17
Reddit’s r_k12sysadmin Credits: @r_channels @reddit2telegram
Looking for any career advice/insight
The point of this post is to learn has anyone experienced a similar environment with difficult leadership, if so how did you manage it?
For reference half a year ago I made the following post which highlights one of the many challenges.
https://www.reddit.com/r/k12sysadmin/s/FpRVi5Lycx
Private school, New head and CFO came as a package deal. They came from a school in which they had their positions for less than a year. The IT Director of their previous school built out an entire network based off managed services using Apple devices and Google Education. At no point did they have involvement in any decision. That director quit fairly quickly into the limited time they were in leadership. Spoke with that previous director, the experiences and insight were not good.
They transition to my location, an environment built on over 2 decades of work and refinement, with zero financial support some years. 100% Windows clients running 365, 1-1 for laptops, laptop program has actually made the school more money than the annual fund. Solo IT for everything. Single handed the entire COVID virtual school.
CFO just demanded network admin access, Head approved it. (Have documentation trail)
Reason being they don't want to submit tickets for software install(ticket system was new leaderships request) and the the CFO wanted to install software after hours and was unable to. I immediately provided the account elevation and responded to all emails recipients, clearly expressing the threat we were now incurring. The response was " Thanks for explaining the risk again, but I've had admin access at all my previous CFO jobs for the past 20nyears"
Previous leadership would provide compensation if I had to work while on approved vacation, usually if it exceeded 10 hours in a few days.
Current leadership has demanded in writing that I will work outside of formal hours without seeking a similar arrangement. (Have the written request)
CFO started a cyber security insurance claim because a user got a phishing email.(Insurance security expert told CFO on the phone to stop saying we were breached)
CFO blamed me for their inability to follow up on communications to prospective MSP. All quotes, information etc were provided however CFO had a very clear request, that the MSP provides a 1-1 service of everything I do. Every MSP wanted to talk with the CFO to clarify that, as that meant to them they needed to have a person or persons on site all working hours which would be expensive.
CFO has demanded their laptop no longer be managed, no Intune, no login, no security, no filtering.
I currently have a job offer to go work for an MSP but it's PTO is really limited, and the only reason I've kept my position is because of the great time off. They created a custom position but the PTO is critical.
I also am in talks with another school but it would require a multi state move.
Thoughts? Shared experiences? Am I missing something?
Those that have left a similar environment do you have suggestions on if I walk away what are the bestthings to do to protect myself
https://redd.it/1q7zjki
@r_k12sysadmin
Autodesk Named-User without email?
Transitioning to named-user licensing since they are dropping network licensing. Can someone confirm if their students were required to have e-mail to get this working? It appears to me that e-mail may not be needed if you're doing SSO, import their accounts, and assign the licenses via the IT Admin plan once your own eligibility is verified
https://redd.it/1q7wrio
@r_k12sysadmin
TestNav and AppLocker
It's been another fun day in wondering who codes these programs.
So does anyone have any familiarity with working with AppLocker and the TestNav program in Windows? Here's the scenario: My students were supposed to be doing benchmark testing today. And mysteriously the TestNav test browser wouldn't connect for almost all of the students - something it has never done before. Just came up with an error that usually means it can't connect to the test server.
After a few hours of troubleshooting me I finally found the reason that a few of the students could connect: Their computers were accidentally not part of the OU that has an more recently created AppLocker policy on it I use to block game launchers and installs. Yet the AppLocker didn't stop the TestNav program from launching - just from contacting the server once the program had already started.
Does anyone have any experience with this that could suggest what I could add to my AppLocker policy to make an exception? Nothing I'm trying seems to work so far, and I'd rather not manually turn the policy on and off on test days. I'm trying to work with the test company support as well, but I'm guessing I might get a quicker response from people who have actually had to work with this in the trenches.
https://redd.it/1q4x63i
@r_k12sysadmin
How are you handling student 2FA when phones are banned in class? (Google Workspace)
My high school is struggling with student account compromises despite 12-character passwords and US-only login restrictions. Students are still getting popped and used to send spam, but because we have a strict no-phone law in my state, I can't use traditional SMS or authenticator apps.
I’m looking for advice from anyone who has successfully implemented phone-free 2FA like Passkeys or hardware keys for their students. If you’ve gone this route, I'd love to know how you handle the logistics of lost keys and the support load for your tech team. We are 1-1 with Chromebooks, so does using the Chromebook itself as a Passkey actually work at scale, or should I be looking at something else?
https://redd.it/1q3wgad
@r_k12sysadmin
Has anyone had issues with students and Flipper Zero’s/ RFID devices?
Backstory. I work in a K-8 and the students and I are buds. They break their devices and I fix them or they’ll need their SIS password reset. They’ll come in and chat for a bit between classes or after lunch and I was asking a few of them what they wanted for the holidays and a few asked for Flipper Zeros. I know I would’ve loved one of these when I was their age, but I’m curious if anyone’s ran into students using them for any malicious purposes.
Happy holidays everyone!
https://redd.it/1pulk2i
@r_k12sysadmin
Confused Between Verkada, Lumana, and Coram for Video Surveillance
Hey all, I’m a K12 sysadmin trying to figuer out which video surveilance system to go with: Verkada, Lumana, or Coram. I’m stuck becuase all of them seem to have pros but also some cons.
We need something that’s easy to manange, secure, and can integrate with existing school IT systems. Our goal is to monitor hallways, classrooms, and enterances to keep students and staff safe, but also be able to review footage quick if needed.
Here’s where I’m at:
* Verkada looks good for its cloud-based managment, but I’m not sure about data privacy. Being in the cloud means there are concerns about who has access to the footage.
* Lumana has solid local storage, but it feels like it might be more complex to manage and scale. It’s good for areas with strict privcy concerns but can be hard to trouble shoot remotely.
* Coram is appealing because of its AI features for detecting suspicious behavoir and hybrid storage but I’m unsure about how reliable their support is and if the AI is really effective or just fancy tech that doesn’t deliver.
Any expeirences or advice? We need something that can be easily managed by a small IT team, won’t break the bank, and most importantly, won’t comprimise on security or privacy.
https://redd.it/1pw1fde
@r_k12sysadmin
Bluebook - Verified Mode
College Board Bluebook has stated we need to enable Verified Mode on our Chromebooks by 2026 or the kiosk app will break. We deploy Bluebook to all our student Chromebooks so we’re a little hesitant to just roll this out.
College Board directions are very simple:
https://bluebook.collegeboard.org/technology/devices/chromebook/verified-mode
However when you look up how to properly set up Verified Mode from Google, it appears there is a bunch more involved:
https://support.google.com/chrome/a/answer/7156268?sjid=1055704996685098588-NC
Has anyone successfully implemented this? Was it just a matter of following Bluebook directions? Did anything else break? Any gotchas?
Thanks
https://redd.it/1pzmlyc
@r_k12sysadmin
How do you handle storing and transporting large equipment for school installs?
We have a warehouse for storage, but here’s the challenge:
* Most of our equipment comes in bulk on pallets.
* Our current warehouse vehicle can’t transport pallets (or even one comfortably).
* We also can’t move a pallet jack to the schools—most schools don't have one.
For context, installs usually happen in the summer, but we often have to order months in advance due to pricing and their fiscal-year deals. Most of our schools schools don’t have adequate storage space, so pallets end up sitting in open areas for weeks/months, which isn’t ideal for aesthetics or safety.
How do you all handle this? Do you break down pallets for transport, rent vehicles, or have a dedicated solution? Looking for ideas that are practical and cost-effective.
https://redd.it/1q2afgw
@r_k12sysadmin
K12 Tech Predictions for 2026?
https://k12techtalkpodcast.com/e/ribs-switches-predictions-k-12-tech-talk-year-end-recap/ and all major podcast platforms
Key topics include the mainstreaming of AI in K12, vendor security scrutiny (PowerSchool and Infinite Campus MFA), continued funding uncertainty, device cost, student data privacy, and looming screentime debates. Predictions? AI, screentime, vendor accountability, tighter budgeting, and more!!!
https://redd.it/1pqxah9
@r_k12sysadmin
How do you handle storing and transporting large equipment for school installs?
We have a warehouse for storage, but here’s the challenge:
* Most of our equipment comes in bulk on pallets.
* Our current warehouse vehicle can’t transport pallets (or even one comfortably).
* We also can’t move a pallet jack to the schools—most schools don't have one.
For context, installs usually happen in the summer, but we often have to order months in advance due to pricing and their fiscal-year deals. Most of our schools schools don’t have adequate storage space, so pallets end up sitting in open areas for weeks/months, which isn’t ideal for aesthetics or safety.
How do you all handle this? Do you break down pallets for transport, rent vehicles, or have a dedicated solution? Looking for ideas that are practical and cost-effective.
https://redd.it/1q2afgw
@r_k12sysadmin
Bluebook - Verified Mode
College Board Bluebook has stated we need to enable Verified Mode on our Chromebooks by 2026 or the kiosk app will break. We deploy Bluebook to all our student Chromebooks so we’re a little hesitant to just roll this out.
College Board directions are very simple:
https://bluebook.collegeboard.org/technology/devices/chromebook/verified-mode
However when you look up how to properly set up Verified Mode from Google, it appears there is a bunch more involved:
https://support.google.com/chrome/a/answer/7156268?sjid=1055704996685098588-NC
Has anyone successfully implemented this? Was it just a matter of following Bluebook directions? Did anything else break? Any gotchas?
Thanks
https://redd.it/1pzmlyc
@r_k12sysadmin
Confused Between Verkada, Lumana, and Coram for Video Surveillance
Hey all, I’m a K12 sysadmin trying to figuer out which video surveilance system to go with: Verkada, Lumana, or Coram. I’m stuck becuase all of them seem to have pros but also some cons.
We need something that’s easy to manange, secure, and can integrate with existing school IT systems. Our goal is to monitor hallways, classrooms, and enterances to keep students and staff safe, but also be able to review footage quick if needed.
Here’s where I’m at:
* Verkada looks good for its cloud-based managment, but I’m not sure about data privacy. Being in the cloud means there are concerns about who has access to the footage.
* Lumana has solid local storage, but it feels like it might be more complex to manage and scale. It’s good for areas with strict privcy concerns but can be hard to trouble shoot remotely.
* Coram is appealing because of its AI features for detecting suspicious behavoir and hybrid storage but I’m unsure about how reliable their support is and if the AI is really effective or just fancy tech that doesn’t deliver.
Any expeirences or advice? We need something that can be easily managed by a small IT team, won’t break the bank, and most importantly, won’t comprimise on security or privacy.
https://redd.it/1pw1fde
@r_k12sysadmin
Chromebook WiFi / network settings
I noticed that in Google Admin Console - I have nothing configured under DEVICES->NETWORKS. Yet I have hundreds of ChromeBooks that correctly login to WiFi when started up.
Can someone confirm that the WiFi credential entered when I first turned on the ChromeBook and ENROLLED sticks with the device - and that’s where it’s getting the correct info to login?
So why would I be using/configuring the NETWORKS menu item? Would it allow me to direct WIFI SSID per OU, for example?
I don’t want to fiddle with additional configuration if everything is fine.
THANKS!
\-jeff
https://redd.it/1put0kz
@r_k12sysadmin
accounts on IFPs
looking for feedback on the following subject.
What do you do in your schools in terms of having accounts on the boards versus no account, locking the board down and basically having it as a second screen to your computer?
We have Promethean AP seven boards which, according to Promethian does not have the ability to lockdown the guest account without removing all other accounts i.e. just having the admin account available.
My principal is complaining that students are accessing the guest account (which has no password because that’s how Promethean does it.) to watch YouTube on the smartboard. The issue is that currently teachers sign in the board with their own unique password and utilize the board and some of them utilize it to watch YouTube in their classes. I don’t really see any other option to otherwise say absolutely no YouTube or you’re gonna just have to suffer the consequences of YouTube.
https://redd.it/1puco8j
@r_k12sysadmin
Has anyone made the switch to soft-phones?
Our district has been using a VOIP PBX for quite some time and have recently been charged with looking at other options. Our PBX ties into the school intercoms for all-calls and access control system (unlocking the door for visitors via phone). Has anyone else made the move to soft phones? Which solution did you pick? What were the challenges, user feedback, and how did you solve these problems? Any input is greatly appreciated!
https://redd.it/1pqtp3y
@r_k12sysadmin
Entra Hybrid Join/Federated Sign in Issues?
Hope all is well with everyone!
I am working on getting InTune up and running for our district. I need to accomplish this without having to run autopilot or wiping the current devices. I just want to be able to enroll devices automatically. Here's where I'm running into issues.
We have a local domain with 2 domain controllers. So I am setting everything up as Hybrid AAD joined. I got everything set up with Connect Sync. Devices are appearing in the devices area of EntraID. All user accounts are also synced over. I can see in devices that the devices have gone from pending to registered.
Here's where it's a little tricky though. We are primarily a Google district. Therefore I set up federation so that users can sign into Microsoft using their Google credentials. I have tested this and it is working as it should.
The problem now is the auto provisioning into InTune. I've been going in circles looking at Microsoft's documentation and I'm at a bit of a loss.
I'm using a single test computer and a test account before rolling anything else out. I've ensured that the test account has an InTune license and is set to be able to enroll devices. This user can log into all Microsoft apps correctly. I've also verified that it is the correct account as I can see the sign in activity in Entra.and it has access to all of the correct apps.
If I run dsregcmd /status on the computer the test account is signing into, I can see that all the values look correct except the device is not getting a PRT token. The error associated with that is 0xc000005f (Realm can't be found). Logs in event viewer state No endpoint information in discovery response (under application - Microsoft - windows - AAD). It also is saying they the user isn't logged in with an EntraID account. However I can also see that the local logged in user has the same UPN and immutable IDs as what is in EntraID. I have verified that the computer can contact all the correct URLs, so I don't believe it is our filter or firewall.
In event viewer under user device registration , it shows the device has joined, but the user logged on with Entra credentials: No.
Is this possibly due to the Google federation set up that I have? Is that something that has to be changed? The active directory passwords get sent to the users Google account so all those passwords are the same. I do not have an on-premises federation service running on either the domain controllers. Is that something I need to look into doing?
Any thoughts or information as to where to look would be greatly appreciated! Thank you!
https://redd.it/1q7k2c4
@r_k12sysadmin
Games on the bus
Over the last half year it so, I've received several requests to provide iPads to students who need to be occupied while on the bus. (Please don't debate the merits of distracting students on the bus. We don't know these students and I trust the training and judgement of the people involved in these processes.) When I ask what they want installed on the iPads, they just say "games."
This has me wondering if there might be a decent, low cost, casual gaming system out there. An entry level iPad is already at least $300 even before the case, MDM licensing, etc. I figured that if there's a $50-$200 hand held gaming system that doesn't require OS updates or an Internet connection, that might make more sense and I could get 5-10 of them and just leave them with our transportation department to use as needed.
Has anyone handled this sort of thing before? Or just happen to know of a decent portable gaming system we could try out?
https://redd.it/1q7urs5
@r_k12sysadmin
Free "You Shall Not Pass" Chrome Extension for Browser-Level Bypass Protection (open source, 10k+ Chromebooks in production)
I'm a Director of Technology at a K-12 district in Michigan. I built a Chrome extension called "You Shall Not Pass" to deal with some browser-level bypass methods that our DNS filters weren't catching. It's been running on 3,900 Chromebooks in my district for a few months now, and after sharing it on our state tech listserv, it's currently deployed on over 10,000 Chromebooks across Michigan. Figured I'd share it here too.
The extension targets specific attack patterns that students use at the browser level. Tab flooding is the big one - kids figured out they can create a bookmark folder with 100+ links and open them all at once, which overwhelms filtering extensions and sometimes crashes them entirely. The extension rate-limits tab creation to 5 tabs per 2 seconds and automatically closes excess tabs beyond the limit. It also detects bulk tab creation events and cleans them up.
History manipulation is another vector. There's an attack called "Point-Blank" where a malicious page calls history.pushState() hundreds of times per second to crash filter extensions. The extension intercepts pushState and replaceState calls, rate-limits them to 50 per second, and kills the page if it exceeds that threshold.
For the LTBEEF and LTMEAT exploits that let students disable managed extensions, the extension runs DOM monitoring looking for known exploit GUI elements. When it detects them, it removes the elements and reloads the page to break the exploit chain. It also has pattern detection for Service Worker proxies like Ultraviolet and Rammerhead - when it sees those signatures in URLs or script loads, it closes the tab.
On top of the JavaScript detection, there are 25 declarativeNetRequest rules that block known bypass domains and URL patterns. This includes things like 3kh0, titaniumnetwork, mercuryworkshop, and hosting platform abuse on Vercel/Netlify/Replit. There's also a rule that catches URLs with educational keywords combined with bypass indicators (like "math" + "unblock" or "homework" + "proxy") without blocking legitimate sites like mathplayground.com.
All data storage is local. The extension logs violation events with timestamps and types, but no URLs, no browsing history, no student identifiers. Nothing leaves the device. No external API calls, no cloud services, no telemetry. The code is open source on GitHub if you want to audit it before deploying.
It's been tested and works fine with Skyward, Big Ideas Math, McGraw Hill, HMH, and other common assessment platforms. Earlier versions had some false positives with about:blank handling that broke assessment pop-ups, but that's been resolved in the current release.
This isn't a replacement for your content filter. It's defense-in-depth for browser-level attacks that network filtering can't see. Students will keep finding new methods, but this closes some gaps.
Chrome Web Store: **https://chromewebstore.google.com/detail/you-shall-not-pass-by-jim/efggnkbeomjjanjmghbadggegjemogee**
GitHub: **https://github.com/jimrtyler/youshallnotpass**
Extension ID for force-install: efggnkbeomjjanjmghbadggegjemogee
https://redd.it/1q4kflw
@r_k12sysadmin
Chromebook WiFi / network settings
I noticed that in Google Admin Console - I have nothing configured under DEVICES->NETWORKS. Yet I have hundreds of ChromeBooks that correctly login to WiFi when started up.
Can someone confirm that the WiFi credential entered when I first turned on the ChromeBook and ENROLLED sticks with the device - and that’s where it’s getting the correct info to login?
So why would I be using/configuring the NETWORKS menu item? Would it allow me to direct WIFI SSID per OU, for example?
I don’t want to fiddle with additional configuration if everything is fine.
THANKS!
\-jeff
https://redd.it/1put0kz
@r_k12sysadmin
Mac Lab with Mosyle Profile Suggestions?
What suggestions do you have to configure Mac mini profiles with Mosyle in a lab environment?
We are new to Mosyle and new to Macs in our district. We are purchasing 2 labs of Mac minis. We are trying to figure out "best practice" for setting up a profile in Mosyle for lab machines. They are not 1-to-1, so obviously a Share Device Group, but we are considering using all "Guest" accounts, so anything the student does would be removed. Has anyone done that before? Or do you have any other suggestions that have worked for you?
https://redd.it/1pvt1fj
@r_k12sysadmin
Chrome sign builder free alternative?
https://support.google.com/chrome/a/answer/16353976?sjid=2598165757223952502-NC
https://redd.it/1pw57tj
@r_k12sysadmin
Advice on Blocking Certain Senders in Google Workspace
Happy Holidays SysAdmins,
I’m trying to create a rule in Google Workspace to prevent emails from specific senders from reaching a particular user’s inbox. My goal is:
* The sender should **think the email was delivered**
* The recipient should **never see the email in their inbox**
* I would like to **keep a copy for auditing/proof**
I’ve tried two approaches:
1. **Routing rules** – replacing the recipient and forwarding to an archive mailbox
2. **Content compliance rules** – matching specific senders and suppressing delivery
However, **Comprehensive Mail Storage** seems to interfere: even when the routing rule “drops” the message, the recipient still receives a copy in their inbox.
Does anyone have recommendations or a workaround for this? Ideally, I want the email **completely blocked from the recipient’s inbox** while still keeping a copy elsewhere.
https://preview.redd.it/jrc1weo5plag1.png?width=2180&format=png&auto=webp&s=72ade903df2dc80c02df6cb188f91534f437c3f2
I can turn off comprehensive mail storage option but wondering if there is any other way
Thanks
https://redd.it/1q0mv5m
@r_k12sysadmin
Server RAM prices on 7-15-24 vs. 1-2-26.
https://redd.it/1q2ce1u
@r_k12sysadmin
Server RAM prices on 7-15-24 vs. 1-2-26.
https://redd.it/1q2ce1u
@r_k12sysadmin
Advice on Blocking Certain Senders in Google Workspace
Happy Holidays SysAdmins,
I’m trying to create a rule in Google Workspace to prevent emails from specific senders from reaching a particular user’s inbox. My goal is:
* The sender should **think the email was delivered**
* The recipient should **never see the email in their inbox**
* I would like to **keep a copy for auditing/proof**
I’ve tried two approaches:
1. **Routing rules** – replacing the recipient and forwarding to an archive mailbox
2. **Content compliance rules** – matching specific senders and suppressing delivery
However, **Comprehensive Mail Storage** seems to interfere: even when the routing rule “drops” the message, the recipient still receives a copy in their inbox.
Does anyone have recommendations or a workaround for this? Ideally, I want the email **completely blocked from the recipient’s inbox** while still keeping a copy elsewhere.
https://preview.redd.it/jrc1weo5plag1.png?width=2180&format=png&auto=webp&s=72ade903df2dc80c02df6cb188f91534f437c3f2
I can turn off comprehensive mail storage option but wondering if there is any other way
Thanks
https://redd.it/1q0mv5m
@r_k12sysadmin
Chrome sign builder free alternative?
https://support.google.com/chrome/a/answer/16353976?sjid=2598165757223952502-NC
https://redd.it/1pw57tj
@r_k12sysadmin
Mac Lab with Mosyle Profile Suggestions?
What suggestions do you have to configure Mac mini profiles with Mosyle in a lab environment?
We are new to Mosyle and new to Macs in our district. We are purchasing 2 labs of Mac minis. We are trying to figure out "best practice" for setting up a profile in Mosyle for lab machines. They are not 1-to-1, so obviously a Share Device Group, but we are considering using all "Guest" accounts, so anything the student does would be removed. Has anyone done that before? Or do you have any other suggestions that have worked for you?
https://redd.it/1pvt1fj
@r_k12sysadmin
Has anyone had issues with students and Flipper Zero’s/ RFID devices?
Backstory. I work in a K-8 and the students and I are buds. They break their devices and I fix them or they’ll need their SIS password reset. They’ll come in and chat for a bit between classes or after lunch and I was asking a few of them what they wanted for the holidays and a few asked for Flipper Zeros. I know I would’ve loved one of these when I was their age, but I’m curious if anyone’s ran into students using them for any malicious purposes.
Happy holidays everyone!
https://redd.it/1pulk2i
@r_k12sysadmin
Microsoft 365 A3 and Blocking Email
We have MS 365 A3 licenses for all users in our school. However, we use Gmail for email. I want to be able to block access to email within 365, or just disable the app completely. It's very easy to do this in Google Workspace. I would simply disable Gmail access for a particular OU. Is this possible in MS 365 with A3 licensing?
https://redd.it/1pu0tyq
@r_k12sysadmin
Self-hosted services for on-campus QoL?
I work at a very small private high school (> 100 students) as the only 'it person' (networking, sysadmin, technician, etc). I serve as the replacement for the last person who left and by the time she left, all CMS, SIS and website operation have been taken over and ran by administration. My domain of responsibility covers all onsite technology-oriented needs, where I find myself quite lucky to be.
I have about 7 yrs of experience in IT, and want to fortify the school's infrastructure. We primarily use Chromebooks, with a small handful of iPads / Macbooks. I have recently deployed a small homelab-style mini cluster from older iMacs which host a DNS sinkhole, a small junk file server, and an AFFiNE collaboration suite.
Admin is very lenient, and usually take my advice as 'the expert'. I want to try and demonstrate to the Admin that I am also capable of overseeing/reducing some of the offsite services as well.
I want to try and host more services to help with things such as network mapping, classroom management, infrastructure automation, and more. Does anyone have any suggestions?
Thankyou,
https://redd.it/1ptmzwj
@r_k12sysadmin
