derf

Have you looked at duckdns.org ? I've found it to be excellent and it's free.

nextcloud can also do this, local install on your network and SMB access for users as well as shared folders if you don't fancy going down the Google/Cloud route.

That should work correctly. I use the same to force to https

Yes I did this setup, check how you authenticate on smoothwall, for us we were using ntlm with redirect which caused a lot of problems due to it's nature, changed to IDEX which helped, but still ended up with the odd error when roaming.

You can run a scheduled task on an event trigger, and then you can pass the event parameters to an external script. Here's an example that I use for handling delete events for auditing all file deletions: Note the ValueQueries and the parameters passed to the vb script. 2017-06-04T09:52:14.5408888 IT Department \Event Viewer Tasks\Delete File true *[system[Provider[@Name='Microsoft-Windows-Security-Auditing'] and EventID=4656]] and *[EventData[Data[@Name="ObjectType"]="File"]] Event/EventData/Data[@Name='SubjectUserName'] Event/EventData/Data[@Name='ObjectName'] Event/EventData/Data[@Name='AccessList'] Event/System/TimeCreated/@SystemTime S-1-5-21-2324878270-345525128-4222137208-1000 InteractiveToken LeastPrivilege IgnoreNew true true true false false true false true true false false false PT72H 7 C:\Windows\System32\cscript.exe C:\Scripts\MyScript.vbs "$(AccountName)" "$(ObjectName)" "$(Logged)" "$(Access)"

This could actually be very useful depending on your auth engines. At the moment we use smoothwall with the chromebook connect so we don't need radius to authenticate. However if we went over to other solutions then Radius auth would be a more standard id method.

A couple of points of you remove everyone from the printer security: 1. The security group on the printer needs, to paraphrase as I'm not at work, "Manage this printer" ticked (as well as the other security options). 2. The group policy needs to 'run in the user context' checked, otherwise windows will connect as the system account and be denied by the printer Then, the printer should add correctly and only that group will be able to print

I use Zabbix as well, once you get your head around it is very nice and useful. Alerts can be a little bit spammy. I'm monitoring Smoothwall, all linux and windows servers and even NUC labs with temperature, CPU etc.

Why not HTML5 with Canvas? No installs needed except for a text editor and an open standard to boot! Depends on the age group and if they have any previous teachings.

I had to lock down creating in the root folders, apply quotas to all the folders, and to stop any tampering apply security groups per department for subject/ks folders. In the process of starting to migrate to gSuite team drives, not sure how much will end up there though.

Same as post above. Defaults are fine and easy and without it you'll have all sorts of nasties creeping in.

Here's a sample PHP script to download the files one by one and convert to MP3 using ffmpeg. Not pretty, not nice, but didn't have the server space on my linux servers to download the lot in one go as was posted at the start of the thread. mp3 size @ 128 Kb/s is roughly 25 GB. $csv = array_map('str_getcsv', file('BBCSoundEffects.csv')); $first=true; set_time_limit(0); $nb_total=count($csv)-1; $converted=0; foreach ($csv as $c) { if ($first) { $first=false; continue; } $file=$c[0]; DoIt($file,$converted); } echo "Converted {$converted} of {$nb_total}"; return; function DoIt($filename,&$converted) { $mp3=str_replace('.wav','.mp3',$filename); $path='d:/your_location'; if (file_exists("{$path}/{$mp3}")) { return; } $converted++; $temp = tempnam(sys_get_temp_dir(), 'TMP_'); file_put_contents($temp, file_get_contents("http://bbcsfx.acropolis.org.uk/assets/{$filename}")); shell_exec("c:/temp/ffmpeg.exe -i {$temp} {$path}/{$mp3}"); unlink($temp); } You'll need to give the PHP process around 1GB of RAM as some of the samples are quite large! I just ran this on my desktop and waited a few days for it to finish. You can restart the script any time to continue downloading.

Grabbing it now, and a simple database and frontend for searching being developed Thanks for the post!

I've taken another approach with our on-premises exchange server using the EWS service, interfaced through PHP and a simple views (month/today/upcoming events/agenda), calendar is checked every 15 minutes and updated if changes are present. The added bonus is we get a full staff calendar and a more parent friendly one. Before we published in outlook to the ical format, however it was bad at parsing multiday events. I assume this would work as expected with an Azure exchange instance, can share details if anyone is interested.

+1 for this soft.

Just an update about this, just for reference sake. You don't need to create contacts and set the forwarding! This is a powershell command to do this for you! Here's the script in full, replace the obvious parts with the relevant details (apologies for the code standard, I'm not very good with powershell) param([string]$cn) IF(!$cn) { [indent]echo "No parameters. Exiting script" [/indent] [indent]exit[/indent] } $username = "DOMAIN ADMIN" $password = "PASSWORD" $secstr = New-Object -TypeName System.Security.SecureString $password.ToCharArray() | ForEach-Object {$secstr.AppendChar($_)} $cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $username, $secstr $Session = New-PSSession -ConfigurationName Microsoft.Exchange -ConnectionUri http://FQDN OF MAIL SERVER/PowerShell/ -Authentication Kerberos -Credential $cred Import-PSSession $Session function MailForward($name) { [indent] $email=$name $email+="@g.YOUR_DOMAIN"; Set-Mailbox -Identity $name -DeliverToMailboxAndForward $true -ForwardingSMTPAddress $email[/indent] } MailForward($cn) Remove-PSSession $Session

Double check the DNS settings on your TCP/IP config, try pointing to a known DC DNS server that works, then work backwards from there

No DNS forwarder setup on the DC would be my guess.

With Unifi you can't have a static assigned VLAN and a radius supplied VLAN. If you do then you end up with no traffic, or no IP (can't remember which one). This is over all SSID's I believe.

Just to echo the others, that is how it works, which is why I set up a SAML server for authenticating using domain credentials. It has the benefit on making a nice login for the chromebooks so the primary pupils have the same login procedure as they do on the w10 laptops and desktops.

https://support.google.com/a/answer/2589954 is closest I can come to helping.

We're currently going through this process, can send me a message and I can explain, short part is: Create an alias in google for your domain, I choose g.mydomain.com Keep your MX records pointing at Exchange while you test Create a contact for each user using the alias, [email protected] becomes contact [email protected] (I've got some scripts to automate this) Set forwarding and store in each mailbox on exchange (part of script above) ..... Now all this would be fine if all your users were on Exchange and Google, however for us this isn't the case as we want pupils on G only (licenses, storage etc.) Next step is switch the MX records and use dual delivery Google side for mail back to exchange (not sure how to stop it pinging it back to G with the forward though...) The google account sync is easy enough, and used GAM to upload all AD photos (daily scheduled task) Used SAML for auth with simplesamlphp all the examples were there for the taking.

Do you have home drives for the teachers and do those drives have a quota on them? I've seen SIMS panic when the teachers drive is full.

Good point The only problem with that is people moaning that the internet is broken again, and it's all IT's fault...

Guest portal has nothing to do with DHCP/DNS records for WPAD. The only problem with BYOD and WPAD is explicit configuration of devices that you don't manage. We had to push all BYOD devices through a transparent proxy, otherwise there's nothing stopping a user from using a direct connection