DavR

We use WhatsApp to parents for one small group. It runs from a dedicated school mobile, and parents "consent" to being part of the scheme by adding the school contact first. I doubt it would work at scale, and I'm keen to be rid of it for all the reasons @paulkerton outlines above. But it was signed off by our DPO.

That's interesting. I've just read that this update is basically to renew some expiring certificates, which reads to me like a courtesy update so old devices don't brick on certain functions. Begs the question - when does an update count as a security update? Does that update include the last three years of security vulnerabilities, or just those certificate updates?

Slightly different scenario here, but same desired outcome. We have Redstor installed on our Hyper-V host, we backup all our production VMs from the host side, but I exclude my testing VMs from the backup. In short though, yes, we exclude the VM, and then go into the file structure and exclude the Virtual Disks as well. The actual VM files that are just GUID numbers I don't bother excluding, because those aren't big enough to make much difference.

August 2005.... At which point I'd done two years working in the industry, and it was the summer I left home for the Big City. I started here September 2015.

I don't think there's any gotchas off the top of my head, but, you'll want to be careful with DHCP and DNS. I'd recommend, as well as putting a trust in place, you also put secondary DNS zones from each domain onto the other. OldDC --> Primary DNS DomainA, Secondary DNS DomainB NewDC --> Primary DNS DomainB, Secondary DNS DomainA You can then configure your DHCP server to hand out both domain's DNS servers, and then everything should be able to see each other.

I'd probably go for option 1, create a new domain. Like you say, less likely to be problematic, and it's a good chance to lose any baggage you may have in the existing domain. Do you have the option of maybe moving all devices and users over in the school holidays, eg, Easter break? Get it all done in one go. The other option of course is to take this moment to drop active directory completely, and go fully cloud based with Intune. But I know that's not for everyone.

Filtering (and monitoring) got an explicit mention in Keeping Children Safe in Education (KCSIE) a few years ago. If it's in KCSIE, that's gospel, and you either do it, or prepare a very good reason why you didn't. It remains to be seen whether anyone marks our homework on Digital Standards, but I guess yeah it stands to reason Cybersecurity would be the next step on the roadmap.

Up to you how much risk you're willing to accept, and what they're being used for. We're still running iOS 12 on the main network, because we just don't have the budget / they aren't high enough priority for replacement. We only use them for infants web browsing and maths games mostly. They're going in the next year or so, hopefully. If you wanted to do it properly, you could put them on their own VLAN / SSID with no access back to the main network to minimise the risk.

I got one of those from an event a while back, and couldn't figure it out. I was looking the thing over, gave it an experimental press.... yeah, right in the eyes 😂 I'd like to say that taught me, but doubtless I'll do it again one day.

We bought Parago asset labels a few years ago (we were thinking of buying into the asset management system, but we never did). They're the type that crumble before they'll pick off, so they never fully come off unless the picker is very determined. That does our asset tags. Anything else, I write on with permanent marker or paint pen. Rubs off a bit over time, but otherwise takes white spirit or similar solvent to remove. There are some areas I still use Dymo labels, but they do get picked at, or just fall off of their own accord, so they're not so reliable.

Who was handing out the toolkits? That's a top draw freebie! Almost regretting not going this year. Almost. I'll be back next year when I need some new socks 😁

Whilst I agree this is a sensible approach in principle, in the case of Notebook LM, Google explicitly state they don't use your data to train their models - https://workspace.google.com/products/notebooklm/ I think this is the same for Gemini, as long as you're using the Education licensed version. The regular version does use your data though.

I thought NotebookLM was included as a core product in all Google Education suites (i.e., already free), unless I've missed something? It's on Education Fundamentals at least, which is the free version.

Restarting Network Location Awareness service resolves it, too. It tends to happen if the server can't see a DC during start up, even sometimes if it's the DC itself (annoying!). I have restart NLA as a scheduled task once a week now, just in case.

For what it's worth, I've got our MDT TS for this to 1) copy AutoPilot profile into C:\Windows and then 2) Delete Unattend.xml and reboot to the OOBE screen. There's also a batch file that clears up some leftover temp folders from the TS. It's not a particularly dignified way of ending the TS and going to OOBE, but it's what the blogs I based our TS on at the time recommended.

Just a thought, but, what is the firewall status on your DCs and/or DHCP servers? Under Control Panel | Network and Sharing Centre, you'll see your NICs and what firewall profile they've got - Domain, Private, or Public. I've had spates of these over the years where Network Location Awareness picks up Public profile after a reboot, which then applies Public firewall, instead of Domain. As a result only certain services work from that server. If your scope is split between two servers, that might indicate why some devices are picking up IP correctly and some not.

Thanks to this thread, I am now aware of the new 2030 deadline for the first six standards. I'm not sure whether to thank this forum for keeping me abreast of the changes, or damning it for the pile of extra workload that just landed 😂 Better I hear it from you guys than Ofsted in four years time, I guess!

This is probably the approach they we'll be taking I think - have Copilot and Gemini configured and available for anything involving personal data, but allow ChatGPT with strict guidance. In fairness, from a survey we did, most staff do seem to be quite switched on to the data protection risks, but that's only what people will admit to on a survey.

Is there an increased demand for upgrades, though? Apart from the regular monthly security update, most Microsoft server OSes get 10 years support. Last time I did a server upgrade a few years back, I put in Server 2022, and that's got support til 2031. I'm still very much of the opinion fresh install and migrate every time. Even with workstations, I rebuild rather than upgrade when I roll out a new OS version (although I realise that is a bit of a luxury), it prevents so many of those niggling faults that come with OS age.

Oh, absolutely brand recognition - taking what they've seen and heard elsewhere, and applying it to the school setting. I also remember how painfully difficult it was to get staff to let go of Zoom, and use Google Meet or Teams, for a good year or two, which is why I was wary of wasting my time doing the same with AI tools 😂 But the very good points made about confidentiality and closed systems have convinced me that getting Copilot and Gemini set up and pushing people towards that is both desirable, and necessary. We only have the basics Google subscription, but must admin I'm more inclined towards Gemini than Copilot, probably because I've seen Gemini demonstrated, and, not had it rammed down my throat like Microsoft have been doing with Gemini. I just want to access my Office programs, guys..... But yes, NotebookLM looks interesting too, I like the idea of creating your own limited knowledge base, rather than using the whole LLM data. Time will tell if that's something I could sell to others.

Good point re Grok et al, given current controversies. I think I might progress from allowing the AI category (staff only) to allowing the Selected AI Tools bundle (staff only) sooner, rather than later. Just to be on the safe side. In the finest traditions of IT, it will also highlight if anyone is using something outside the approved list of AI products, as they'll shout that it's been blocked 😉

I see what you mean with the select AI bundle (we're an LGfL school too). We currently have the AI category allowed for staff only, but we'll be locking it down a bit when we've made our choices and set our policy. That bundle may prove useful in future.

Do you have a link to the LGfL suggested list? Or do you just mean those that are allowed through the web filtering by default? Interestingly I've found some evidence of LGfL doing a pilot using Teach Mate, but, whilst the videos are still up on their YouTube channel, the article on their website has been removed. The videos have only had a few views in two years, so I'm guessing that didn't get too far 😕

There is - I've just sent it to our Ops Manager to see if she's interested.

Useful to know, thanks! I think the moment has passed on that one, but, in case anyone asks again.