DavR

I would comply with what they've asked, as this is a reasonable request. But also raise it with someone, in writing, that a situation exists where this is not being reciprocated, and that there is CCTV equipment that only the site manager can access, contrary to policy. I'd probably raise it with the security consultant in the first instance, because if they're worth their salt, they should take that on board. If not, escalate the matter. Re access logs, up to you whether you whistleblow on that one. Can you prove there aren't any? I'd say that's the site manager's problem, myself. Doesn't sound like a situation anybody would be too keen to resolve tbh (IT problems never are, to management). Flag it, in writing, so if there's ever a problem, you're in the clear.

We managed to get a Mac Mini M2 for under £400 earlier this year. It was six months old and open box, but for our needs (pretty much just iPad management) that was more than enough. Worth asking what your suppliers can lay their hands on. I spent a few years running ours off a Hackintosh, which was OK, but I always lived in fear of it breaking. An up to date basic Mac is a legitimate business need.

Same, bundled with LGfL. We got given X number of licenses, but as we're a big school wangled a couple more. No idea what pricing is like as a commercial product, though. Do you have Office 365 A3 or above? Might be worth looking at the inbuilt mail encryption in that, if Egress is looking too costly. Alternatively, you could ask a reseller if they can offer you a price (we use Millgate for our licensing generally).

Are you sure you want to muck about with soldering/attaching wires to a new battery, when you can buy them pre-fitted? Most laptop CMOS batteries I've replaced you can buy the battery with wires connected as one piece, ready to plug in to the mobo. For example, I think this is the one for the Stone NT310-H - https://www.ebay.co.uk/itm/186588826995

Just an FYI on the Crusader robust headphones, and the ear cushions coming off. You can buy spares of these, to replace them if and when they get lost, but I found we never lost that many. We've had a set of these ourselves for maybe 5+ years, and it's only been this last summer that I've audited them and found a lot of failures. Five years is bloody good for a set of headphones IMO (just about to order a new set of 32 @ £330 + VAT).

Now you say that, I think I had that problem myself in Google Drive last week. When browsing to the Google Drive page, I hit a landing page that didn't include my Shared Drives, even though I could see Shared Drive files in my recent files. Refreshed the page, and Shared Drives as a section came back. Just a thought!

How many connections are your HDMI cables going through, and are you confident they're good quality cables? We have our HDMI runs cabled through trunking and into a wall plate etc, which works fine most of the time, but, we have had difficulties with losing the picture in the past. Point to point with one cable was usually fine, but the cable runs + wall port connectors + fly leads caused problems. We resolved this in the end by replacing the trunked cable runs with better quality cable. A good way of testing is running just a single cable, screen to PC, and see if that works better for you.

Could it be that the shared drive/s have become hidden for those users? We get that occasionally. Easy enough to unhide them when you know how, though - https://support.google.com/a/users/answer/13015138?hl=en#zippy=%2Clearn-how

We run a scheduled task via GPO as well, but, we don't run ours til 9pm for the above reason. Bit of a shame to leave so many workstations running for up to 2hrs/day extra, but trying to change or exclude devices for evening events was just too much extra complication.

You might find this thread really helpful on the point of restoring the account - https://techcommunity.microsoft.com/t5/security-compliance-and-identity/convert-on-prem-ad-users-from-office-365-azure-ad-to-in-cloud/m-p/42908 If you restore via PowerShell, you'll have the option to scrub out the ImmutableID (ie, the GUID is uses to match with on-prem AD) using Get-MsolUser -ReturnDeletedUsers | Set-MsolUser -ImmutableId "" so there's less chance of it matching when you re-introduce the local AD account. You may also want to check whether your AD sync is set to soft match, or hard match, in Azure - https://www.linkedin.com/pulse/syncing-on-premises-active-directory-azure-ad-guide-ashkon-yasseri-tpgmc. If soft match is on, that could be matching and linking the accounts, despite you not wanting them too, due to name etc being the same. Hard match, on the other hand, should only link accounts where the sync GUID matches.

IIRC, you can't do bulk account creation and management using the free version (as you might expect). Not sure if there's a process available if you're paying for a business license.

Publisher End of Life is in October 2026 - https://support.microsoft.com/en-gb/office/microsoft-publisher-will-no-longer-be-supported-after-october-2026-ee6302a2-4bc7-4841-babf-8e9be3acbfd7

Yep, PDF is a good backup to have, especially if the design doesn't need to be changed. I'm assuming there will still be plenty of Publisher-to-PDF convertors online after Publisher retires, but, I'd rather not put too much faith in them re Data Protection.

Yup, that should do it! Not sure if it needs to be Initial sync or if Delta would do it, but either way, job done.

I always had Canva down more for presentations, than desktop publishing? Affinity Publisher might be worth a go, though - is this something you're installing on your desktops by default?

We've got gobs of stuff on Publisher here, teachers love it. I've never been fond of it, but then, I've never had the same design needs as our teachers. I went up to Office 2021 this summer to avoid the forthcoming Office 2019 EOL. Will be holding on to this until summer 2026, and then that'll be the end of Publisher! I've already warned our lot once, but will run more warnings from next September. Hopefully, being the last year, teachers can convert stuff as they need it. I wonder if anyone will release a decent Publisher reader/converter in the interim? What have everyone else been recommending as an alternative? I've been saying Word and PowerPoint, but neither are really a replacement.

I don't think I've had your exact problem, but, the key thing when it comes to matching Azure AD with local AD accounts is the object, or matching, GUID. This is a unique string that matches the online with the local accounts. Break that, and you should break the link between the two accounts. Most modern implementations will be using the AD attribute ms-Ds-Consistency-Guid to link the two, some older implementations used ObjectGuid. The quick and dirty way to break the link is to remove this attribute in local AD, although I'm not sure whether that removes it from the AAD side. Another way is to move the local AD account to a folder that isn't sync'd with AAD, run a full sync, make any changes you need, then move it back to the sync'd folder. I think that resets the GUIDs.

I still create a base image for our iPads, and roll it out via Apple Configurator. I *think* I made this change in the base image before rolling out the last batch of devices. In theory this process is now obsolete, but, there are just a couple of settings that it catches that can't be done any other way.

Reckon I could take or leave this idea, but, I'd be first in the queue if they brought back the original flavour beans and sausages! The Richmond ones just don't quite cut it the same.

Ditto if you're hoping to run any VMs on this server in this config.... even when just running VMs for testing, it's advised to have host OS on one physical disk/array, and guest VMs on another, due to the intensive read/writes. Sorry, probably not what you want to hear when sounds like you're in a disaster recovery scenario!

What are your RAID settings? Even if you're just using a single disk (not recommended due to redundancy and performance), the server likely has a RAID card in, which is sat between the motherboard and the hard disk. My understanding is that you'd need to create a volume on that array, for the RAID card to offer to the motherboard as a disk, before you can install an OS. Even if that RAID volume is just RAID0 using the single disk. You could be connecting direct to the motherboard, but that would be an unusual config for a server.

That's usually meant dead mainboards for us. Like many others, we've lost a lot of Lenovo's that way. What's your make and model, out of interest?

What's your RAID config? Usually I'd expect drives to be set up as part of a RAID array, and then Windows to install on a volume on the array, rather than be installing direct to a single disk. In this instance, you may need to point Windows installer to a driver for your RAID array (or you used to have to, don't think I've needed to last few servers I've done).

If it's prompting them to login, but SSO succeeds after that, I wonder if it's getting the login username correctly? IIRC, we needed to have the user's email address, in the email field in users AD account, before OneDrive would sign in silently.

You may well have already checked this, but do you have fast user switching enabled? If you've got multiple users logged on to a workstation with limited resources, that's gonna max out your memory quite quickly.