dmj

I'm afraid my presentation and teaching skills are not up to it

Really? That absolutely wasn't my intention. I was simply asking him to focus another way to deploying things, given my job is literally to deploy things I have a lot of insight into the different methods and why big business does it in a certain way and why small sites do it in another. I honestly thought it would be helpful to see another side of deployment. Anyway, judging by the feedback, you all made it clear I should keep my nose out and you all seem happy enough keeping doing things as you always have.

It will definitely take longer to do as IasC compared to point and click provisioning. Perhaps I'm talking to those running large secondaries, MAT's with several schools or Universities rather than a small primary with 50 machines - and if you don't care about infrastructure being down for a few hours why you manually re-provision everything in a disaster scenario, then by all means do it all manually. If you want to save one bills by shutting down half the infrastructure at night/evenings/holidays good luck with a manual approach. My experience with secondaries we had around 50 switches, 20+ servers, 2000 devices and a team of four. For the time I spent there I only managed a small portion with IaC but even then I could see this was the way forward and as soon as I started working at a University 90% was managed by IasC. I suspect the only reason people are not doing IaC (in larger organisations) is, as you pointed out, they don't have the time or know how to go about it. FWIW I wouldn't advocate managing hyper_v with PS, use terraform/ansible to abstract that. edit: Having advocated IaC, I'll come up with a few reasons NOT to do this: It's harder, much harder It takes time, which most of us don't have You won't find entry level staff with an understanding of software development practices Staff retention is harder as devops pay is generally higher than sysadmin pay Training (and time for it) Anyways, if 1% of the 1000+ people/bots who've read this take on board some of the suggestions and working practice it will have been worth my time posting.

Fair point. I wasn't trying to be confrontational. I'll try and rephrase it. Our job is to maintain mission critical infrastructure on an enterprise scale rather than small business scale. We should be using enterprise methodology and not small business methodology. This would be a good start for managing intune with code: but to be honest PS is probably a bit awkward for this and there are many tools that manage server and desktop configurations which are designed for IasC: ansible, terraform, chef, pulumi, puppet etc, etc. So the way I do this is to create a github repository, and set it up such that techs all use their own branches. A commit to a branch then triggers a CI pipeline in the same way CI works in software development. The CI pipeline will check the configuration against policies you have put in place, 'lint' the code to make sure it meets certain specifications and check whether it looks like it's going to work (no obvious errors). To merge a branch into 'master' (ie promote the changes to production) the techs need approval from a senior. This provides an instant mechanism for others to review what you have done, thus sharing knowledge, and importantly it provides a log of every change on all systems. If all these checks pass you merge your changes to the master branch. This merge then kicks off a deployment pipeline which deploys all the changes (eg builds a server, 100 servers, or just deploys registry keys to a workstation). Any problems in the wild and you just revert the merge and the deployment pipeline reverses the changes. You know exactly how all of you switches, servers, workstations are configured because you have an exact output of the state of them. Someone deletes your intune, or burns down the building - just re-provision it all because you have the exact state stored in git (and on all the techs machines) I appreciate it's not beginner stuff, but there are a lot of businesses with FAR fewer users/machines that are doing this. So I would urge any tech, beginner or otherwise to spend some time with IasC. This methodology is known as devops: using developer practices and applying them to operations. Again sorry if I sounded confrontational, I'm not trying to disrespect what you have done.

Great effort, but I'm sorry to say I disagree with the approach you take. Nowadays deployment best practice is focusing much more on IaC and less on point and click deployments. 10 years ago it would have been spot on, and it's still a great approach for hobbiests. The problem with point and click deployments is that you don't get: Any documentation as to what you did (other than watching a 20min video!) an audit history, an authorisation process, reproducibility/consistency, any kind of peer review of the work, built in DR process, any possibilities for automation and no policy enforcement/security scanning of mis-configurations. I appreciate school IT people don't get training on best practices, and much of it we have to make up as we go along, so it's good to see someone helping improve this. I just want to point out that there are other ways to do things, practices that most of the IT industry has adopted and I worry that schools are getting left further behind. So it would be great if you could focus on some Infrastructure as Code techniques. Sound is a bit low too.

2.5 admins. It's a podcast, on youtube as well as other places. Really high quality information: https://www.youtube.com/@25Admins

No worries. Windows wouldn't copy the permissions unless the same user existed on both systems and I suspect this is the issue here - or rather the user ID's on both systems don't match. if the users match with 'ls -l' (in the directory), run 'id ' and make sure the UID matches on both systems. Unix systems have the root user as UID=0 and the first user usually has an UID=1001, or 501 on macs. The UID's on both systems will need to match.

I don't know/understand what synology is, so I suspect it's some sort of *nix. Given that assumption can you say whether you using a centralised system for managing your users? - you won't be able to match users on different systems unless the user uid's match. it would be helpful if you post the results of ls -l and (if there is a '+' at then d of the line, indicatiing an ACL run: getfacl on bothfilesystems.

-p should do it. Are you having trouble with POSIX permissions or ACL's. If the latter, does the filesystem have acl support enabled? Where do the permissions come from? Ie are the user accounts mapped correctly in the target system?

Indeed, yet somehow needs dual CPU and 8GB RAM to use nowadays. IIRC recommended system requirements 20yrs ago were like 128MB RAM and pentium 133.

Yeah you're probably right here. It would need some unpicking to deal with the raw tables. I mentioned it as I'm working on a BigQuery project at the moment. Sometimes the fastest and least hassle solution is the best one. Although I must admit, accessing live databases directly from spreadsheets is kinda awesome

One option I thought of is to use Google's bigquery. Data ingress is free and for a tiny storageset like SIMS (most of which is probably transaction logs) so would be really quite cheap. 500GB is about £7 per month IIRC. Most of the data you could strip anyway and the first 10GB is free. The downsides of bigquery is that you pay per query, which is where they get their money back, but if you only need access once in a blue moon it would be super cheap to host there and staff could access the data they need directly from google sheets.

I'm surprised it's that straightforward, you would think schools would just club together for a single license and share the updates.

What does the licensing say about running SIMS 'but not using it'?

We used to have 'charging lockers' where students could put their laptops for a charge. They didn't get much use and were quite expensive. I'd probably go with @Norphy suggestion if I were to do it again.

^ 100% don't do a lift and shift if you even vaguely care about costs. Convert as many of your applications to PAAS as possible, if you can't - choose a SAAS option. There are a variety of SAAS options for active directory - GCP, AWS (Ironically Azure AD isn't actually AD) https://cloud.google.com/managed-microsoft-ad/docs/overview https://aws.amazon.com/directoryservice/ For the others (and AD if you need), convert them to containers and deploy directly or run a k8s cluster if you need more control. https://github.com/HP41/docker-papercut https://www.papercut.com/blog/print_basics/the-power-of-docker-and-containerization/

In the past I've used: https://www.nagios.org/ https://icinga.com/community/open-source/ https://prometheus.io/ Icinga is probably the easiest, but prometheus is the most comprehensive and widely used. None of these tools just monitor disk space - but if you are starting to look at monitoring then I would be getting something that will provide alerts for a range of things and there are plugins for all three that would monitor just about anything you could think of.

Sorry to do the 'told you so thing': With ZFS you'd simply diff against an old snapshot and restore the files using the output of the two snapshots. You could probably do it in a single line. Alternatively, if you scripted moving the files off the filesystem you would have been able to generate a log of what you moved so you could use the script to move them back. Sorry again for being captain hindsight, but I've made similar mistakes as this and learned from them so hope you will

Your're confusing ICMP TTL with a DNS Record TTL In ICMP each hop reduces the packets TTL until it reaches zero and gets discarded. It's got nothing to do with DNS TTL records which is how long the record lasts in cache before it requests a new one. This issue doesn't sound like a DNS problem to me.

That's not how it works. All this does is provide access to SAML auth via the login screen. You can choose who your auth provider is, host yourself, and use any of a number of identity providers (multiple if you want). whether you want QR codes, fingerprints, FIFO or whatever is up to the implementation

Slow clap. SAML auth for windows. I think Chromebooks introduced this in like 2013. 10 years late to the party.

That would be a laugh - it would spew 'de-authentication' packets at your neighbours so they couldn't connect to their wifi.

bunch of second had go-pros https://www.mpb.com/en-uk/product/gopro-hero-4-silver

For those 'fighting' this sort of thing - it's known in the tech industry as "Shadow IT" There's a list of arguments that you may want to use on Wikipedia (and all over the internet) https://en.wikipedia.org/wiki/Shadow_IT

14.25 is basically nonsence. Stuff like the computer can't have any data on it. Lets see that boot into a word processor.