ilc72

I would like to thank everyone for their contributions. I appreciate the honest feedback, it has been taken on board and much was already in our plans. Nothing will happen, or money be spent, that’s not critical without a full root and branch review of the existing infrastructure and a full Needs Analysis involving those people that actually use the systems. Too often money is spent on infrastructure that is over specified. I’m no fool and won’t allow the School to be ripped off on my watch, there are plenty of options and using refurbished kit is definitely one. To be honest until recently there hasn’t been a great deal of Desktop innovation since Intel’s Sandy Bridge architecture. I don’t want the thread to be hijacked, and have had a couple of very helpful PMs! I’ll ask a Mod to lock the thread

ITGURU I don’t question your logic, I commend your service to the School and you’ve given good reasons as to your reasoning. There is no one size fits all solution or product. The best products are useless unless they have the right people with the right skills installing and managing them! My comments were actually meant as a compliment not as criticism. I’m even more impressed that everything is properly documented, often the weakness of many IT professionals who are happy to carry it in their heads. I just hope the School appreciates you and pays you well, as they have a gem!

Q1. Does Windows 10 Education A3: Windows Defender Antivirus, Device Guard mean that Sophos is redundant, when taken in addition to Fortigate UTM? You could/can use Windows defender - BUT...it would be pretty unmanageable without centralised updates/monitoring etc which can be done through SCCM (which is neither cheap and a serious piece of kit to setup) Thanks for the heads up, I will take a look into SCCM as even with VDI we will most likely still have many desktop PCs, any pilot of VDI would start small and work from there. It wouldn’t even touch the classroom environment in the first iteration. Whatever endpoint solution you have, it needs robust configuration/update management! Q2. Does Enterprise Mobility Suite (EMS) A3: Intune for Education, Azure Active Directory P1 allow us to perform synchronisation between AD on premise with Office 365 AD for Single Sign On, Password Resets, and enable us to implement Two-Factor Authentication without purchasing additional products? Will there be ongoing additional CSP costs for an Azure AD tenant? ..well if you used Intune (which might be a sensible future...) you wouldn't want a local AD at all. Its not a well developed solution (in my view) and Microsoft has a tendency to pull the plug on such developments which are not widely adopted.... And yes, its now possible to synchronise and reset passwords and provide SSO with the latest versions of DirSync or Azure Connect ...or whatever Microsoft has decided to call it this week. So, no, its no longer necessary to pay for licencing Azure (..But you would need Server 2016...and Windows 10....I think) Given they bundle Azure Active Directory P1 or P2 I tend to agree, I’d welcome any comments on people who have gone this route. Currently we are planning to upgrade to a 1Gbps Leased Line with a EoFTTC backup through a well known provider so maintaining connectivity shouldn’t be an issue if configured correctly. You raise an interesting point, do people to tend to buy Server licenses or include them in OV-ES, I have read that it’s cheaper to buy as the annual costs are steep! Q3. If the School runs a hosted SIMS solution do you still need SQL server licences to connect to AD? The SP is telling us we need two full SQL Server licenses for this purpose? Is the another alternative since new SP is saying we need two SQL Server Standard Core licenses at a cost of £700 for the primary/backup VMs that host this function? My experience is that typically cloud-based applications include a limited license for this purpose? If its cloud based - I can't see why you'd want local SQL licences. We don't use SIMs - but Yes - to host SIMs - I'm sure you would want licences. I’m still waiting for more information from SP, I will check with Business Manager that it is in fact hosted, then if that’s the case I will check with the supplier to confirm. Q4. If we offer teachers remote access via a VDI portal do we need Windows Virtual Desktop licenses if using a VMware Horizon solution based on premise? If so, are licenses purchased for concurrent users or all users with remote access? I've no idea...but I'm sure they will tell you...and Yes, I'm sure it will cost money - probably a lot of money. There are "free" (although that would assume you are not paying anyone to install and set them up) "Linux" based solutions that allow you to designate a block of school schools to allow staff/students to connect to remotely via a web page....which avoids running a server....and therefore avoids the issue of remote licences for desktops - because you are using the existing desktops. BUT...allowing connections from outside to inside is a BIG hole to put in your network. Various RDP services are known to be hackable. You could but in a VPN layer (more licences for the clients potentially)...but you would still have a potential issue of dirty end user computers (potentially with keystroke loggers) being connected to your network. Did you say that one the whole reasons for your mess was a breach? Really you need to give your staff locked down laptops which are managed through your network...or possibly inTune. Sadly InTune doesn’t work with Windows 7 and attack vector was a spearfishing email attack responded to by a senior member of staff. As I understand it there was no AV installed, only Windows Defender and not Security Esssentials, I don’t think there is any Config Management either! My background involves considerable work in the Defence sector, I don’t believe in giving users laptops, any remote access should be zero or thin client to a persistent VDI image so that they get the same experience outside School inside! We are fortunate not to have many laptops that leave the premises. That said security is always a balance with cost and usability, therefore we are involving a member of the SLT in the Strategy Team and will consult Department Heads and those teachers with an interest as widely as possible. Q5. How does Microsoft generally handle issues where subsequent payments have not been made to multi-year agreements? We have checked and the School was never notified or invoiced by the original SP, moreover the Distributor handling the agreement never contacted the School to warn them of non-compliance as I’m being told is the normal process? It sounds to me that you need to pay up. You have used their stuff for two years...and not paid. That's not moral. If you don't want to pay for their stuff...you shouldn't use it. Why should the rest of us pay more to cover their losses by you not paying. I suspect that the email addresses used belong to staff/users that are no longer in the school and their accounts have been deleted...so notifications will not have come though. But, not getting a notification doesn't get you out of paying!!! We have checked with previous Business Manager and trawled old accounts to no avail. We should pay absolutely, but in my past experience (working for another large Software company), those that came forward we’re offered more leniency and flexibility in resolving issue. The numbers are not trivial and are not included in the budget for this year. One thought I had was whether they’d roll the costs into a new multi-year OV-ES agreement? Q6. How can I verify the pricing is not marked up? Our new SP is not an education specialist, we have previously seen excessive markups on other products with special educational pricing from them? Can anyone recommend a good educational reseller to work with? Why on earth would you have chosen an SP that is not used to working in education? I'm not conscious that any supplier applies higher markups to educational users - its usually the reverse. However, it is, sadly, too often the case that Educational network managers have poor ICT skills, and expect and require an extraordiary amount of support from suppliers to make up the shortfall. You can't expect suppliers to provide what is sometimes daily telephone support and onsite visits without paying for it. And yes it will run to thousands of pounds if you added it all up. We work with RM computers and while I often question the costs..it works..and it works well...and in a joined up manner. It probably isnt the right solution for everyone. I never chose any of this, it’s a mess that I’ve inherited, extremely reluctantly, it’s not about who is the cheapest but ensuring they are close enough. The existing SP quoted £170K for new Servers and Storage that I have found to be available elsewhere through an accredited education partner for about 50% of the cost. Thanks for your responses Alan, I take on board what you are saying.

I wasn’t involved in any of this, I don’t think outsourcing delivers the long-term savings and will be recommending evaluating bringing it back in house. I know how it feels believe me, although not outsourced I was acquired and “TUPEd” into a Company that I would never of chosen to work for! Also if we get agreement to hire, this forum is where I would post the job link! I fully respect the people on the forum and am not looking for free Consultancy. I did a huge amount of research before posting in the first place! That lead me to here, as there just isn’t the detailed information to answer the questions, and if you read the OP they are of rather a sensitive nature!

That’s rather unfair as I’ve recommended the School hire an IT Manager, but where we are that sort of money will get no-one. Given we are close to the old Silicon Valley of the UK you are talking double that! Part of the problem has been the new HT and their outsource everything. We have lost HR Manager, IT Manager, Facilities Manager etc.. When you do that the chickens come home to roost! The RC know what a Governor’s responsibilities are and that my role is stepping into day-to-day operations, we are putting in place plans to address this but Rome wasn’t built in a day! We as a governing body are committed to developing a new IT Strategy that focuses on improving Teaching & Learning and the Student/Parent Experience. It’s not about cost, though the £300K figure is ridiculous, it’s about delivering improvement. Good IT allows teachers to work more flexibly and productively and so properly focused IT system can deliver tangible savings in staff absences etc.. However the Licensing issue needs to be resolved immediately, hence my OP!

I can see both points of view, having my first experience with email was MS Mail 4.0 and Lotus ccMail! My background was Enterprise email and communications and the largest ever deployment was 240K users across 400+ worldwide offices, including some in some very far flung places. Back in those days, 2003, Exchange wasn’t an option and Lotus Notes was the only realistic option. That deployment consolidated from 46 datacenters to just 3 mirrored datacenter sites, it ran on highly virtualised Unix servers, though we evaluated platforms from x86 to the mainframe. I’m no lover of Exchange and spent many years battling Microsoft in the trenches. However, these days I love Office 365 and think that the implementation is fantastic, I would never recommend a School try and maintain an on premise solution, that said if you have the skills to run it it is still a viable solution. But ITGURU’s employers are lucky to have such a skilled and knowledgeable person in their School, but what if ITGURU retires, if off sick, or is run over by the metaphorical bus! Certainly down in the South East trying to recruit skilled staff at rates Schools are willing to pay makes the decision to Office 365 an easy one. I’ve only recently got involved in the Education sector as a Co-Opted Governor, despite wanting to do anything but IT, the disaster that my School’s IT has become I have had to become involved. What I know is that the School has an IT infrastructure that is too complicated, especially given its ability to compete suitably skilled for IT support resources, we have no choice to simplify things. One of the first projects is to migrate Staff email to O365, we just need to figure out how the user management integrate with the current W7 environment, most probably ADFS if it can deliver self-service. Another point that’s oft overlooked is how strong Office 365 security is when opening up BYOD, think multi-factor authentication on setup on new devices, automatic URL rewriting, device management, remote wipe, etc..

Hi Mike For reference we are based in Surrey and the School is a Grant Maintained Secondary School, one of the few left that hasn’t joined the local MAT. We are close to the Hampshire border in about 30 miles to the West of London. We would certainly welcome any support that can be offered by anyone and am happy to come and meet people and see their environment and learn from others. Happy Christmas to all!

Hi Ditto You rightly identify the challenges we face and we have had long discussions amongst the Chair of Governors, Chair of Resources and myself about the separation of responsibilities. Governors are there to provide advice and oversight and not take day-to-day responsibility. The problem we have is the Business Manager is new and has no IT knowledge, the Head won’t sanction the appointment of an IT Manager, and there have been major issues that have led us to this point. The SP basically has presented the School with a quote for a Windows 10 Upgrade for £300K, split £180K for servers and storage, with a further £120K for 100 new PC’s and to upgrade remainder of estate to 256GB SSD and 8GB RAM. School’s simply don’t have the resources to manage an environment like this and you are completely right there are other strategies out there including non-Microsoft. The issue is that there are things that need to happen immediately: Microsoft Licensing Internet Connection & Improved Security (currently looking at a managed service from Schools Broadband for this) Email Migration to O365 (existing SP are quoting) Storage (currently we are desparately moving data to alleviate pressure on our old mirrored 10TB HPE SANs and have an upcoming software licensing timebomb) Collectively we have decided to establish a working party comprised of three Governors, the Business Manager, and a representative from the SLT to address the IT Strategy in the New Year. We are looking to invite third parties to provide input into that process. So far we’ve looked at the Cutter Group and CSE NET but would welcome advice from others. The Governors want to see a seed change in IT Strategy whereby funds are not just spent maintaining infrastructure, but using IT as an enabler to improve Teaching & Learning as well as the Student Experience. For reference we are based in Surrey and the School is a Grant Maintained Secondary School, one of the few left that hasn’t joined the local MAT. I’d love to see how other Schools have addressed this conundrum and how they are innovating.

Hi I am a recently appointed co-opted governor for a UK school. The School I represent outsourced its IT service provision a few years ago, recently the Service Provider changed. Unfortunately the School has no on-site IT knowledge and therefore I have been asked as a recently retired IT specialist to conduct a thorough review following a recent cyber attack. The School signed a three-year licensing agreement back in February 2016 paid annually. This was purchased via the original SP and the order placed through a Distributor. However in turns out the School were never invoiced for the charges in February 2017 or February 2018. Without going too much into the situation their needed to be a complete regime change due to issues with the previous Head, Chair of Governors, the original SP, and Business Manager around conflicts of interest. Obviously the School appreciates it needs to rectify the situation with Microsoft, but has not budgeted for a huge bill for previous years. The School has around 100 FTEs and 1000 students. Does anyone have any experience of how to deal with this situation? The new SP has quoted for Licensing under the new OV-ES agreement but I have some questions. We are planning on migrating staff and teachers to a hosted Office 365 environment, I would like to ditch the local Exchange server completely but I am told this isn’t possible as it is needed for authentication? I am also pushing the new SP to implement VDI where possible (starting with a pilot for the back office staff and teachers (to provide remote access) though meeting stiff resistance. Currently we have around 400 PC’s all running Windows 7 and the new SP recently installed Sophos AV on the endpoints at presented us with a bill of £5K for a three-year agreement. We are in the process of having a new Gigabit fibre connection with a Fortigate UTM solution installed. We are trying to decide between Enterprise Desktop for Education E3 and E5. So the questions I need to ask are: Q1. Does Windows 10 Education A3: Windows Defender Antivirus, Device Guard mean that Sophos is redundant, when taken in addition to Fortigate UTM? Q2. Does Enterprise Mobility Suite (EMS) A3: Intune for Education, Azure Active Directory P1 allow us to perform synchronisation between AD on premise with Office 365 AD for Single Sign On, Password Resets, and enable us to implement Two-Factor Authentication without purchasing additional products? Will there be ongoing additional CSP costs for an Azure AD tenant? Q3. If the School runs a hosted SIMS solution do you still need SQL server licences to connect to AD? The SP is telling us we need two full SQL Server licenses for this purpose? Is the another alternative since new SP is saying we need two SQL Server Standard Core licenses at a cost of £700 for the primary/backup VMs that host this function? My experience is that typically cloud-based applications include a limited license for this purpose? Q4. If we offer teachers remote access via a VDI portal do we need Windows Virtual Desktop licenses if using a VMware Horizon solution based on premise? If so, are licenses purchased for concurrent users or all users with remote access? Q5. How does Microsoft generally handle issues where subsequent payments have not been made to multi-year agreements? We have checked and the School was never notified or invoiced by the original SP, moreover the Distributor handling the agreement never contacted the School to warn them of non-compliance as I’m being told is the normal process? Q6. How can I verify the pricing is not marked up? Our new SP is not an education specialist, we have previously seen excessive markups on other products with special educational pricing from them? Can anyone recommend a good educational reseller to work with? Thanks for any guidance... ilc72