GameOfGPOs

Out of interest, did you ever get to a solution for this? We have a very similar problem that's been on and off for over a year now - coinciding with a move to Sophos. It’s started to be a problem yet again after updating to 24H2, we had the problem on 23H2 early doors, but not everywhere. Similar setup to you, Sophos, Cloud Drive Mapper, Dell devices, imaged with SCCM.

The Mead Educational Trust - The Mead Centre, Gipsy Lane, Leicester, LE4 9DD Role: Senior IT Technician Salary: Grade 6 £30,032 - £32,354 per year Job type: 37 hours per week, Full Time, Permanent Start date: ASAP Apply by: 8th December 2023 @12pm This is a great opportunity to become a Senior IT Technician working within the MAT IT Team that supports 13 schools across Leicestershire, other central and educational functions. Full details and applications via ETeach - www.eteach.com/careers/tmet/job/senior-it-technician-1386848/?lang=en-GB

The Mead Educational Trust - The Mead Centre, Gipsy Lane, Leicester, LE4 9DD Role: IT Technician Salary: Grade 4 £24,494 - £26,196 per year Job type: 37 hours per week, Full Time, Permanent Start date: ASAP Apply by: 8th December 2023 @12pm This is a great opportunity to become an IT Technician working within the MAT IT Team that supports 13 schools across Leicestershire, other central and educational functions. Full details and applications via ETeach - www.eteach.com/careers/tmet/job/it-technician-1386839/?lang=en-GB

Ask them to enable Relay Rocket on your relay instance. We have it running with 3 VMs hosted in a cluster as our transparent base filter to catch anything that doesn’t have an agent. We then have one setup to serve the captive portal. You will need a wildcard SSL certificate for them so you don’t get a certificate warning. Must be said - the transparent setup we have will filter at a student level (or whatever level you pick based on your relay structure) but when something is blocked it will give the user the option to sign in to unblock if appropriate to that user.

We’re a MAT of 11 schools - growing to 20 this year, with roughly 7000 users so far and recently moved to the LS Relay platform having been on a tenancy setup of Smoothwall. Just to mention, I have nothing bad to say about Smoothwall. First off, ask for a trial period to play around with the portal, smart agents and reporting to get a feel for rolling out updates and possibilities of what you can filter. That really helped us make our decision to move away from a typical setup. We sync our single AD structure with Lightspeed - spend some time planning it out. You want to use security groups in OUs grouped together to make filter changes easy across levels. Agent works well across all devices. Only issue I’ve had was with iOS 13.1 breaking the agent when it tried to update leaving the device with no connectivity. Relay Rocket - your main question. We run 4 in a cluster on VMware virtualisation - not had a single problem with them. We run 3 clustered as the transparent base filtering and set as the DNS across every client network as a backup. We then have 1 solely setup for captive portal guest networks/BYOD. You will need a wildcard SSL certificate to apply to the VMs. Anything with an agent ignores the rockets unless the agent fails and we block port 53 DNS outbound to anything other than our rockets so you can’t get unfiltered net by changing device DNS setting (the relay rockets forward any internal domain dns to your domain controllers). Your main challenge with the rockets will be how you plan to get any BYOD to the captive portal. Apple and Windows devices seem to redirect naturally. Android not so much - I just trick our WiFi into serving its captive portal page but edited the webpage so it redirects to the rocket instead. Speaking to them at BETT - they were heavily US based and chromebook centric until about a year or so ago. The UK side has received investment recently and development is being ramped up with plenty of features on the way (proxy based filtering, more Windows agent features). Drop me a PM if you want to chat. P.s - the Safety Check feature is currently just for chromebooks but will be released for Windows soon meaning safeguarding monitoring and filtering will be in one place for one price.