KK20

another thing that people often overlook (if you are doing this yourself) is the radiation pattern. Most vendors put these out AP Antenna Radiation Patterns – Ubiquiti Help Center this may give a reason as to why certain rooms have seemingly poor coverage. The radiation pattern might be sending your signals out of the window or into a corridor. We repositioned most of our unifis to be "near the entrance and pointing towards the middle of the room" not central and not in a corner, this seemed to fit with the pattern of our U6 radiating "down and out". The ruckus was better in the very middle of the room. In two of our rooms, simply moving the AP solved an issue of poor connectivity.

we have two SSID, "secure" and "guest". Secure is 802.1x with machine certificates, used for our domain devices (there is a fudge for chromebooks). Guest uses packetfence NAC. The native VLAN for guest pops a request to packetfence which checks to see if that client is authenticated, if so then the authenticated user is put on an appropriate vlan - student and staff go on a vlan that needs securly authentication via their 365, pure guests or visitors get dropped on a dns heavily filtered securly vlan. Firewall filters DNS so only our internal DNS or securly can be used. Essentially, have two SSID, one for known devices, one for unknown devices. The unknown SSID will use packetfence to decide which VLAN they should eventually land on. I would also avoid SSIDs with passwords on BYOD (possibly not an issue on domain devices if you lock them down), unless you dont mind the password going on the internet. It is a single netsh command to export password in clear.

we have two SSID, "secure" and "guest". Secure is 802.1x with machine certificates, used for our domain devices (there is a fudge for chromebooks). Guest uses packetfence NAC. The native VLAN for guest pops a request to packetfence which checks to see if that client is authenticated, if so then the authenticated user is put on an appropriate vlan - student and staff go on a vlan that needs securly authentication via their 365, pure guests or visitors get dropped on a dns heavily filtered securly vlan. Firewall filters DNS so only our internal DNS or securly can be used. Packetfence works with 365 logons or guest accounts, the guest accounts are dished out to guests when they inventry in. A pair of radius servers do the autheticating. Packetfence sends the controllers an appropriate VLAN for the user depending on their logon. Each VLAN is set up and firewalled appropriately with settings on the APs determining which vlans allow interclient communication etc. Some "swiss cheese" for our papercut mobile print server, DNS and DHCP relay. This was a real shite to set up with unifi originally but it does work. I now have this running with TWO controllers onsite as we have a rough 50/50 split of ruckus unleashed and unifi EFG. Both communicate to packetfence. Im in the process of setting up ethernet through packetfence with our switches so I can guard against rogue ethernet devices too. When BYOD is considered, think along the lines of what people can bring in. TFTP server and DHCP server? yep. DNS server? yep. Seen both of these. So make sure you have appropriate firewall and DHCP snooping etc.

I created the new (seemingly faulty) profile on a 2022 domain controller via GPO, the domain controller has no WIFI device and has no netsh wlan profiles as a base (not that I thought GPO would take into account anyway). The ORIGINAL secure SSID has been there for a number of years, lord knows how that was done. I used the same test client (W11 25H2 newish laptop) as a testbed, this machine was freshly imaged and would behave the same as any other machine on the network. I exported both profiles on this machine and compared side by side. Since they are GPO assigned profiles I cannot manually drill down into them via the client side GUI screens. In the past I am almost positive that I created a GPO and rolled to clients (freshly minted clients would connect via ethernet after deployment, grab GPOs as appropriate and go on their merry wireless way when ethernet disconnects), but now I come to think of it, I could well have scripted this as a netsh import as part of the installation. I did have a niggle in my brain that I had come up against this as a problem before. Either way, dont trust the GPO for setting an IEEE 802.11 profile. I will create one in intune and roll that to a test device to see what intune does.

My recommendation is to look at why you are wanting to upgrade. Blackspots? Bandwidth? clients having difficulty connecting? I had our apprentice go around each classroom running inssider generating a coverage map. There had never been a proper "tuning" or channel map conducted. In the end it was better to turn down the power, set channels, moved the access points to different points in the room. We didnt bother upgrading anything although we did add a few U6-Pro to fill in some darker areas. We do have a single U7 and boy does that run hot. Very hot in fact, so keep that in mind if you do go U7. We didnt go with the U7 as they are only 2x2 devices, we will have more density (chromebooks) so kept with a 4x4 U6-Pro, plus we dont have 2.5gb POE. Monitoring switch ports show that the U6-Pro rarely max out the 1Gb anyway, I suspect the U7 will only max out on 6Ghz wide channels - we dont have many 6Ghz capable devices. In short, running at optimised 5Ghz channels with 40Mhz width on a 4x4 U6-Pro (or R750 ruckus) with 2.4Ghz turned right down and 5Ghz not running on max power was a better fit than ripping everything out. 2.4Ghz is enabled on our outdoor APs as that reaches the fields/allweather better and can still be used by the chromebooks and ipads. We have a site mixture of Ruckus unleashed and Unifi EFG.

I have had an 802.1x wireless policy based on computer certificates, ive been running this setup for a long time without issue (plus a fudgy "known user" + certificate for our chromebooks via google wireless profile). I was setting up a new 802.1x SSID for testing use and set up a new GPO in the computer->policies->windows settings->security settings->wireless Network 802.11 section. I was pretty sure this is where I had set my "normal SSID secure" gpo before. No problem so far. My test machines got the gpo, connected and ran really really slowly, mainly due to the machine now connecting at 54Mb, controller confirmed the client was negotiating at 802.11a at 5Ghz. Ouch. Switching between the two secure SSIDs switched the speed back to 500 odd Mb (40Mhz width). Both authenticated via our radius server just fine, I could see the accounting being what I expected. I surmised I was an idiot and probably selected TKIP, WPA, or legacy something in my new SSID. Except I hadn't because my controller (unleashed) wont let me select TKIP or WPA, only allows WPA2+ . I almost ran out of ideas until I exported the two profiles on the test machine and looked for differences. Low and behold my "new" profile had line <FIPSMode xmlns="http://www.microsoft.com/networking/WLAN/profile/v2">true</FIPSMode> But seemingly no way in the GPO of disabling this. There SHOULD be an option to disable "perform cryptography in FIPS 140-2 certified mode." but I cannot see this in the security/advance section. Luckily I could tweak the XML and import the XML into the GPO. As long as I didn't edit any settings in the GPO (and simply imported), this seemed to stick and roll out to my test clients (overwriting the wireless profile on the client).

ok so UNTICKING "migrate to a physical computer with a different processor version" lets me install either in a gen2 (Gen1 is happy to leave this ticked). This wont be a problem for me but this is definitely odd. I have always been conditioned into ticking this as I used to have a slightly different CPU in an older cluster (so needed to check this for live migration).

This is an odd error. On an old r740 intel server there are no issues with creating a VM for server 2025 (and W11 ISO coincidentally). Boots just fine from the ISO downloaded from Microsoft. On my EPYC server I can install any other gen2 ISO but NOT server 2025 or W11 - neither will boot from iso - a boot loop "press any key" followed by a brief loading then reset. I thought I would be clever and install a gen 2 2025 (and W11) then move (with shield certificates already on each machine as i've moved TPM VMs before) from the old r740 to the EPYC but this wont boot either! The funny thing? I can create a gen1 VM, enable "key storage drive" etc and proceed to boot the W11 or 2025 ISO without issue. It is only on Gen 2 that I cannot boot (either ISO or a fully "moved working 2025 VM". Tried with secure boot on/off. TPM on/off (yes I know TPM is required but for testing tried with off). The EPYC is a datacenter 2022 OS hypervisor and has been running 2022 VMs, Ubuntu server, and an older 2016 VM (which WAS going to get migrated to 2025 hence the test) for a year without issue so no idea what is going on here. Has anyone else had any similar issues?

no ta, i was just curious.

for the teaming, did you go from 2016? Was your NIC team a legacy load balance? That was possibly why, newer server uses switch embedded teaming. I think you can still set up a legacy team in 2019+ via powershell but it will get fiddly. I have inplace upgraded a 2019 with switch embedded team to 2022 (not a hypervisor, our onsite VEEAM local backup coordinator) and this upgraded just fine with the team intact.

Careful if you are using S2D and an inplace upgrade. I had a two node S2D fail on an inplace upgrade (2016 to 2022) and found it easier to just create a fresh cluster and restore from VEEAM. I now look after a three node S2D on 2022 and will leave that for a while. I believe the safest way is to evict a server, upgrade, rejoin, leave to resync, repeat, upgrade VM levels as appropriate. 2019 made the cluster upgrades easier, the S2D was the issue for me - it just barfed.

nice. WAC would be great if the it had free alerts. I ended up scripting powershell email alerts for my cluster as that was pretty much all I cared about for our three nodes. So its a win on its own just for the alerts.

We have kept LTSC for our digital signs (LTSC2019), I know a school that use teams app so that wouldnt work on LTSC, they have extended 10 support for some machines. We took our older laptops and ChromeFlex'd them. Integrated reasonably well with our chromebook fleet, the only issue is the lack of store on the Flex- they are just general use devices. I cant think of many things that LTSC wont do though.

"none of the above" if youfibre is available. They have been brilliant and utterly stupid-fast for the speed. £30PM for 900/900 here. I had virgin beforehand and used modem only with a synology firewall. TBH no issues, even when I wanted to cancel. They were more expensive and youfibre were symmetrical. One caveat on vodafone is for their full WIFI coverage deal, the inlaws live in a stone cottage that is quite long, the walls eat WIFI. Vodafone sent a couple of boosters that worked really well and were pre setup - sure you can probably do it cheaper - but for the life of the contract it works out well if you need a number of boosters and dont want the hassle of purchasing matching sets and setting them up.

Wondering if there are any hockey players on here, especially if you are North West or North East (played in both leagues). Wondering if Ive played against any of you 🙂

On your DHCP server, ensure you have your subnets setup, makes no difference on the VLAN/subnet as long as each can ROUTE to your server. The DHCP server will give an address to a subnet requesting, let your router do the routing (and ip helpers set appropriately). Look at implementing DHCP snooping on your switches, this can stop rogue DHCP or misconfigured VPN appliances messing things up. As for failover, this is what we do, you can even tarpit the secondary response if you like on active-active should you prefer a server. I have my server doing all of our DHCP for all subnets, even though the core switch can DHCP, I prefer to keep it under one console.

Ignore this. wrong post. cant seem to delete.

the microsoft way (without third party tools) is windows audit policy and log checking for events.

Cluster servers RAID 1 on the BOSS drives, no raid on the data as we use storage spaces direct. Standalone DC RAID1 via its 755 perc hardware controller. Hoping to be "almost server free" by the time refresh rolls around in a couple of years.

This is an odd one. I have a Policies for Microsoft 365 apps policy for all users, it sets the editing language for office as UK and enables the UK language. This does not seem to reflect for the majority of users, most users are on US for office. Outlook (and Outlook new desktop app) seem to be set as US, but the odd thing is that some documents in Word are UK and some US for proofing! The setting can be changed via cog->general->language time. PCs themselves are set as "windows display language" English UK, region is English UK, keyboard is English UK. I cannot seem to nail down how to set everyone as UK for proofing/editing for "office for the web" and Outlook New desktop. For the machines that use desktop 365 apps, the GPOs work just fine for UK proofing.

Bad form? Why? The only negative is on the "backend", i.e. thats a lot of network traffic, your fileserver cannot cope etc. I dont find this at all. I especially like this page https://jkindon.com/stop-redirecting-appdata/ all these points are fantastic IF you have 1:1 devices (I like the pictures/video section - so if you DONT redirect those and pupils save to them, they are saved to the local profile- errrrr thats not going to work on multiple devices is it? so you redirect to follow the documents surely?). If you dont, then your PCs will All need larger storage drives to cope with profile size. I know our rooms had 256 SSDs and the "popular" PCs struggled for free space without redirection. Now we are a small school, less than 1k students. We have a pair of servers with more cores than it needs, NVME drives running a 2 node storage spaces direct. IOPS rarely break 5k, I could probably run cached HDD for those levels, but there was an offer on the NVME backplanes and the drives so thats what I got (plus no RAID card to worry about) - cheaper than speccing ALL pupil pcs with larger drives. Switching is star twin stack 10gb and can easily handle the redirection. So why not? There isnt a technical reason not to. Now roaming profiles can be an issue, that would be a lot of copying to and fro when logging on It only redirects the roaming part which is, roaming! If you dont have 1:1 devices then profiles are going to bloat your PCs. Adobe roaming is usually 200mb bloating to 400mb on startup, unfortunately we use CC a lot, and CC really does like to bloat the appdata folder. Redirect? No problem! Microsoft adds another chunk and wait till you run teams and its cache of doom. That needs to sync too. This is per PC per user. Even with room seating plans this can make a real mess. We cut down from 7 day profile removal to 60 days with appdata redirection (on 256 SSDs). The downside? you cannot use KFR onedrive, its one or the other. No biggie! We have a basic quota for my documents, increased for those with video edit rights (subjects with big videos) and people use onedrive. This is normal for us anyway as pupils are now getting their own ipads with onedrive as the primary storage, teams for homework etc. I have yet to find a single program that will not work on our system. Now granted we dont run many, but the ones we do use (MS, Adobe CC, Teams) love to cache in the roaming. I have no idea on this website, nor that you could remove programs during unattend! I only used by unattend to, well, unattend and hands off my installs. Im changing my XML next week as this will help.

not really, we buy servers that fit to budget. Our R750 were cheaper than R650 at the time and had a "deal" on the CPUs giving us more cores than we needed. Licensing DC didnt make much of a difference with the 16 packs still working out. Same as you, I budgeted a "normal" workload on 20 cores. We run a 2 node hyperconverged so can easily run on one node and I am happy to patch during the day using CAU with no loss of service. Looking forwards, MIS is cloud, 80% of storage is cloud; we still run a small onsite "documents" for our PE, drama, Art, DT as the video editing portion does not play well with onedrive. But this is changing now I am running ipads for 50% students, these work much better with video so as soon as I have that cracked I can get rid of all-but-office staff desktops.

speak to john at veryPC. He is good at finding individual components. This can make things as cheap as they can get for what you need. We are on OVS with individual components because it suits us. We dont have 75 knowledge workers so chest is not cheaper (when I last priced it), M365 was more expensive - not all vendors work with chest if you wish to go down the EES route. We dont have an onsite exchange, SCCM so its windows upgrade, cals, office + free 365apps uplift, a couple of DC 16packs and an STD server 16 packs (16 packs cheaper than bundling 2 packs for our server cores), P1's for intune and P1 entra/identity remember that not all MS products give faculty:student ratios and need to be licensed per user. reading your knowledge worker count at 200 I would also price chest EES as this may be cheaper depending on how you endpoint license.

the M2 in the picture in an NVME drive (one notch), not a "sata drive in M2 format" (two notches). so you cannot use the M2 to SATA caddy. You can get USB C to NVME, PCIe to NVME adn these work fine in most UEFI and as someone else has posted already, that MB looks to support NVME (again one notch) and thus will boot off it anyway. Incidentally not all PCs like SATA M2 in those slots either (Prodesks usually complain)

Posting on behalf of my friend, the outgoing network manager. (If you go to ANME then I usually bring them along so you may recognise them!) Austin Friars More Information Closing date for applications: Thursday 13th March 2025 at 8:00am. Salary to be discussed at interview I believe.