17
Reddit’s r_k12sysadmin Credits: @r_channels @reddit2telegram
What student chromebooks are ya'll looking at?
Probably about that time of year. While we still haven't quite hopped on that train of buying chromebooks yearly to cycle in we are looking at buying a small batch partially for afterschool, partially to test as we are looking to move to cycle in batches yearly. So what are ya'll looking at for options? We haven't had to great of an experience with Samsung (4) and HP (HP 11MK G9) chromebooks ourselves. Though the later could have been exasperated by the clip on cases we were using (issues with hinge cover and extra pressure on hinge screws separating from top cover).
Tentatively we're eyeballing 8 GB of RAM full stop but I'm also curious if moving to DDR5 speeds up what little capacity 4GB has to be acceptable. Just trying to futureproof in case we have to start adding in more extensions or what Aluminum OS will require.
Have MediaTek processors/wifi chips come into their own? I seem to recall the last time we bought chromebooks a few years ago MediaTek was still having some teething issues, especially on their wifi chips.
Also curious about how repairing screens with all these models that are coming with touchscreens now. Seems like most in the 8GB RAM range are touchscreens.
https://redd.it/1qd2egp
@r_k12sysadmin
Chrome OS Flex Devices Policies Not Applying
Guest mode is enabled on devices along with sign in restrictions removed even though everything is correct in GAC/OU. Genuine Chrome OS devices policy's are applied fine.
Anyone ever run into this? What am I doing wrong?
Edit: Apparently this is some sort of TPM issue even though it is affecting different models of managed Flex devices.
Anyone have a fix for this? I'm a one man shop that could use the help! Already re-enrolled a few devices and still have the same issue.
https://redd.it/1qcuryj
@r_k12sysadmin
Anyone using IPAM tools? Any recommendations?
I'm looking into IPAM tools(IP Address Management). I've explored Netbox, EfficientIP, Infoblox off and on over the past couple of years. It would be nice to have a paid support product but cost seems prohibitive in K12.
Looking to get away from IP management via spreadsheet. Additional features on some of the tools would be nice.
I'm likely going to set up the free version of Netbox.
Any other suggestions or reviews?
https://redd.it/1qcp9no
@r_k12sysadmin
Help Desk Replacement for IT and Maintenance
I wrote a help desk page in PHP/MySQL 20 years ago and we're still using it today. It's basically one form where the end user enters their name, email, and chooses a department: IT or Maintenance. The request goes to all of those in that department where it's then assigned.
I don't have the time to maintain this anymore and I'd like to move to a cloud solution that will serve the needs of both departments but be simple and cost-effective. We have 4 in IT that needs access and 11 in Maintenance.
Any suggestions on the best product?
https://redd.it/1qcpauy
@r_k12sysadmin
The most 1st world problem I've ever come across in this job....
https://redd.it/1qcp5bc
@r_k12sysadmin
Chromebook policy and checkouts
Anyone care to share their Chromebook policy? Ours will not go home with students and have to be turned in each day. I just want to make sure im not being too extra on protecting these devices. (Private high school)
Still trying to figure out the logistics of tracking that borrowing process too. Curious what others are doing for check in/outl. Thought about mounting barcode scanners on each cart but, im a one man show and know that will get annoying quick. Also thought about just having the teacher enter in each device number into our SIS during their rolecall.
https://redd.it/1qcbtj8
@r_k12sysadmin
Google Drive File Structure
This is one of the few things from a management side I wish was like Microsoft. If I want to in a shared drive have different access based upon how far in the drives folder structure I am, the user should still be able to navigate from the root and only see what you have access too, not just a random folder that sits in the shared with me section.
https://redd.it/1qbynov
@r_k12sysadmin
Retention Policy - Deleted items in email
Do you have a retention policy on items in the Deleted folder of a user's email? I am considering permanently deleting items after 6 months.
https://redd.it/1qb4ihy
@r_k12sysadmin
802.1X
Just curious, anyone else doing 802.1X on their wired networks?
https://redd.it/1qbd1bm
@r_k12sysadmin
New Year, New Cyber Attacks
https://k12techtalkpodcast.com/e/holiday-break-spike-schools-under-cyberattack-%e2%80%94-prepare-now/ and all major podcast platforms
We discuss the New Year spike in cyber attacks on schools over the holiday break and practical strategies for vacation periods - automated alerting, third‑party monitoring, suspending or shutting down non‑critical services.
Other topics include what to look for when hiring technician, the rise of remote psycho-educational testing, early findings from the E‑Rate cybersecurity pilot, vendor liability caps in data privacy agreements, and a listener email about student account compromises from downloaded apps and VPNs.
https://redd.it/1q8amqr
@r_k12sysadmin
SANS Courses
Any ed-tech folks here done one of the SANS courses in recent memory? Apparently, after many years of my asking for them in an aspirational that would be cool fashion, we actually got a grant or something to allow me to take a single course, so now I have to figure what would be at least slightly on-target for the workplace.
https://redd.it/1q5zqdz
@r_k12sysadmin
AutoDesk/SheerID Verification help...
I sincerely hope someone is able to provide a direction to go with this issue. We have been stuck in the loop with AutoDesk/SheerID to verify that we’re a school. I’m going to attempt to boil this down for simplification.
We have an email address we used to log into AutoDesk with, we’ll say it’s Aschool@domain.com. The name on this account is AMember. Reason for this is that there are 3 of us in the department and we all have access to the account. I’ve went through “verification” numerous times, but it keeps getting denied. I’ve explained countless times that there is no “name” to verify on the account as it’s an admin account and it’s not tied to an individual. Every single time we get told that the verification has failed. There is apparently no phone number to call and actually speak with someone within the education arm of AutoDesk or at SheerID…chat/email are the only options.
Is there anyone else that has experienced something like this in the past and was somehow able to get it rectified/resolved?
Thanks to all of you, I’m going to go back to pulling out what’s left of my hair.
https://redd.it/1q6lf5q
@r_k12sysadmin
MS Powerapps licensing change
I'm not sure how many out there actually use MS Powerapps, but I know our state has had several seminars during educational conferences on app development for the past couple of years. Just wanted to let you know MS announced is ending per-app licensing, with end of sale basically immediately.
https://redd.it/1q6iziy
@r_k12sysadmin
Entra Hybrid Join/Federated Sign in Issues?
Hope all is well with everyone!
I am working on getting InTune up and running for our district. I need to accomplish this without having to run autopilot or wiping the current devices. I just want to be able to enroll devices automatically. Here's where I'm running into issues.
We have a local domain with 2 domain controllers. So I am setting everything up as Hybrid AAD joined. I got everything set up with Connect Sync. Devices are appearing in the devices area of EntraID. All user accounts are also synced over. I can see in devices that the devices have gone from pending to registered.
Here's where it's a little tricky though. We are primarily a Google district. Therefore I set up federation so that users can sign into Microsoft using their Google credentials. I have tested this and it is working as it should.
The problem now is the auto provisioning into InTune. I've been going in circles looking at Microsoft's documentation and I'm at a bit of a loss.
I'm using a single test computer and a test account before rolling anything else out. I've ensured that the test account has an InTune license and is set to be able to enroll devices. This user can log into all Microsoft apps correctly. I've also verified that it is the correct account as I can see the sign in activity in Entra.and it has access to all of the correct apps.
If I run dsregcmd /status on the computer the test account is signing into, I can see that all the values look correct except the device is not getting a PRT token. The error associated with that is 0xc000005f (Realm can't be found). Logs in event viewer state No endpoint information in discovery response (under application - Microsoft - windows - AAD). It also is saying they the user isn't logged in with an EntraID account. However I can also see that the local logged in user has the same UPN and immutable IDs as what is in EntraID. I have verified that the computer can contact all the correct URLs, so I don't believe it is our filter or firewall.
In event viewer under user device registration , it shows the device has joined, but the user logged on with Entra credentials: No.
Is this possibly due to the Google federation set up that I have? Is that something that has to be changed? The active directory passwords get sent to the users Google account so all those passwords are the same. I do not have an on-premises federation service running on either the domain controllers. Is that something I need to look into doing?
Any thoughts or information as to where to look would be greatly appreciated! Thank you!
https://redd.it/1q7k2c4
@r_k12sysadmin
Games on the bus
Over the last half year it so, I've received several requests to provide iPads to students who need to be occupied while on the bus. (Please don't debate the merits of distracting students on the bus. We don't know these students and I trust the training and judgement of the people involved in these processes.) When I ask what they want installed on the iPads, they just say "games."
This has me wondering if there might be a decent, low cost, casual gaming system out there. An entry level iPad is already at least $300 even before the case, MDM licensing, etc. I figured that if there's a $50-$200 hand held gaming system that doesn't require OS updates or an Internet connection, that might make more sense and I could get 5-10 of them and just leave them with our transportation department to use as needed.
Has anyone handled this sort of thing before? Or just happen to know of a decent portable gaming system we could try out?
https://redd.it/1q7urs5
@r_k12sysadmin
Red Rover with School ERP Pro
Does anyone here use Red Rover with Infinite Vision’s School ERP Pro? If so, what is the process like for getting RR’s data (i.e. absence balances) into ERP? We’ve seen/heard different answers. Thank you!
https://redd.it/1qd0s4c
@r_k12sysadmin
Youtube Bot Error
Recently, we started having this issue on our campus where Youtube videos that are embedded in a slide show, like Canva, will get a "Sign in to confirm you are not a bot" error. The teachers affected are signed into their school accounts fully on the devices and we still get the error. Now if we use a personal Gmail account then their is no error. Also, if we use a hotspot, the error is not there either. I am thinking YT has linked our IP address to bot "stuff". The only thing that changed was over winter break we installed a new gateway, but our IP stayed the same. Anyone have any ideas? An IP change would be a last resort option.
https://redd.it/1qcvnfe
@r_k12sysadmin
Students able to access Tiktok/Instagram through Google Short Videos?
A teacher brought to my attention that while Tiktok/Instagram is blocked if a student tries to visit it directly, they can bypass that block if they go to Google Short videos and open a Tiktok or Instagam reel and be able to view it.
I witnessed this on the student's device and account. Sure enough it's blocked if visiting the site or opening it from Google results, but they're able to access it through Google shorts.
Has this issue happened with anyone?
https://redd.it/1qcu7xc
@r_k12sysadmin
Athletic Events - Streaming
Is anyone using a wireless bridge for connectivity for streaming baseball or softball? Looking to see if anyone has had experience with this. We will be using a Hudl cam.
https://redd.it/1qcqgnv
@r_k12sysadmin
Love that first paycheck of the year, that's decreased since December.
The June/July time for raises (if you get anything) causes early year pain.
Edit: Yes 12% premium increases (with coverage decreases). Was 12% increase last year as well.
https://redd.it/1qcnl2b
@r_k12sysadmin
Letting Students Keep Chromebooks Over Summer?
I am thinking of letting kids keep their Chromebooks over the summer. The two issues I see are if a kid breaks or loses it. My question for the schools that do let kids keep their laptops over the summer: how do you deal with broken or lost laptops at the beginning of the year, and is it worth it?
https://redd.it/1qc78k7
@r_k12sysadmin
Computers acting slow
Well last week everything was going good and no real issues outside a few hiccups. Today all computers are acting very slow trying to connect to dc on network. Ping is good to DC and DNS. New users login login on computers are rough taking a long time to load user on Win 11. Seeing if anyone can give me some ideas why slow.
Thanks in advance
https://redd.it/1qb1blz
@r_k12sysadmin
macOS configuring user settings
My org collects student passwords. I’d like to get away from this practice for obvious reasons. We do this as we need to log into user accounts so the Mobile account is created and then run a few policies and configure some settings in Google. We prioritize minimal user work here.
What other methods can I use to ensure privacy for users while also ensuring their machines are pretty much ready to go at pickup?
https://redd.it/1qb4nkc
@r_k12sysadmin
What do you do for fun activities?
What do you do in your department to have fun, team bonding, or just raise morale?
Do you have a night where your dept goes out? Do you have a Friday where you all sit around for 20 minutes with your favorite sodas and candy bars?
Just curious!
I'm thinking of a night at a virtual golf range (it's too damn cold to go to a regular one).
https://redd.it/1q8sufb
@r_k12sysadmin
Google 2SV Enforcement - Sanity Check
Hi all:
We enforce 2SV for all staff members via OU assignments and have for a few years now. After winter break, I noticed that when viewing staff members in the Google Console and checking under the Security tab, it indicates that 2SV is not enforced and can be turned off.
I opened a ticket with Google and they had this to say:
|Hello. Thank you for your patience while we looked into your request. I have received an update from our internal team, who have thoroughly reviewed the case and provided their findings. Google has recently announced the enforcement of the 2-Step Verification (2SV) policy. This enforcement is being rolled out for organizations using Google Workspace for Education, Workspace for Nonprofits, Cloud Identity, or Android Enterprise. As per the internal update, this enforcement is expected to take effect toward the end of January. According to the audit logs, the 2SV organization-level enforcement was removed on October 6th, which aligns with Google’s enforcement timeline. Once the enforcement date for your Google Workspace organization is reached and 2SV becomes mandatory, the corresponding changes will automatically be reflected under the user security settings. Note: Google’s enforcement settings take precedence over organization-level settings. Since the Google enforcement policy is currently turned OFF, it is also displayed as OFF in the Admin Console. At this time, no action is required. Please allow some time for the enforcement to be applied, after which the changes will be reflected automatically.|
|:-|
Can anyone else who's enforcing 2SV confirm that you're seeing the same thing I am? That explanation doesn't make sense to me. Our org's 2SV settings have not changed and it is all enforced.
EDIT**
After further investigation, it appears that anyone with an Admin role assigned (Vault search, password reset, etc) is impacted by this "glitch", so Google support may be on to something. Normal staff are enforced. Can anyone confirm with an admin account?
https://redd.it/1q5j318
@r_k12sysadmin
What Windows devices do you issue to students
We are 1:1 with our student population and have been issuing Surface Go units. I discovered that those devices are no longer made, so we are looking foralternatives. We want to stay with a touchscreen, active pen, and either a detachable keyboard like the Surface or a 2-in-1 with a 360 hinge.
Does anyone have any suggestions? If you use the Windows OS, what are you issuing to your students?
https://redd.it/1q5rfmc
@r_k12sysadmin
Chromebook Recovery Utility
Has anyone had any issues with this today? Everything is fine until it tries to write to the USB.
https://redd.it/1q6l2t7
@r_k12sysadmin
Looking for any career advice/insight
The point of this post is to learn has anyone experienced a similar environment with difficult leadership, if so how did you manage it?
For reference half a year ago I made the following post which highlights one of the many challenges.
https://www.reddit.com/r/k12sysadmin/s/FpRVi5Lycx
Private school, New head and CFO came as a package deal. They came from a school in which they had their positions for less than a year. The IT Director of their previous school built out an entire network based off managed services using Apple devices and Google Education. At no point did they have involvement in any decision. That director quit fairly quickly into the limited time they were in leadership. Spoke with that previous director, the experiences and insight were not good.
They transition to my location, an environment built on over 2 decades of work and refinement, with zero financial support some years. 100% Windows clients running 365, 1-1 for laptops, laptop program has actually made the school more money than the annual fund. Solo IT for everything. Single handed the entire COVID virtual school.
CFO just demanded network admin access, Head approved it. (Have documentation trail)
Reason being they don't want to submit tickets for software install(ticket system was new leaderships request) and the the CFO wanted to install software after hours and was unable to. I immediately provided the account elevation and responded to all emails recipients, clearly expressing the threat we were now incurring. The response was " Thanks for explaining the risk again, but I've had admin access at all my previous CFO jobs for the past 20nyears"
Previous leadership would provide compensation if I had to work while on approved vacation, usually if it exceeded 10 hours in a few days.
Current leadership has demanded in writing that I will work outside of formal hours without seeking a similar arrangement. (Have the written request)
CFO started a cyber security insurance claim because a user got a phishing email.(Insurance security expert told CFO on the phone to stop saying we were breached)
CFO blamed me for their inability to follow up on communications to prospective MSP. All quotes, information etc were provided however CFO had a very clear request, that the MSP provides a 1-1 service of everything I do. Every MSP wanted to talk with the CFO to clarify that, as that meant to them they needed to have a person or persons on site all working hours which would be expensive.
CFO has demanded their laptop no longer be managed, no Intune, no login, no security, no filtering.
I currently have a job offer to go work for an MSP but it's PTO is really limited, and the only reason I've kept my position is because of the great time off. They created a custom position but the PTO is critical.
I also am in talks with another school but it would require a multi state move.
Thoughts? Shared experiences? Am I missing something?
Those that have left a similar environment do you have suggestions on if I walk away what are the bestthings to do to protect myself
https://redd.it/1q7zjki
@r_k12sysadmin
Autodesk Named-User without email?
Transitioning to named-user licensing since they are dropping network licensing. Can someone confirm if their students were required to have e-mail to get this working? It appears to me that e-mail may not be needed if you're doing SSO, import their accounts, and assign the licenses via the IT Admin plan once your own eligibility is verified
https://redd.it/1q7wrio
@r_k12sysadmin
TestNav and AppLocker
It's been another fun day in wondering who codes these programs.
So does anyone have any familiarity with working with AppLocker and the TestNav program in Windows? Here's the scenario: My students were supposed to be doing benchmark testing today. And mysteriously the TestNav test browser wouldn't connect for almost all of the students - something it has never done before. Just came up with an error that usually means it can't connect to the test server.
After a few hours of troubleshooting me I finally found the reason that a few of the students could connect: Their computers were accidentally not part of the OU that has an more recently created AppLocker policy on it I use to block game launchers and installs. Yet the AppLocker didn't stop the TestNav program from launching - just from contacting the server once the program had already started.
Does anyone have any experience with this that could suggest what I could add to my AppLocker policy to make an exception? Nothing I'm trying seems to work so far, and I'd rather not manually turn the policy on and off on test days. I'm trying to work with the test company support as well, but I'm guessing I might get a quicker response from people who have actually had to work with this in the trenches.
https://redd.it/1q4x63i
@r_k12sysadmin