CyBeRkId2002

Hi all, As the title, are there any Independent Schools out there using Bromcom as their MIS, and if so how have you got around the quite glaring issues of Fee Billing. I am led to believe it is possible but I just can't understand how My findings so far are: Bromcom (and Arbor for that matter) do not generate Fee Invoices inside the MIS - quite understandably as they are not targeting (or quite ready for) the Independent sector as it stands. The only fit for purpose Financial Management system that does the billing process (working out how much to invoice based on parental relationships, discounts etc.) inside the finance package, rather than the MIS, is PASS Finance PASS Finance have a manual import facility which is fairly complex (as it understandably needs to be) which will be prone to failure if anything on the MIS reporting or PASS import changes (unlikely but possible). The larger issue is that... As we use Admissions+ (I believe) to collect Direct Debit details and Bromcom / Arbor do not have anywhere to store the information then some kind of matching is going to be needed between all three systems prior to import to get this into PASS Finance. This means almost constantly as we all know details change over time. This makes it, in my eyes, almost infeasible. I am just curious if anyone has got around this huge hurdle as we would like to at least investigate Bromcom as an option.

We have had a few users recently working on different computers around the school and files not syncing well. They are typically non-Microsoft Files (text and html is the Biggie) and I am fairly sure it is due to logging off too quickly before the file has synced (I suspect pupils may be clicking log-out, potentially with files saved but still open, or possibly not saved and relying on the "Do you want to save this file" prompt). This means files sometimes do not sync, and sometimes they create duplicates (with the computers file names) Other than user education is there anything we can do to minimise this? We are early in moving to OneDrive as our primary storage and think issues like this could hinder progress

We are currently considering Unifi wireless (among others) and I wondered if anyone had any recommendations on how to streamline the adoption process of Unifi Access Points across VLANs. At present we have Unifi Controller running on a VM in a VLAN (lets say VLAN5), with the aim of having all access points on the same VLAN. What options do I have for streamlining the process so I can plug the AP into ANY switch port and have it ready for adoption? So far my thinking is: Manually configure switch ports for the correct VLAN. This is what I have done historically and would like to avoid it if possible. Use LLDP to dynamically assign the VLAN on the switchport. I am not 100% whether our current switch supports this and, more importantly, if memory serves me correctly - at least on the older AP's - they pickup their IP before the VLAN has changed and refuse to switch over when it has Add a second virtual network card to the VM on the default VLAN. This would allow devices to see the controller as soon as they connect to the default VLAN. It could then be changed by defining the Mgmt Vlan in Unifi Have I missed any options? Can you setup any kind of Pointer / Forwarder on the default VLAN so it can find it on an alternate VLAN?

Thanks all for the responses - extremely useful to know that this approach (whilst far from ideal) is feasible although ideally will be targeting a 2-3 week window.

Thanks very much for all the responses! All really useful. Doesn't seem to be a standout so going to have to look at all options very carefully indeed.

We are currently in the early phase of my investigating a WiFi replacement and am considering the option of doing this in house. I will be going ahead with consultancy initially, but imagine it is going to advise (as most are one AP per classroom etc.). The cost of this using one of the big brands (Meraki, Ruckus etc.) is going to be huge and being a fan of Unifi (and particularly their cost and licensing model) I wondered two things: If we decide to go in-house the major issue is going to be time for a rollout. We are looking at 100 or so APs, some of which are awkwardly located and lots of which need new cable runs. This leads to the question of time to carry this out! Is such a thing as a phased WiFi switch even feasible where we work round the building replacing within a 3-6 month period. If we match SSID and settings are their going to be issues with roaming between two entirely different network infrastructures? Secondly, does anyone have an recommendations of companies who install Unifi and will carry out a site survey. Thanks in advance, Michael

As the title really. Been through the procurement process with a state school, but the complications of finance / fees seem to limit the field significantly. If anyone could briefly offer up what you are using, what finance system (if separate) and a brief summary are whether you are happy it would be much appreciated.

Now sorted, thank you! We were on the latest firmware - but then they released another. This resolved the situation! Thanks for the reply.

oooo. That is clever! My only question - if Android does check Google at connection (as I suspect) would the new flow not be as below: Android Connects to Network -> Android Checks in with Google -> Request gets re-routed to forcesafesearch.google.com -> Response comes from forcesafesearch.google.com -> Android checks cert Whilst this will match, I will still need to disable SSL on forcesafesearch will I not for it to skip the MitM, which goes back to the original issue.

With Google excluded it works - but like I say this is best avoided if possible. I am, however, starting to think it is impossible unless anyone can advise otherwise.

I was actually just going to post a very similar question - but thought I may as well tag on here. Has anyone managed to get Android devices working without the 'No Internet / Limited Connectivity' warnings whilst retaining SSL Inspection. I am starting to think it is impossible. So far I have: * Tried adding connectivitycheck.gstatic.com to our SSL Exceptions * Tried adding https://www.google.com/generate_204 to SSL Exceptions (although I can't be 100% certain this is working correctly) I strongly expect that Google is making a request to Google and using certificate pinning. As such I think it is impossible to not get this message - although would love to hear if others have got this working! If not I suppose our only options (particularly for BYOD devices are): * Not decrypt Google (and in turn not see search activity which I feel is a major safeguarding risk) * Advise pupils to click 'Stay connected' and carry on about their business. Not ideal, and something I would like to avoid, but better than not monitoring sufficiently

Morning all, I wondered if anyone had any understanding of the Papercut MF authentication process? We are having major issues where people are suddenly unable to print. The issue often resolves itself, but after hours in most cases. I am struggling to spot a pattern on what causes the issue, and our print supplier have also struggled to track down the issue. When it occurs: User logs into Papercut MF on the device absolutely fine User can print anything sent from the computer When they need other functions (scan / copy) they select the department and are presented with a 'Cannot authenticate' error (seems to not load the built-in functions) If anyone has a deep understanding of what authentication takes place here, and where I can start looking for troubleshooting, it would be very much appreciated!

Hi all, thanks for the replies... Lee - Have booked a 15 minute meeting with you Monday to just check we are heading along the right lines, especially as we are likely to be moving to yourselves when our current connectivity contract expires!

Morning all, We currently use a Sophos XG for both Firewall & Filtering roles. We are strongly considering a move to a cloud based filtering platform (Securly) and finding the cost for the Sophos - when just doing Firewall duties, to be a bit expensive. On the flip-side I don't want to skimp and it needs to be secure and fit for purpose. I wondered what people are using and the key features to look out for Fast VLAN Routing Seemless authentication - could be client, agent on server etc. We do use RADIUS but currently only for Wireless devices 2 Sites - one has approx 1000 devices at any one time, the other possibly 300. Both have 1gb Fibre Redundancy Provider with Secure VPN Connection that has not been subject to many CVE's (I'm thinking Fortigate). This isn't something we use at present but will likely consider in the near future. Have been looking at a pair of Dream Machine Pro Max for both sites but open to any other recommendations that people have used and found works well.

Apologies. It is AQA we are use! Sorry for the confusion. @mavhc - Issue rolling out with VSC is largely around the number of pre-requisites, and their difficulty to get running in a shared user environment or pushed out systematically. My understanding is that: GHCUP is needed to install the language compiler, Code Runner is needed to run within the IDE, if pushing out GHCUP using a software deployment method it will only install the PATH variable to the local user Lots and lots of hurdles to try and get it working. I know nothing about any of the others above but I suspect they may be a no-go as the teacher has to have some level of understanding of the language, which leads me back to my original question... Has anyone managed to get it working?

Morning all, As part of the OCR A-Level spec students are supposed to have experience in coding in Haskell. I know there used to be a full package with IDE, but think this has now been abandoned. I have been trying to get this working in Visual Studio Code for about a week now (along with a way of easily deploying) but have been hitting wall after wall. I wondered if anyone had deployed this in a classroom environment and if so whether you could share your experience and tips. Thanks, Michael

You say UK keyboard... do they come with the covers? If so we could be very interested. Will drop you a message Monday.

Does anyone have any updates on this. We are using Sophos and excluding sydney.bing.com does work and enable the feature - but unsure on the implications of this.

Hi all, Sure I have done this in the past but for the life of me I can't get it configured now!!! Looking to implement user level Power Management policy that achieves the below: Staff accounts are locked after 10 minutes inactivity (already implemented with screen saver) and then device should go to sleep Exam / Presentation Accounts do not sleep and / or do not prompt for password on wake. I am sure I have implemented similar before, but now it seems no matter what I put in the user area, only the computer settings take effect. Closest I have got is set an hour long sleep / screen lock on the device and secure accounts using screensaver settings - but I am sure I have done better than this in the past! Has anyone done similar? Where am I going wrong. Spent a whole afternoon on this!

Hi all, Just a quick question that hopefully someone can confirm. We are looking at moving away from the legacy MFA setup (enabling and enforcing on each user) to conditional access. Am I right in thinking that if we have a Conditional Access rule to not require on internal addresses, but the user has the legacy 'Enforced' setting, it will still prompt them for MFA and that I will need to go through and change these all to enabled to function correctly. It certainly seems to be the case, but just wanted to check in case their is something obvious I have missed in my testing. Cheers, Michael

First time using SIMS in about 5 years... I am the new IT Manager and none of the remaining team have carried out a SIMS update so far (all fairly new in post). Only info I have is that the Spring patch definitely hasn't been run yet, and nobody thinks the Autumn update was run. Looking on SOLUS there are LOADS of releases / patches on there and I am lost on which to apply! Even if Autumn 2023 hasn't been applied can I just approve SIMS / FMS DB and Full Releases? Will this get us up to date? What about Statutory Return Filesets? Do I need to run all of these? How do I find out what I am missing? Finally Patches... do I need to run the missing ones? Or is that included in the latest DB update file? What backups do you like to take first? I will be running a VEEAM backup immediately before. Is that sufficient or do you take one from SQL Mgmt Studio? Any other tips to make this go as smooth as possible greatly appreciated.

No, as far as I can tell they are not processed to a print queue at all.

Yes - absolutely. And have been struggling with this on and off for a while! Have you found a fix? I have been wondering if it is a filtering issue (we use Sophos), driver issue or papercut issue. I will give papercut a ring this afternoon and see if there is anything they can recommend.

Really quick question. I have taken over at a school that has a Sophos XG in place. AD integration works pulling users and groups through, but the firewall won't setup an NTLM connection with the server. I have spent some time troubleshooting, but just can't get it to setup the link. I suspect it is to do with the computer account created in AD so over half-term I would like to re-establish the link from scratch. My plan is: Remove the connection to the AD Server from authentication sources Delete the AD server from the Sophos Remove the firewalls computer account from AD Setup the authentication server from scratch in the Sophos and hope it creates again in AD Change the user account used for the join to a non-domain admin for security purposes Sounds fairly straightforward... Any pitfalls I need to be aware of?

Looking for the most seamless way to setup RADIUS at a school I have just started working at. From research I need: PEAP and msChap - is that correct? I would prefer not to setup a PKI infrastructure and / or have to disable certificate validation on clients. In this scenario I believe I need a public cert. Are there any guides on this, does the internal DNS name of the server need to be the same as our FQDN (guessing the cert issuer needs to validate it somehow). if so how do we go about achieving this instead of it using it's internal name. Which suppliers issue NPS valid certs for Radius Any help for the best, hands off approach, would be greatly appreciated.