dmj

iPXE may be useful here, it is a PXE firmware that you can flash onto an existing ROM or boot via USB https://ipxe.org/

Another +1 for Cloudflare. And it's pretty easy to add in things like DDOS protection against your sites if you need it.

If my suggestion doesn't work off the bat you might need to give the logged in users permission on the service account home directory and registry.

That's not some knocked up open source thing. 11,000 commits, 1000 releases, 150 devs, corporate sponsorship, written in rust. 700 forks. That looks pretty good to me, I'd guarantee you are running plenty of software that doesn't have nearly that level of support. https://github.com/ruffle-rs/ruffle

You're describing something very common in Unix/Linux systems. You might be able to do something like a shortcut to [color=#202124][font=&amp]runas /user:USERNAME “C:\path\to\Program.exe”[/font][/color]

I bet the PC it's running on hasn't had a security fix in its firmware for 20 of those years.

Has anyone managed to build a helpdesk system that uses previous answers to automatically resolve or escalate helpdesk questions? We often send canned responses to simple questions and I was thinking of a way to automate that. Our current helpdesk is a mixture of Jira tickets for longer term issues and Slack for (near) realtime issues. Both have pretty good api's so I thought it would be quite simple to stream that data into BigQuery and get Vertex to use retrieval augmented generation (RAG) to give answers based on previous questions (Google environment, but Azure/AWS have equivalents). I figured we could also use helpdesk type articles to help generate responses. Has anyone done anything like this before? I think it would be dead simple to do with an email based system (but I'm not likely to want to run a mail server, ever, again! For slack and Jira i'm not so sure. Constantly polling the channels and returning responses sounds doable but not very efficient. Any ideas?

It's a bit of a 'how long is a piece of string' question. Without knowing/measuring exactly what is being used it's difficult to say, but suffice to say what you have is clearly not enough. One thing to consider is using an old pc/server as a caching proxy. It is simple to setup using squid. Your web filter may do this already - check it is caching and has capacity.

If you can run electric, you can add the fibre at the same time so you don't need to add the cost of the wireless link. edit - also cost it over the lifetime of the hut - not the initial price you are paying.

4/5G dongles and VPN, or dig a trench.

more like before re-pinning locks was 'a thing' !

it is the filesystem that holds the ACL's and if you don't want to get in this state again, and you want authorisation and auditing controls then its about time to configure the file system permissions in code. Life would be easier if you separate the concerns of the file system and the server. You should be able to have multiple servers sharing responsibility for CIFS/SMB which get their data from redundant file systems (ZFS is particularly excellent at replication here). I'd be inclined to start this from scratch, migrating the shares out to a ZFS share, setup the permissions as you need, spin up some pods to do the filesharing, test it and then nuke the original server and replicate the data back. It's probably a few days work, but its a LOT safer than hitting a button on production and hoping for the best, and you'll be in a much better place than when you started.

There better be a Lee Majors cameo

AFAICT Duet is basically bard (also free) https://bard.google.com/chat that's integrated into Google Workspace There are some other Google AI things, such as vertex but used more from a programmatic PoV

I think the Google version (Duet) is available for those with Google domains. Theres a 14day free trial, but it looks expensive @$30 per user per month

Same. Nobody in their right mind trusts microsoft patches.

Tar was released in 1979 ! still in widespread use. Tempting me back to windows. Can it open exel files out of the box yet? At least there's wordpad to open doc files :-)

I use CoPilot daily (not the windows version, the one in VSCode). It rarely gives the correct answer, but is always useful to me to speed things up even if it's just providing the text for me to tab complete so I don't have to type it. Asking it to do things like document a function, or refactor something can give some good results. Asking it to do anything vaguely complex and it will just spit out nonsense. I'll keep using it, as it does help but be aware of the limitations.

on any services like service1.schoolname.sch.uk -> servername as a CNAME then point the server to the server IP as an A record. If you have an MX record on that domain you can't use a CNAME IIRC, but we tend to prefix with www

Your website/services DNS records should almost always be CNAME records that point to your server/load balancer A records. I can't think of a good reason why you would point schoolname.sch.uk directly at a server/LB ip address.

I fully support configuration as code, but I would be inclined to use a more standardised method than custom bash scripts for installation (they are pretty gnarly !) There's an ansible role for this: https://github.com/kdpuvvadi/unifi and, more importantly Docker images: https://hub.docker.com/r/linuxserver/unifi-controller

My thoughts are that most school networks are not really fit for purpose in this regard, and should probably be re-thought from the ground up. I'd tackle if from the complete opposite perspective by securing access to the network so that public workstations can't actually do any damage if they are compromised, ie move teaching resources onto the internet and treat workstations as if they are coming from the internet.

Google Classrooms sounds like it would fit the bill for this.

oh what's the free one called now? They keep renaming everything.

Google SSO also provides this, they call it 'context aware access' and it's free on educational standard, IIRC the Azure version is a paid extra.