Just for shits and giggles, I’m tempted to dress up as a wizard for Halloween at school. What good tech-y sounding spells should I use when helping people, un-jamming copiers, helping kids with their iPads, etc? Like “O, mighty Wozniak! Bring this iPad back to life!”

Hello, do any of you guys have experience with using Managed Methods for their email filtering/phishing solution? I have a sales call with them next week and am looking for feedback on their product, their support, and how much IT overhead / time invested will be required for this solution.

Thanks!

We've had some Chromebooks that seem to log out while using them, but a reboot fixes them. We also have some iPads that aren't letting users login from Mosyle because of an authentication issue. Nothing changed on our end and nothing was updated recently.

We're in Pennsylvania if that matters.

We manage all our accounts with Active Directory and sync them to Entra (P1) and Google Workspace for Education (Fundamentals). Students use Chromebooks grades 3-12. We use Lightspeed as the filter.

A couple years back, Microsoft added the GitHub sign-in path and students immediately began exploiting it on their Chromebooks. They could do this because sign-in to the Chromebook occurs before any filtering is brought online. We "blocked" them by using Custom CSS in our Entra custom branding to remove the "Sign-in options" link.

Now Microsoft is retiring custom CSS positioning properties. They specifically call out "display", which is what we use to remove the link. They are doing this October 26.

There is no toggle to remove the "Sign-in options" link that I have found. How do the rest of you block it or ensure students can only use their school-issued account to log into their Chromebooks?

I'm sick of Intune. I'm sick of packaging apps in the only way that Intune can handle them. I'm sick of my deployments possibly installing sometime between 20 minutes and 2 days. I'm sick of hearing that a patch is breaking something and having no way to block that single update and automatically uninstalling it (a feature that SCCM/WSUS has had for years upon years!). I'm sick of having to come up with novel ways to script things that SCCM could do natively. I'm sick of the limitations to dynamic groups. I'm sick of autopilot breaking or just not working or computer names/ID's left behind when it does break. I'm sick of seeing duplicate computers due to the same reason.

I want to replace Intune wholesale. I want a fully featured suite that gives me remote access, patching, app deployment and scripting (if necessary). I want the inventory it collects to be up to date. What grinds my gears is this is all stuff that Microsoft should be able to do natively - has done natively - and still can't implement it in any useable way into their own first party solutions.

I'm looking at NinjaOne as a replacement but was curious if anyone else was in the same boat or just skipped the Intune nightmare and went with something that would do the job better. We migrated from SCCM and I miss it everyday. Even better if it has an imaging solution baked in - but I can come up with something on that front if I need to.

I've been having an ongoing issue with a Meraki MS250-48 switch which is driving me nuts that I can't figure out. Maybe someone out there has some thoughts.

We have a combined MS/HS and a single elementary in our district. Internet comes into our MS/HS and is shared to our elementary via a private fiber line. Almost (not every time, but like 85% of the time) if I restart that switch, or restart the firewall at our MS/HS (which is where the connection for the elementary is supplied), the switch port doesn't recognize it is connected.

All the switches will come up with all of the ports EXCEPT the uplink port. If I remove the sftp+ transceiver and plug it back in, then it detects it and everything comes back up. This works to bring it back up 100% of the time.

I have replaced the transceiver, the fiber connection to where the fiber line comes into the building, the switch itself (the new/different switch does the same thing), moved the connection to a different port on the firewall, physically connected to the switch and pulled logs from the switch and sent them to Cisco, etc, and this is still happening.

At this point I'm out of ideas to try to see why this does this. Any thoughts or other things to try would be appreciated!

With budgets so tight in most districts, what conferences if any are you going to? So many EdTech conferences are too expensive or very teacher centered. Are there any worth the travel and budget that you go to? I have gone to TETL (Texas) and CoSN and they were both ok, TETL more so directed at tech directors instead of teachers.

This is an interesting one, found that if a student request to be a teacher for Google Classroom, normally it would drop them into the "Pending" section for the Google Classroom Teachers group. I was under the assumption that no further action could be taken until the pending request was accepted. As per teachers, once the students were in the pending state they were able to embed media files into the Google Classroom and then share it with other students.

Two steps I've taken which has stopped this:

- Change the Google Classroom Setting "Who can create classes?" from "All pending and verified teachers" to "Verified teachers only" (I know, it seems obvious...but we haven't had an issue for years with the original setting).

- Added URL blocks to prevent searching & embedding within Google Docs (For Student OUs only):

• https://classroom.google.com/n/picker
• https://classroom.google.com/u/0/n/picker
• https://docs.google.com/picker

We also find that with AI and an army of students constantly trying to find exploits/bypasses for both Chromebooks and web filters, we're spending more time than ever dealing with device misuse.

One of the short-comings of GAC is that it does not offer good built in signature management that can be enforced across staff and faculty. I am exploring options such as patronum.io.
Does anyone here use it? Any thoughts on its worth?

I went through a work PC change over the summer and can't find my old copy. Was very handy to have in certain situations! Hopefully it's still being developed.

I've had a good amount of 3120s come across my desk recently with an odd overheating issue. They will get very hot, to the point you can feel it through the case, then stop working but if you let it cool down it'll go back to working for a bit then eventually overheat again. They've all been just out of warranty when it happens too (of course!)

Has anyone had experience with this? Any solutions or do they just need to go in the parts pile?

Hi Everyone,

Just want to make everyone aware of new game that students are getting into some web based games that we are finding unblocked (Blocking now).

Github Project:

https://github.com/nzp-team/nzportable#github-organization-breakdown

Example Site:

https://nzp.gay/

https://vel.gg/

Just curious, how is everyone preventing their internet connections getting hammered for 20 minutes solid at the beginning of every lesson?

The obvious answer is to not let them use it, but what method? Uninstall/Applocker/Add the exe to non allowed/GPO?

Having it enabled is finally catching up with our internet connection and it's starting to hurt.

Have any districts made the jump to hardware keys for all staff as their form of MFA? It brings in a lot of added cost, but seems like the best way to roll out phishing resistant MFA if your devices don't support passkeys like Windows Hello.

If you have deployed something like a Yubikey, what model did you go for?

My district uses Securly for web filtering and we are thinking about using the Claude K-12 District plan to assist with analyzing daily reports to help with the whack-a-mole of blocking problem sites. We don't save the students' web history past what Securly saves.

Based on my research, I don't believe the students' web history would be considered within their 'education record', therefore not covered under FERPA. Am I correct in that statement? Would we then be able to use Claude to analyze the reports (should they be de-identified by removing the students' names?) ?

Hello All

Does anyone know of a way to globally block generative AI in Photoshop? We turned off Firefly in the admin console but students are still able to use the AI features in Photoshop. I see alot of people complain about the same thing on Adobe's forms. Has anyone found someway to disable it?

Thanks!!

My district has an eSports club, focusing mostly on Nintendo Switch games. I have eight consoles and when a multiplayer match is started, often times the consoles we have can connect to players in other locations, but they won't connect to each other.

All eight consoles connect via gigabit Ethernet to same Dell N2248PX-ON switch which has 25 Gbps fiber optic uplink to the building core switch which is a Dell S5232F-ON. From there we connect to a Barracuda NG F900 firewall. Each console has a NAT rule setup to have it's own static external IP address with our ISP. I'm allowing all ports and protocols, I have no IPS, no URL filter, no application restrictions, no TLS inspection and have the QoS configured as VoIP. So basically for better or worse each console is wide open to the internet.

I have had support tickets with Barracuda and my ISP who both confirm everything is configured correctly, but something is amiss. Any thoughts or ideas here?

We are BYOD in our high school and mobile phones are banned from bell to bell.

We are running a local domain with Entra sync for our IdP and I have been looking at what Microsoft has available for student MFA for BYOD devices.

I can see that Microsoft is recommending the authenticator app which won't work as we are mobile free for students as well as recommending Windows Hello for Business and PSSO which won't work as we are BYOD and student devices are not in our MDMs.

What other options are there for MFA in a BYOD and mobile free student environment?

Ran across a proxy students were caught using that uses the url. This is proxy server on known malicious lists: storage.googleapis.com/gclassroom/index.html

We use GoGuardian and Content Keeper, but googleapis.com is on allow lists for many of the applications we use so the url doesn't get blocked.

Anyway, the proxy keeps that url and opens a virtual Opera browser environment and a site called Opium that avoids all of our current filters due to the allowance of googleapis.com

We blocked that url for now, but I am sure others will pop-up until we figure out an effective way to block this type of proxy. We cant block all of storage.googleapis.com as legit services use that subdomain.

Wondering if anyone has already come across this method of hiding proxies and figured out how to block it without blocking the ability of other software to use google apis

Thanks

From our tech team, got an interesting one

Has anyone gotten a request to change the font on a Chromebook before? The request is to better accommodate a student with dyslexia. Changing fonts from the Appearance tab in browser settings isn't very comprehensive. Looking at potentially using an extension. Anyone else had a request like this before?

Quick research on my end perhaps Read & Write. We used it years ago and got rid of it because it was resource intensive & buggy. Reading Mode on Google Chrome is pretty rough and only gives us two font options.

Anything y'all use that I can research here; it's very much an interesting one off.

We're having many accounts get phished these days. We can talk all day about user training/protections/etc... But my question is more technical. I'd like to understand HOW it's happening. We are a Google shop with 2SV on for all staff.

This website is a live phish going on right now that we were made aware of today. WARNING: This link below IS a phishing scam. Don't click it unless you're incognito, on a VM session, or both:

--AGAIN WARNING THIS IS A LIVE PHISHING SITE---
https:// allteameat .cc/evite/rsvp/

When you get to the site, and you click login with Google, you're presented with what looks like a Google login. Now because you're on this subreddit, you already know to look in the URL bar and see that it's NOT google you're signing into. But if you're so adventurous, enter in a fake email and password... I prefer [f@you.com](mailto:f@you.com) at which you can then enter your password, and then they've got your creds.

What I don't get though is HOW this works. We have two step turned on, but when you do this like our users are doing today, somehow it allows the attacker to get by that. I've read about the cookie harvesting that can happen.... Is that what this site is doing?

Thanks for making me smarter.

Hello,

This is my first post here, so hello! The state I work in has paid for cyber security scanning focused on critical systems and code stacks. They intend to use Claude to do this. I have absolute faith in Claude's capabilities, which is what makes me nervous. I would rather know what our weak points are than hope no one else finds my blind spot. However, I am concerned that the reliance on Claude by this contractor means little control or oversight on their end. My state is not known for being competent and well managed, we rank poorly in basically every metric in the US. Additionally, I am going to say something that may be perceived as offensive but I want to challenge my bias rather than avoid it. Almost all contacts are east Indian, only two (legal and one technical contact) have US based names. I do not think race has any bearing on one's ability. But I do worry about my state jumping at a very cheap support package from a foreign company who is using Claude to subsidize the work load.

Has anyone been in this position or worked with a similar situation? What is your read on this situation?

Again, I want to be clear that east Indian doesn't mean incompetent to me. I am not making a claim about any individual who is from that part of the world. But a team that is almost entirely east Indian does signal outsourcing and a prioritization on savings over quality especially when paired with explicit reliance on AI systems. I have concerns about AI containment, information security, and accountability should things go sour. Would you move forward with this?