DavR

If you're syncing computers via AAD Connect, then they should be doing a hybrid domain join silently in the background. It happens by a Scheduled Task that runs in the background, and may not be immediate. Have a look in your AAD console and see if computer accounts have started appearing. If they've not, then it's the background AAD hybrid domain join that you need to look at. Fingers crossed you can find an answer on this that isn't a site wide rebuild!

We've had a lot of complaints over the years about sending comms as email attachments, as a lot of people will be reading this on their phones. We try to put the message in the body of the email, with PDF attachments only when it's unavoidable. Word docs are a definite no-no. We've had conversations about having a standardised style in email, including structured subject lines, etc. Tbh I don't think that's the biggest problem with school comms, and I don't think enforcing style rules is going to happen unless you've got someone senior who really cares about making that the case.

Is that the free ChromeOS Professional that they're currently offering free? https://chromeoscertification.com/chromeos-administrator I really should, but there are several areas of study in there that I've not touched in my basic use of the admin console.

You could try creating a conditional access policy now, even if you only scope it to include one dummy user. Conditional access should trump Security Defaults in precedence, so might stop them being enforced on you. The fact that it's trying to enforce those, though, says maybe some part of Microsoft isn't happy with your current security settings.

Unless they replace it with something else, it is still relevant for those not using conditional MFA. I was using it right up til recently when I created our conditional access policies. We didn't have the licensing for conditional until very recently. Agreed though - it's very confusing essentially running two different MFA systems!

If it's certain computers that OneDrive won't SSO on, then yes I would echo the hybrid join theory. Hybrid AAD join is defo required for computers. If it's certain user accounts, might need to check that the UPN is definitely correct. Possibly also you might need email address in the email field in AD, although that could just be a requirement for Outlook.

My understanding is that, when you use Conditional Access MFA policies, this page gets overridden. It's normal to see these saying disabled, even though they are covered by Conditional MFA.

I'm not aware of there being a report that shows which users have or haven't signed up to MFA, but, if you go into Azure Portal and look at the users through there, it will show who has a phone number registered to their account (assuming you haven't pre-filled this yourself, and that phone number is the primary MFA you're using).

Yeah, we've got WhatsApp groups that are semi-official for parents of each class. It's not something we're looking at taking further, though. We can see WhatsApp fatigue becoming a thing in the next few years, and we have had incidents where these groups, being somewhat out of our control, have backfired. I'm sure you've looked around at the competition, but there are a number of different home-school comms apps out there already. I wouldn't say there was one particular market leader, though, from schools we've spoken to. I'm open to PMs, time permitting, as this is something that's been discussed here fairly recently.

I can't speak for other schools, but our process for adopting a new technology is all based around a Data Protection Impact Assessment of the new technology. This should be completed before any data is shared. Each school will do their own, but they will all be based around what data is shared, where it is stored and what security protections the vendor has in place. All schools should be doing a DPIA before any new data processing activity. From my experience, most comms tools are pull only, they don't write anything back to the MIS. Certainly with some MIS (eg RM Integris), write back isn't actually possible.

There are a couple of options in this thread from a few years back Would ye olde Windows Movie Maker do for you, or is that far too simplistic?

+1 for the MIS link. If you want to get school techs and admin onside, then you will want your product to populate contact details for the child directly from the MIS, with the minimum of faff for the school admin staff. As well as the obvious name and contact details, you'll be wanting to look at exporting whether the contact has parental responsibility for the child, and their priority. Some mailouts, schools want to go to Parent 1 only, some to all with parental responsibility. If you don't want to look at working with the APIs of all the different MIS systems, using a data transfer mechanism like Wonde might be an idea. To share some of our experience, the problem hasn't necessarily been the emailing tool we use, that's been OK. For us the barrier we face is that parents aren't responding well to the volume of email we send - we get complaints that it's too much, and know that some people just plain do not read bulk email any more. Email fatigue is a very real thing these days. We're considering changing the medium we use to contact parents to an app such as Parent Hub or Class Dojo, a single place specifically for school comms.

We have a generic supply account for one-day supply teachers, with limited access. I can see the argument for only named accounts, but in this scenario is just not practical.

I think our old telephone system had a power input like that, which connected directly to a UPS. Couldn't tell you whether that was running AC or DC, though the fact it was coming from a battery could have meant DC. Ultimately though, that's only going to be any real use to you if you've got a comms room equipped with a DC supply at the correct voltage. Without that, you'd be looking at buying a AC/DC converter, by which point, you might as well have got a switch with two AC supplies.

Thanks for that - just used this method to verify our status. We're still Basic Can't see a link to it anywhere else in the UI though. Weird that this change is only showing for certain customers. Maybe they're introducing it gradually.

I just remove the user, here. If people try and contact them, they'll get an unknown mailbox error. Depends where your retention policies sit when it comes to ex-staff, really.

Similar capabilities, but I'm a fan of https://www.ilovepdf.com/ suite, and often recommend it to staff with simple PDF tweaking needs. With my DP head on though, never use free web tools with confidential documents, as you are potentially sharing with a third party.

I applaud the high ambition of getting lunch and exercise into a lunchbreak. Or indeed, either of the two. It's sandwich at the desk here, has been for years. I've tried to get into a lunchbreak routine where I at least take half an hour away from my desk, but frankly, there's nowhere that attractive to spend it here.

Great, nice easy one!

I'm not sure I entirely follow your usage, but, the way we do it here is to block the Students group from logging on to certain workstations. This is in GP under Computer | Windows Settings | Security Settings | Local Policies | User Rights Assignment | Deny log on locally. We then apply this GPO to only the workstation we want. Under the same page is 'Allow logon locally' which can be used to specify a list of who can log on to the workstation. I've not used it myself, though.

Anyone else getting bombarded daily with spam about Connect @ BETT? For a tech-based show, their lack of an unsubscribe option is kinda annoying. I'm not sure I'm going this year, and even if I was, I'd be browsing not meeting, so I don't want to fill in their form to match me with companies.

Is this text correct? Only, Msiexec.exe doesn't exist in C:\Windows, it lives in C:\Windows\System32 on Windows 10. When calling msiexec from a startup script, I usually either call directly msiexec (no .exe), or with the path, %WINDIR%\System32\MsiExec.exe. Perhaps try one of those other options and see if it makes a difference. When scripts don't run in my experience, it's because they either cannot find the file your calling, or cannot access it. My money's on the former.

Sounds like a loop, to me. Unpatch chunks of your network in turn, until the high latency stops. A healthy wired network shouldn't see more than a few ms at a time on ping responses. Maybe strip it down to just your device, one switch, your servers and the Internet connection, and see what performance is like then, and build back up from there.

When it's wired up to the switch, can you ping the call bell system? I'd assume not given no lights, but you never know. If the call bell box is portable, can you take it to the switch and hang it straight out of port 3 on the switch, thereby bypassing the wall cabling and patches? If the call bell box is not portable, do you have a switch or mini switch you can connect it to, just to see if you get port lights on that? Just trying to narrow down whether its the call bell box, cabling, or the switch that's misbehaving.

Last time we bought some, we got quotes from Highgate IT and Academia (formerly Toucan). In my experience, there doesn't tend to be much price difference on the iPads themselves, the deciding factor tends to be the accessories and storage/charging solutions. It doesn't need to be an education-specific supplier, but it's a lot easier to do things like Apple ADE (formerly DEP) through an enterprise supplier, as opposed to retail.