product.....yes with irritating limitations.

Yes there are MDM solutions for iOS...for "enterprise" management...including Apple's "free" Configurator and Profile Manager. The trouble is...that these tools are essentially after thoughts - applied to a device that was originally designed for one user. The moment you start wanting to share that device in a school the gotchas creep out of hiding. To start with when a user has logged onto something (Office 365, or email) inevitably they forget to logout...and the next user has access to their files and emails. You can use things like Apple's Classroom manager...but you need to allocated 2 or maybe 4GB of iPad space to each user. That means 16GB devices are unusable , and even 32GB can be a problem - especially when you start adding the dozen or more apps teachers requires. And you don't get free updates forever - only as long as Apple keeps releasing them for that device - and there are lots of ipads in schools stuck on iOS 9.4 because it Apple chose not to support older devices....which in turn means that some apps won't sun on them (usually the ones you would like to have). No; I agree Android is no better on these fronts.

I'm always a bit concerned when I hear "We need ipads….or wifi….or laptops....one to one scheme...or " I always think these things need to be driven by what you want students to achieve....and hopefully that is ICT skills...and programming skills... And the OP indicates that browsing and "coding" is required. And while any device could manage browsing I'd want to explore carefully which apps are available to achieve "coding" - and if they are better served with one platform rather than another. Are you going to run Office365 apps - or google - or do you really want the iOS suite? Are you happy with the way they run on the device you are thinking about. Keep the focus on what you want to achieve and what you need to put in place for that to happen (and it will probably include training and support for staff....unless you simply want to hand devices out for a playtime session in class....with students spending more time creating backdrop images and customising the device than doing any IT focussed task. Undoubtedly you could get numerically more Android devices than ipad ones.....which is worth something....and don't forget ongoing costs of a management MDM solution...and repairs/replacements.

Have you disabled IPv6 in Win 10?

I'd be trying to get the ac wave 2 ones - ideally the HD pros....as a longer term investment....The Nano HD would seem to be a good idea - but I'm not sure you can actually get them. No point in vesting in yesterday's standards. You'll be glad you made the choice in 5 years' time....when there is even less money around and you are still trying to make do with less.

How are you setting the proxy? If you are setting a browser proxy - possibly with a GPO - that isn't necessarily picked up by anything else (JAVA is a case in point - which has its own separate configuration). Setting it via DHCP with an option pointing to WPAD (if you have a webserver somewhere to host this...) tends to be more successful with dome devices and applications.

How about just using MS office One Note....just the kind of things its designed for...and works everywhere...on everything....

Onedrive does not "really" store your data in that path....and typically doesn't work well in shared PC environments because each user that logs onto that computer would have to wait for file sync to complete. The "on Demand" variant is better for this.... You could try a script that does a SUBST command to create - say an O: drive that points to that folder.

VPN access? You mean you are going to allow any PC at home riddled with ransomware and viruses to access your school network directly? I presume you already have a job offer at another school you are ready to move to. Maybe...and only maybe....if you have a fully locked down staff laptop where the user cannot install or run executables or scripts (maybe an RM network) ...then I might consider allowing a VPN connection to school. Why not use O365 (or google filestream) as your means for providing user storage?

Are you talking about the old (...really old) serial cables..? Surely they just use USB cables....or at least ours do....

Usually staff require “freeze” so that they can use pc for other stuff while display remains on board. They can do much the same by using “extend” rather than “duplicate” screen mode ..assuming you drive monitor and screen with separate vga/dvi/hdmi outputs. But you would need to give some training etc

So...do these troublesome PCs have a smoothwall https certificate installers? You would need authentication exceptions to sophos cloud or to whatever else is getting blocked...because updates and the like will run as service account not as a user account.

or on eBay ...

WiFi is typically not a replacement for a wired suite of computers. Don't be taken in the suppliers/advertised claims of gigabit WiFi…..that is only going to happen in an isolated barn with no surrounding WiFi...where you can use 80 or 160MHz wide channels...and all the clients are multistream...and possibly support MU-MIMO. Typically - even the latest WiFi kit in a dense school environment is going to deliver somewhere between 100 and 200Mb/s to a client. And its not going to deliver those speeds simultaneously to all clients - but shared between those clients. And if your wireless clients are not multi stream, MU_MIMO and don't support "ac" then speeds will be worse. Expect 10 minutes for a class to logon - possibly more. Note the "connection" speed you see, and often quoted is UDP not TCP..and assumes perfect spatial separation of streams - which in the real world only gives a 25% or 50% uplift at best. And because wireless is a medium with packet collision detection - the efficiency falls off pretty rapidly when you have more than around 15 clients. In a dense environment "ac" rarely offers any significant increase over "n" because of being restricted to narrow channels (to reduce co-channel interference and the size of the collision domain). 35 BYOD tablets would be no problem for WiFi…. 35 PCs...a nightmare....

...Office 365 SSO can be done without any cost...ever since AD Azure Connect replaced Dir sync (which is free....). (needs to be on something later than 2008R2 for SSO to work). Google SSO - perhaps you can't do that for three...but you can certainly sync users, passwords and groups for free with GADs and GAPs. Salamader is doing what MIS systems should be doing as part of their role....without buying an extra product. I particularly like their sync of timetables into outlook calendar.

I’m sure Ubiquiti works fine..even really well in lots of schools. And It would high on my list of choices. But I would buying a couple, or several Ubiquiti access points to test in your particular area...and getting some loan kit from ruckus, meraki, Aerohive or whatever in that real world situation. Never take anyone else word for it. Check it out yourself. And that includes suppliers as well as users.

We experimented with providing a network link to the projector’s “remote” page...with the projectors on their own vlan via a smoothwall rule that only allowed staff access to that vlan.

Yes 11.4 here too. Far to mean to pay the massive annual costs for later versions.

The issue is not whether it is safe....the issue is with "does it comply with GDPR?" And allowing any Tom/Dick/Harry access which may allow them to see personal data on your systems is almost certainly not allowed. You might not give them access to a SIMS logon - but if the can simply copy a database and the data isn't encrypted it has the potential for a data breech. In practice...of course - you are going to have to give some access to allow them to get the job done...but I think these days you would probably need to show close supervision and monitoring to prevent such a breech. It's likely - that the current breech that BA experienced was "external contractors" working on their web sites leaving in place something which allowed an easy hack. External access by companies is always going present a GDPR risk - especially if they have administration rights...

Yep - fibre modules are prone to failure - especially the genuine badged high price ones. Buy a cheap Chinese one for £10 and it will last for ever (or seems to - for our netgear switches).

I have always used netgear, despite the bad press given to them (usually by those who won't buy anything unless its badges Cisco or HP...a bit like those who only buy NIKE trainers). When one (and its only been one for the last 20 years) failed a firmware upgrade and bricked it self - and phone call to netgear instantly had them promising to send out another by courier for next day. In the end - with their guidance I updated the boot code and the firmware sprung into life, but knowing they really deliver to customers without hassle when things go wrong made a permanent customer out of me. (But yes, they are a bit noisy, and no they are not quite as fast as some switches in terms of packet throughout. And buy the cheap £10 fibre modules - much better than the badges £100+ netgear ones). And if I started again I'd be looking at Ubiquiti, because their price/performance makes them worthy of a good look....and their web interface alone is wake up call for those stuck in the past insisting that command line programming is the only way to go. I'd also look at ZYXEL. Don't expect suppliers to be rushing to you with the cheaper options - which they will rubbish - because their margin is going to be much smaller.

I wouldn't be allowing any external devices to connect directly on my domain network. Well..not unless that devices was essentially locked down - and they couldn't install programs ...but even then there would be a serious risk of malware and/or ransomware infections It would belong as a BYOD device - on a separate VLAN ...and if you are not already using cloud storage for files - I'd be looking at smoething like HAP to access files via a web interface. And I'm not sure where you would stand with licences for program taken off site. A site licence...is a site licence....not an off-site licence. If you have Volume licence agreements with Microsoft you can add the "365" bits to allow students to download and use office 365.

SQL will always use ALL the available RAM. It should release it as other tasks and processes make demands... I think I would have make 16GB the lowest limit...possibly even 32GB. Then I would check what routine maintenance tasks are set up is SQL manager. Particularly after the year end roll - I'd want to make sure it had run things re-index and tidy of data files. That can make a significant difference.