KK20

I suspect they will be hiding behind https://www.gov.uk/guidance/copyright-licences-information-for-schools if they are eligible. The whole grey area of "playing a DVD but casting it to a class" is a different ballpark. Not withstanding the "im only playing a clip for curriculum based learning" (so not needing a licence anyway) or using VLC to chop a portion out and uploading it to clickview then linking to your VLE for a class etc etc. At the end of the day, we have MPLC alongside a reminder on inset day. That covers me at least.

run this Get-IntraOrganizationConnector |fl Name,TargetAddressDomains,DiscoveryEndpoint,Enabled if you get no error but also no response then your OATH is borked and the cause (this was our cause). To fix, run through this: https://docs.microsoft.com/en-us/exchange/configure-oauth-authentication-between-exchange-and-exchange-online-organizations-exchange-2013-help?redirectedfrom=MSDN run through it all and don't be tempted to cut corners.... we use hybrid 2016, ran through hybrid wizard without issue. No mailboxes have been migrated.

An odd one. I ran an SDS import for our teams following some set changes (Friday). I checked the teams admin panel and the old teacher had been removed, the new teacher was in the team and was an "owner", the old teacher was not listed at all (which is correct). The teacher had complained that they could not see the team. Still in the teams admin panel I added myself as an owner to the team (so now the admin panel states the usual "Microsoft.Azure.SyncFabric", the proper teacher and me as the owners) , 30 seconds later the team appeared in my user panel but when I "managed team" I could see me and the old teacher as owners. No mention of the new teacher. I got round this my flicking the new teacher settings from owner -> member -> owner in the admin panel. 30 seconds later this change replicated in the team and the old teacher disappeared. Any ideas? This happened for 6 of the teams for this teacher (same issue, old teacher remained as owner when looking as a user but all was correct in the admin panel), two other teams updated correctly (kicking the old teacher off and accepting this new teacher as the owner). I updated on Friday so there has been quite a length of time to sync, plus the manual changes were sync'd in less than a minute.

there arent many settings to select on the free tool. This is one example. Salamander pulls this as a header for school.csv: isams report pulls: The data in school.csv is also totally wrong as it ignores our preschool and JS - that is warned of though as it does say Salamander cannot extract that information. However, section.csv has even more changes in the header. Salamander: isams: The other CSVs are also slightly different in headings. I click UK headings for SalamanderSDS and use UK reports in isams. There isn't much else to configure in SalamanderSDS so I decided Salamander wasn't for me and carried on with manually SDS update. Ive had no issues with our teams, teachers and pupils use it, the teams seem to replicate all the changes I make.

No, I didn't bother as I would imagine the free tool support was at the bottom of the pile. I did request a quote for the paid Salamander but with the lead time in "months" it wouldn't be worth considering at the moment. I'm happy to continue manually exporting report and updating SDS when sets change or pupils start but was looking for alternatives. We are still "onsite" AD with sync and running hybrid onsite Exchange (with no migrations), no immediate plans to migrate these to the cloud.

I have always updated teams manually via the isams SDS reports and SDS portal import for our profile. This isnt too onerous a task as we arent a huge school with lots of changes. Looking forwards, I would like to automate this. I know of the Salamander SDS tool but this has never worked for me correctly, the CSV that it generates via isams API dont even look like the CSV generated by isams manually (which do work). Are there any other players out there apart from Salamander that automate SDS from isams? I know I could call on the isams API and probably write a few scripts to generate the data, then call the SDS powershell but I would prefer a more robust solution! I looked at ruler connect but they are SIMS only I think.

do you have OEM licenses on the base units? It cost us much less than £50 for core desktop EES - those are only windows upgrade licenses though, you need something on the unit to begin with. This will sort all your CALs, windows, office for your base units, then all you need are your server licenses, exchange, SQL, and external connectors etc and you are ready to rock and roll. I would also make sure you get all your queries and responses is writing. It sounds like a disaster waiting to happen (from an audit point of view).

yes. I went P2V with: 1x domain controller, 1x file server, 1x exchange server, 1x SQL server and 1x web server. All worked turnkey short of having to reassign IP addresses. All were windows 2012 at the time and I simply used windows backup/restore. I backed up via inbuilt server backup, shutdown each machine (not the only DC on the network, I retained the other DC as physical), restored the backup as a VM with identical disk sizes, booted up VM, changed IP and everything worked. Dont forget that your DC doesnt want to get its time from the host, make sure you are using NTP. Once I had virtualised, I then went about migrating services on each server as I would when decomissioning them. It should also be noted that I have inplace upgraded all servers except exchange and DC - those two were migrated as appropriate.

We use the USER Windows Components/Store/Turn off the Store application, this leaves the icon but gives the user an "admin block" screen when clicked on. We also enabled Turn off the offer to update to the latest version of Windows for good measure. Customise APPLOCKER for locking down (or allowing) upwanted apps.

We teach small basic (pretty much VB), it is a very good starting language - this and basic HTML is the staple of first and second year. Python is next after small basic for advanced second year and rest of third. Option block is computer science with python and c#. Dont forget that .VBS scripting is VB at its heart and substantially faster (and lower boot cost) than .ps1 scripts. Flash is used on a number of resources but we only use chrome flash with all the click to allow set as default - this is to show teachers it is on its way out, hence a hassle. Java is not used by any teacher resource, we have some old iDRAC that use JAVA that is about it. I think netgear has an app that uses flash too.

An odd one. We have used our start menu customisation as long as I can remember. Ive even contributed the the giant thread on the subject with our working XML. However, this all stopped this week and I have no idea why. Nothing has changed on our end but I do have a fix. This is the current working bare bones XML we use: Pretty simple and has worked for years. Since the middle of this week though, if a user tries to log on with this layout, then they lose access to the start button (doesnt work at all) and the event log shows: After a lot of wrangling, checking GPO, checking permissions, killing profiles, recreating start menu customisation I narrowed it down to the setting LayoutCustomizationRestrictionType="OnlySpecifiedGroups" , if I remove that line then all is well but users can no longer pin their own customisations to their start menus. Machines are 1909, ADMX is 1909, local policies up to date. The GPO actually copies this XML on bootup to a local folder and the GPO uses the local copy (stops the server copy being locked for editing) so I can change this really easily. It is reproduce-able on all our machines. Has anyone else had similar issues? Any idea on how to get LayoutCustomizationRestrictionType="OnlySpecifiedGroups" working again?

ADFS was simply the MS guide I used at the time (ADFS has been running for some time but not really used - I set up ADFS initially as a login for our adobe products, oh the irony). I'm happy to hybrid but do not want to move fully into azure AD only at this time - I want to remain "onsite" for some time yet. Thank you for the advice.

Im within touching distance of getting this working but something is amiss. ADFS with WAP set up. Office 365 A1 plan only. First of all, I can SSO to office 365 if I use a domain hint with https://office.portal.com?domain_hint=domain.co.uk If I use https://office.portal.com then I get asked to provide sign in details (domain email only, I never need to provide a password), the email is enough to get me past the SSO. External to our domain then obviously our ADFS page is presented where I need to provide the password. How can I avoid the request for sign in details so that I dont need to use a domain hint? I ask this as I plan to leverage office 365 logons for other SSOs? I want to avoid launching https://office.portal.com?domain_hint=domain.co.uk at startup if possible (seems a bit of a hacky solution). This behaviour is the same in Chrome, Edge and IE11 (I added WIASupportedUserAgents for other browsers)

Just wondering if anyone else has had support on go slow this last week? I've have one ticket go "missing" from my support portal from mid last week and the resubmission is still being queued for attention. All I am asking for is batch API keys - the control panel now errors when I try to raise some.

Ive been given a nod to Panda. Ive used the free version of family PCs but dont have much in the way of other experience with them . Was advised to look at their adaptive 360 as that covers ingress and egress spam (we currently throttle policy egress and recipients our students as a precaution for compromised accounts) but also endpoint. Price point is slightly cheaper than Sophos for us. Any experience with Panda? Am also looking at VIPRE currently too.

Its primarily the anti spam im looking for (puremessage has really let us down and the support has fallen pretty short of acceptable) and we aren't going to move to office 365, on premises will be the order of the day here.

After having a very bad time with sophos support we are looking to move away from sophos. We have an on premises exchange 2016 server and we use a pfsense with snort firewall. Im not necessarily looking for a UTM as the cost tends to increase somewhat. I am looking for either a combined AV/antispam solution (that would remove sophose enterprise managed clients completely) or an antispam solution (just for the exchange server). Ideally I would like an inbound and outbound (thinking to combat compromised accounts). Currently we simply tarpit and throttle/ratelimit student accounts via exchange. We have no plans to move to office 365 and will retain on premises for some time to come. we are not a large volume site and have approximately 800 mailboxes for 500 users (old users legitimately retained, email enabled service accounts, make up the extra) Any ideas from you good folk?

in the past, if we used GPP then we found that printers would add sequentially and if a printer wasn't available the logon would slow down. Using our venerable W7 .vbs script this would not be the case and logon would progress whether the printer was on or offline. GPP meant we would rarely get missing printers, script meant we would occasionally get missing printers. So we scrapped GPP and use the script method; In the end we simply put a shortcut to our universal printer .vbs on the desktop - users would double click the shortcut to get printers if they were missing (and this would work every time). Our printers are mapped depending on OU so this method works nicely for us. There are no exceptions in our hierarchy. Local printers are never removed and have always worked.

We have a working SSO onedrive for our staff having set up "Silently configure OneDrive using the primary Windows account". We run ADFS and have a valid azure tenant. All is good, AD sync works, onedrive is happy for staff and the folder appears in file explorer. We have on-demand setup so that staff can download files they need. Office 365 A1 is running and although noone has used it in 6 months, it does work. Moving onto pupils, we have a few differences in our GPOs for pupils, one of which is "Windows Components/File Explorer/Prevent access to drives from My Computer = Restrict C drive only". This is to stop the little darlings messing with things they shouldnt, such as running amok in program files double clicking everything they can find or trying to run random .msi's that may or may not install but certainly screw up their profiles. This has worked well for us for many years. However, onedrive will not work when this GPO is enabled. If I remove the restriction, onedrive works and maps the userprofile temp onedrive folder to their cloud onedrive; put the restriction in place and you get an error clicking on the onedrive icon. I have tried "hiding" the C drive instead - this fixes onedrive but you can still "search" for C: and open the drive, since this is "hidden" rather than "restricted" the little darlings can run amok again. (Searching whilst "restricted" brings the same error as if you have clicked the C drive in explorer). I have tried redirecting the default onedrive folder - this works if I select a "d" drive as the destination for onedrive, but I cannot get the redirection to work with a network folder (\\fileserver\onedrive$\%username%) - I have tried both using the USER GPO for default directory and setting the registry Software\Policies\Microsoft\OneDrive\DefaultRootDir [value]= \\fileserver\onedrive$\%username% this would be a reasonable workaround for me but I cannot get a network location to work for me. Not all PCs have a "D" drive and since we have 120gb SSDs I cannot afford to script a creation of D drives everywhere - plus I do not know what happens to these working folders over a lifetime I suspect I will need to script a cleanup which will be messy. How are you guys locking down (or not) your PCs and getting onedrive running?

my apologies, I made an edit in the meantime. I have added more on our costs, when I costed things out the realtime cost was eitehr 25% or 50% more per user on a comparable 365 plan. This was licensing alone, I did not factor in a hardware or hardware maintenance cost as I simply don't have one - there is more than enough capacity in our nodes to run exchange. I should add a disclaimer that our A1 tenant is active, I have a WAP active and sync to our AD azure "free" - I leverage this for our adobe software. I did have a trial of A1 and found it lacking, I have not chosen to run hybrid mode and have deactivated office 365 applications. I am trialling on demand onedrive sync and opening up the apps for use at home but there is no demand. Even when we had the old rights to office-at-home, this wasnt taken up much. I think the difference between us is that we are much smaller than you (we do not send millions of emails), the resources I am using onsite is far lower than you have; our entire infrastructure storage arrays are 6.4Tb usable each, the backup arrays are a mere 36Tb useable each with an archive synology of 24Tb - we are a different league to you. Since i imagine 365 costs the same per user then I imagine you can leverage the higher storage capacities on offer whereas I dont need that. My system is far simpler than yours, hence a less likely occurrence of an issue. I suppose there is no middle ground with 365 - for highly complicated high volume systems then yes, 365 is better as you don't need to worry about setting a complex HA DAG system onsite and at 2PB of data, that would take a large management of storage on its own. At the other end of the scale, for smaller users then you wont need the added hardware for exchange in the first place. If you are somewhere inbetween then it is down to the individuals to evaluate.

Office 365 is free to education - that is true; Office 365A1 is free to education. Have you tried changing your password with office 365A1? How do you approach syncing the changes back to AD with your free version? I didn't even bother looking past that hurdle as that is an instant dealbreaker. How do you pure office 365 guys handle spam, I assume you don't rely on MS internal spam filtering only (we use puremessage for our spam filtering, reporting and control ), when I looked at 3rd party options both in front/behind office 365 they were more expensive than a comparative exchange plugin etc - for example "sophos central" was a more expensive solution than onsite sophos. Other packages are available and im sure someone else will have a cheaper o365 spam solution but I would need a single management gateway for all AV/AM/AS services such as sophos central (online) or SUM etc. I did forget, A1 plan also doesnt have access, for good or bad our curriculum has access taught in the lower years with mysql plus workbench in the upper/6th form Having office 365 as a cloud only option changes backup routines too. How do you guys backup? Do you use azure or a 3rd party? Do you backup to local? Again, when I looked at this, the options were more expensive than our onsite solution for a similar like for like rotation. Are you happy with a single point of backup? The costs did not add up for us - ive already said what it costs us for an exchange license per year, o365 (im assuming you are using EES the same as me) works out in real terms (for me at this time) at about £7.50 per user based on 95 "knowledge workers", a comparable EES desktop package plus a premium A5 plan (needed for password sync alone that A3 wont provide) would work out at £11 - thats a huge increase, even moving to A3 would be £9.25 (these notes are one year old when the last EES changes came in) - I work on cost per user by factoring total cost by user obviously we pay by "knowledge worker" these days, plus the server licensing - I am well below the 1000 count so do not qualify for the higher discounts and am wondering how you guys are getting cheaper than EES pricing for your office 365 plans? These aren't secret costs, ive already said what the VM is, hardly a powerhouse VM; Unless you are 100% in the cloud then you will still need to maintain an onsite presence of servers and an onsite presence of backup; that is a sunk cost regardless of your exchange/o365 solution and will need the same level of maintenance - one extra VM is nothing to our burden and we already have datacenter licences for our nodes. As for exchange reliability, what outages have you actually experienced before? Exchange has been rock solid for us, it has never "frozen", never locked up, the VM that it lives on does nothing other than exchange and puremessage though, no other services and that is how I have had all my exchange servers (I would have preferred server core but that wasnt an option in the past, I believe 2019 does support core though). I do know of a school in the county that has gone 100% online (no local storage, onedrive and cloud AD etc). Im not going to discuss someone elses network but I am aware of the issues and pains that goes on. I can point to more news articles with o365 outages than I have ever had (although I cannot say if they affect everyone when an outage happens, I do not have o365 and cannot say what metrics you receive), I cannot be bothered to search for onedrive outages or how often this happens (if ever at all). Even MS have a leeway of 45minutes per month. I reboot the email server for updates once per week, that takes on average 5-10 minutes to shutdown and restart the VM - I also choose schedule the time based on low use (sunday at 3AM). Taking routine updates into account I have had fewer outages then o365 over my 10 years; feel free to take your pinch of salt it bothers me not an iota. I installed exchange 2016 just over a year ago and I haven't touched it since (insofar as installation or tweaking, the patches are automatic, the server is scheduled to restart automatically once per week) and it took me 5 working days to migrate, 2 to get the exchange set up and migrate a few test people, the rest of the time was waiting for migrating mailboxes and finally switching off the old server. I followed the MS migration best practice (apart from resources which I ignored. There will never be a time we have all our mailboxes active and the duty cycle MS base their mailbox resource calulations on is way above our own usage). The other elephant in the room is internet bandwidth. Outlook is not so much a hog of data but is a timely hog of data. Despite all the protestations from the IT department or all the other plethora of options staff have, some old school staff will still email their work home, they will still email school work to pupils - it doesn't matter what sharepoint portals exist, home access plus, intranet pages, VLEs or other well trodden paths, they will still insist on expanding my exchange database with their swollen documents. 100/100 wont be enough, then 200/200 looks a little shaky, oh look 500/500 is affordable. This is all extra expense though, expense that isnt needed but to run office 365 however. This is also dependent on whether you can GET that sort of bandwidth we are geographically locked on a hill in the lake district. I have a beautiful view out of my window but the internet sucks, we use a local wireless point to point connection for our 100/100 - very reliable with an SLA but still not perfect. Our backup is a normal ADSL2 line as there is no fibre ducting near us and no BT infinity to the area either. I am quite happy to accept that this is a user issue and a training issue rather than a real problem though, ongoing and a regular inset article from me... My point is, no one size fits all. If office 365 works well for you then great. Don't discount everyone else as not all situations are the same. If microsoft stop selling exchange then we will migrate to whatever is appropriate and pay whatever we need to, that is just life; perhaps costs will parity over time, perhaps our rural location will get a wealthy landowner to pay for fibre trunking (that we can utilise). Anyway, glad you are happy with your setup, we are happy with ours. Ironically I dont think ive answered the OP question. Hybrid doesn't work that direction (it is local to cloud not the other way round), what you would do is install a local exchange instance, migrate to the local instance, then activate hybrid on the local with your just-migrated-from tenant.

as an aside, this is why I originally setup our free office 365A1 azure AD sync - it allows 3rd party SSO requests to the federated logon. It was seamless for our adobe "per user" apps to leverage the azure AD once you have set up the trusts. Best bit is that users dont need to type a thing.

We run exchange 2016 and will continue to do so. we will not run office 365 unless there is no alternative. For us an onsite solution is substantially cheaper. - Costs (licensing) and server(s) Our exchange 2016 VM is 32Gb RAM and has 8 cores assigned to it with 300Gb used out of 500Gb assigned - theoretically this is way below the "spreadsheet calclulations" in practice this is fine, the VM performance counters are more than adequate - I would also say that 2016 uses fewer resources than 2008. This is not burdensome on the overall system. Licensing costs for raw exchange server is £45 annually EES with the CAL licenses being part of the enterprise core desktop pack. Office 365 would cost MUCH more than this per user (approximately 700 mailboxes) to the tune that I could buy an R410 refurb physical server per year and still have change. We use an additional IP dedicated to exchange OWA/autodiscover/mx. SSL cert would be needed in either case, im not sure if you can script lets encrypt to work with o365, you certainly can with exchange 2016 and IIS etc. - Mailbox sizes average mailbox size is 300Mb. Concurrent usage is approximately 100 users. - Availability We have had zero downtime from our onsite exchange server (during a working day) in the 13 years I have been working here. Migration time from 2003->2008->2016 has been approximately 5 working days per upgrade - both were "online" migrations with 2008->2016 being the easiest. In comparison, we have lost internet connectivity with both our primary and backup lines on a number of occasions due to factors beyond our control (dissimilar tech but both route through the same main exchange which has had downtime). The VM is located on our 4 node cluster (stretched between two live replication "sites" on our premesis - junior and senior school parts of the complex). mobile or external devices connect the same to our exchange as they would to o365. Obviously if our primary and secondard lines went down then external connectivity would be an issue. It is more of an issue for onsite people to lose connectivity to exchange though. - Management of Exchange & Security Server is patched and runs to best practice, not much more can be said really. Management is no more onerous than o365 I think. I know you can powershell o365 so our scripts that auto-create certain pupil accounts on MIS changes would still work. Other notes: Backups Online backups of o365 does exist yes, but the cost is quite high (from what I saw). What I have not seen is someone retore from 3rd party backups to o365 so I cannot comment (though it was veeam I looked at so I would guess seamless - we use veeam for our main backup solution). Out of interest, what is the speed of restore associated with o365? What about retention, day/week/month etc (and extra cost for this - do you backup to azure instance or third party online storage)? We use backupassist local backup (was about £100 at the time some years ago) and offers mailbox backup/restore. I have used this restore and it is a few clicks with no downtime. Backups are stored daily (week) on our fast backup storage, weekly on NAS rotating and monthly on "old NAS" with rotating. Cost associated with backup is substantially cheaper than online o365 storage options I have seen, the onsite cost is also spread between our other onsite backups. Overally I would not discount people who want to retain onsite exchange.

Dont forget that come-what-may javaws is gone, openjdk or not. Now for those with older idrac 710's etc, you can still leverage the remote connection but you need to load the .jar with a local JRE. make a base folder and create another folder within this called lib Copy a JRE folder from an older 8 installation with javaws, rename the folder jre and put it in the base (so we have BASE\jre\bin etc) download and edit a JNLP from your idrac. grab the 3 .jar files from the JNLP. There is a avctKVM.jar located at the top and 2x .jar depending on your platform, for windows mine were called avctKVMIOWin64.jar and avctVMWin64.jar extract the DLL from the platform section .jar - avctVMWin64.jar and avctKVMIOWin64.jar, put them in the folder called .\lib use the batch file below to access your idrac the folder structure should be BASE jre lib the batch file to call the show: @echo off set /P drachost="Host: " set /p dracuser="Username: " set "psCommand=powershell -Command "$pword = read-host 'Enter Password' -AsSecureString ; ^ $BSTR=[system.Runtime.InteropServices.Marshal]::SecureStringToBSTR($pword); ^ [system.Runtime.InteropServices.Marshal]::PtrToStringAuto($BSTR)"" for /f "usebackq delims=" %%p in (`%psCommand%`) do set dracpwd=%%p .\jre\bin\java -cp .\avctKVM.jar -Djava.library.path=.\lib com.avocent.idrac.kvm.Main ip=%drachost% kmport=5900 vport=5900 user=%dracuser% passwd=%dracpwd% apcp=1 version=2 vmprivilege=true "helpurl=https://%drachost%:443/help/contents.html" depending on your original JRE copied, you may need to fiddle with the security settings. You may need to edit .\lib\security\java.security and comment out jdk.tls.disabledAlgorithms You can use this method for other javaws or plugin pages (or minecraft!) such as older TREND systems etc.

Ubiquiti state that it is concurrent users not APs/Switches that are important; A design maximum is 1000 concurrent users: https://help.ubnt.com/hc/en-us/articles/217549368-UniFi-How-many-APs-can-the-Cloud-Key-handle- This obviously depends on your own system. We have 47APs - a mixture of LR, AC-LR, outdoor, AC-M - (guest/voucher portal SSID on VLAN, SSID on VLAN and SSID on main) and as far as AP management the cloudkey doesnt break a sweat, a switch or two might easily break the 1000 mark of course but 1000 is quite a high number for pure APs . The actual software is the same, the same flaky mongodb, same flaky firmware updates, same flaky method of adding an SSL certificate for the guest portal, it is just the hardware that might not be up to snuff for you. As far as management goes it is friendlier than the java service, device firmware can be updated with the click of a button, autobackups can be taken and rolled back by the click of a button (or downloaded off the device for storage). Obviously AP firmware is the same as separate controller with the same options. If you want you can even integrate into the ubiquiti online portal (we havent, our cloudkey connects to the internet only to check for updates when I choose to as it is firewalled off - I manually enable in the firewall when I want to look for an update). Migration to the cloudkey was a doddle, there is a migrate export from java service to cloudkey import. For £70 it was a no brainer for us. If it dies then I can always import the last backup I have into an onsite java (as this is supported too).