KK20

parentpay wanted to charge us (this was a couple of years ago). We said, please send a formal quote so that we can balance this cost vs implementing arborpay instead at the same time as we migrate to Arbor. Suddenly the costs were waived. We coudnt get round the Inventry charge.

i would see if you can shop around. Veeam might be expensive but it really does work well on a restore - physical, virtual, cloud. Our Redstor is great at restoring cloud, decent at restoring onsite files, tragic for bare metal. Veeam is great for all.

We have a couple of bodet harmonys boxes (SLT offices) that links to our bells. Start and finish "melody" on the bells.

I have ipv6 set up on all my servers but no DHCP scope. I use DHCP snooping so dont really mind what the clients are doing. We still have an public IPv4 for our external web internet services so I have had no reason to transition, although I do have a plan to enable ipv6 for public facing services should I need to.

I seem to remember the tinkercad site having an issue with certificate pinning. I needed to do something in Securly to let it through (not just in the student profile "allow") but I cannot remember now. Seems that whatever filtering you use has the same issue.

We got fed up with autodesk some time ago. Back in fusion 360 days of insane requirements to upgrade each version. Have been using onshape for education alongside tinkercad for yr7s. Works on chromebooks too.

Im talking about user experience and workflow. potentially: User opens PDF, user edits PDF, user saves PDF. Currently, for our users they open PDF, switch to examwritepad answer document, write answer, switch to PDF document, etc I was merely commenting that I can see the benefit of cutting out a switch. Not the end of the world of course but if it makes it easy for the candidate.

I can see the thinking behind this. Download a PDF exam paper, candidate then fills in the PDF exam paper (rather than switch backwards/forwards between paper and answer programs). We use Read&Write for electronic reader so it would be seamless to highlight, "read", then edit the PDF to write the answer.

what type of apps? legacy .NET framework forms apps have a much easier way of signing code with the older clickonce mechanisms, you can supply a code signing certificate and allow your signed apps via applocker. It is harder with Windows forms apps (later .NET) as you need to manually sign the EXE using signtool - this can be built into the projects as an "aftertarget" but this is quite manual and needs doing per project, also needs the PFX and password known to the user! We do this with a short date domain CA code signing cert installed on the machines and we only use legacy framework due to the PFX and password issue. It is on my list to look into this further.

we have a couple of generic agency account, they have conditional access for onsite logon only and a USB yubikey each. There is a sharepoint document library for "cover work" and the accounts have access to this sharepoint folder. Longer term agency get their own accounts. Yubi pin get changed when the sheet of paper wears out or gets lost (usually weekly). I was thinking about getting a token2 OTP card and burning them to an account (renaming the accounts if necessary), that will save changing yubi pins.

As often as a person loops back a cable. Nice to know it has been done as this doesn't affect the day to day running (as RTSP sorts it out) but you dont necessarily know it has been done. If students are messing about then other stuff has most likely happened in that class, keys being switched on keyboards etc. So I would rather get an alert for that, get it passed over to the behavioural team so that they can sort it out in a class. Ive also had a port flapping issue on a base unit picked up a few times, these stone AIO had NIC and WIFI, the NIC was misbehaving and flapping with the WIFI. Ive had a misconfigured AIO that was flapping and had internet sharing enabled, this naturally looped back with RTSP doing its nut, the AIO worked just fine but was a bit slow. Misconfigured software filling up logs on C:, UPS with a faulty fan. idrac talks nicely, ive had a faulty drive pick up via idrac forgetting that I also had a machine agent that did the same. I do have logic for our >10Gb links operating at 75% over a period of greater than 1 minute, if im hitting that level on my interconnects then there is an issue for us. Getting historical data on hypervisor and backupserver nic loads pinpointed a misconfiguration with SET (teaming) when everything appeared to be fine. Ironically enough, I dont bother with toner as the papercut alert worked so I didnt bother setting a sensor up for that.

100 sensors is not a lot. That wont cover more than a couple of VMs. I havent counted the number of sensors I use, one switch stack would be about 2000 I guess, multiply that out for a few switch stacks, then buildings, then sites. It adds up really quickly. I think our UPS eats about 40 alone with each battery bank having temperature, voltage, fans, load, runtime. Sure, if you wanted a basic "Im happy that the UPS is working" then you could only use a single sensor for "temperature" I guess, but I would probably want one for each battery bank so thats 6. Then for each VM maybe monitor disk space alone on one drive and have fancy logic for up/down. For switches it would be pointless really, they expose a lot of data. Printers are odd, the toshibas we use need a bit of logic across a few sensors as I only care about certain bits that papercut doesnt tell me (staples, waste toner and jams) but need a few sensors each.

i use librenms purely for automated alerts, I dont use the dashboard unless im chasing alerts. The alerts are a bit clunky to setup to begin with, but work well enough and have a decent logic path. I have it set up for disk space, network saturation on the switches, server status (memory pressure, cpu levels sustained over x time etc), port flaps, trapping RSTP events, the usual stuff. It is SNMP so fairly basic if you want detail and data as you are limited to what the devices or agents expose. Still, you can still get a lot of SNMP data from your monitored devices and as long as you are happy to add various logic strings to your alert monitors then it works well. The cost is your time. Any type of monitoring can get quite interesting, especially when you can drill down to your switch port throughputs and see what culprits use the most bandwidth. I was quite surprised by how chatty some clients are (naturally, without being misconfigured) and how efficient others can be (I was surprised how efficient hikvision CCTV cameras are compared to verkada).

A3/A5 are 1Tb per user I think. A1 is 100Gb though and yes, I suspect this will catch a few out. This is a tool that will look at quotas and license attached. Identify OneDrive Users Over License-Based Storage Quota | PnP Samples

We also put flex on our old DFE doorstops. The battery life surprised me the most, old Dells get a good 5 hours at least still. Sure, no apps, but not really an issue when you can add fake PWA "apps" keeping the browser cleaner.

are you running hybrid or are you fully cloud? The reason I say is that redirecting a desktop location is a matter of changing a registry entry, the issue is where to redirect them too. In a previous establishment, on the full cloud intune managed devices, I had a master script that would sort out "nuances that I used to perform with AD", one of which was a redirected desktop. This would be a local folder with read only NTFS rights (for the majority). The folder was kept up to date from an intune policy. Dont forget to set another registry entry to discount the desktop from KFR. No pushback from users because that is how things had always been done.

yes. very simple and worked just fine. I used it to migrate, I moved from redirected documents to KFR (sans desktop KFR as our students still have redirected desktop). Got a CSV from AD OUs and migrated pretty much year group at a time.

sounds like microsoft edge sync open tabs (and possibly sync history). If "open tabs" is enabled, if two machines are logged on, have the same edge profile, have edge open, then it stands to reason that the profiles will sync and tabs will open and close automatically since the profile will be synced.

do you use onedrive? Is that signed in ok? I had an activation issue with some staff members, their local profile was busted and onedrive couldnt sign in, this caused office to misbehave.

Just to be absolutely sure, you are creating a brand new domain that happens to have the same name as the old domain? If you are currently running 365 hybrid then you will need to hard link the accounts and mail enabled groups from your "new domain objects" to the existing 365 accounts/Mail enabled groups? You will have to wade through 365 machine accounts and possibly old group accounts. Keep us informed how you get on, this is a pretty gutsy undertaking.

Even easier if you dont use ".local" as you can just change a few local DNS entries.

Not really. All DCs have certificates, they have their own machine certificate. As long as the "thing that is doing the LDAPS" trusts that domain controller certificate(s), then LDAPS will work. A domain CA makes things easier because you can install the CA as a trusted root, so any certificate that is issued is trusted. For new "things" you will only need to trust the CA not "each server that needs to be trusted). Simplified of course, im not going into the merits of offline CA + subCA.

Before I go asking software resellers and getting sales spam, we are currently using older OVS-ES deviceOS+cals+office+365apps+intune1+entra1 . Looking at a new agreement later this year, so thinking A3 via Chest instead. I see that there is a staff count reconciliation date of 1st November, what happens if you get new staff after this (i.e. agreement is for 90EQU and at 1st Nov still 90EQU but in December 2 extra EQU join so now need 92 licenses)? Are there grace logons available or are you allowed to go over your assigned A3 "without loss of function" until 1st Nov rolls about again (i.e. will 365 admin portal let you go 92/90)? I've not been in a position where our allocated A1 or M365 are even close to xx/yy licenses so not had this issue. Is there a rough anecdotal "over XX EQU users is generally better to go Chest EES"? Can you still get MAK keys from MS for devices that don't have embedded licenses (we have a couple of small "has device sticker windows license but not an embedded one" appliances that do use windows such as digital signs)? Whilst we don't have any, I assume all windows logons will need to be 365 and not local logons (as i'm not sure how they could be licensed as a local logon unless said MAK key exists and an "honour" license)

Still hasnt changed for perpetual licenses it seems Use Chrome upgrades - Chrome Enterprise and Education Help Repair, repurpose, or retire ChromeOS devices - Chrome Enterprise and Education Help This is a shame if it has changed. I have never tried using a conditional license for flex, ive only ever used for a warranty repair and reprovision.

sometimes there is kit that has a decent amount of life left in them. We have a few dell precision laptops with Xeon E's in them - officially not supported in windows 11. Yet they are functionally identical (sans ECC) on i7-8700 s with 6 cores/12 threads and the 8700 are supported. So we run W11 on them anyway as technically unsupported (until the updates dont run due to being unsupported, then they will go in the bin). These laptops are just as quick as other more modern offerings and have much better screens (plus are built pretty well). I actually wonder if it is the iGPU that stopped the support for the Xeon Es, being workstation drivers.