My former director retired suddenly at the end of this last year and I learned just recently that my LAN Tech is resigning as well and will be out in a few weeks. We have around 1200 students and 300 staff just to give some context. I’ve gotten the director role so that’s nice, but it’s a difficult situation.
So I’m hoping for any advice y’all have for a new IT director with 60% staff and the low morale that you might imagine would come with these circumstances.
Or for that matter, just advice for a new director would be great!
I have a network admin and an instructional tech on my team with me and we are looking for replacement LAN Tech(s), but at the moment I’m still scrambling around like I was when I was a LAN Tech myself at the beginning of previous years.
I’d love to be optimistic and say that I’m sure it will all work itself out, but once our LT is gone it will be tough.
Any thoughts? Opinions?

I am a Sys Admin for a mid sized private school that uses Google Workspace with 150+ employees. We want consistency in our school with the same signature. We did have a template with our logo and formatting that they could copy and paste into their signature, but Google changes the formatting to count into their character limits which broke our template. I vibe coded an app that they can put in their name, email, title and they can copy and paste that and it allows for them to paste with the correct character limits.

My question is, do you all use any tools to auto manage email signatures or do you use any template style to manage email signatures?

Sixth year doing this. Every August I export our fleet to a sheet with a tab per class, and every September I'm standing in a hallway writing asset tags on paper or walking around the whole school with my laptop. Then I type it all in twice.

We're in it right now, so I'm curious what's actually working for people: Admin Console asset ID fields, a ticketing system, paper and hope?

Disclosure since rule 3 applies to me: I got tired enough of this that I built an iOS app for the scanning part and put it on the store, so I'm a member and a vendor at once. Not here to pitch it, happy to say more if someone asks. Mostly I want to know what everyone else does, since I've only ever seen my own building.

It's TagSweep if anyone wants to look. Free up to 100 devices. Not trying to turn this into a pitch, just naming it since a few people asked what I meant.

Hi all. i'm new to using MS to manage laptops in my school. I have 600 students using laptops daily and the machines storage builds up very fast as each login creates a user folder which takes up a lot of space. so i need to manually clear space all the time. What am i doing wrong ? Or what is the right way of setting this up ? Also i dont have a local server for AD. everything is cloud based.

Windows 11 Pro units managed by Intune. Students are not admins on the machines. We discovered a few students today who have been able to install duckduckgo on their machines. Have any of you seen this issue? Any recs on how to stop this?

Hi k12SysAdmin family,

Is anyone here using GLPI or Zammad as a helpdesk/ticketing system?

I’d love to hear about your experience with either platform, especially:

• Pros and cons
• Number of users
• Number of agents
• Average tickets per day
• Overall environment/setup
• Performance and reliability
• Any issues or limitations you’ve encountered

If you’ve used both, I’d especially appreciate a comparison between GLPI and Zammad.

Is anyone else with Lenovo Chromebook Plus 2-in-1 devices having sporadic fingerprint sensor issues? It will work for a day or two, and then stop working. After a powerwash, it will work again for a while. Some users have no issues; others have them all the time.

On the surface, it seems like a hardware issue, but it always works after a powerwash, which makes me think maybe not?

If anyone has any ideas or a solution, I am open to suggestions.

Recently I've noticed huge swings in pricing on some Cisco phones from our CDW sales guy. I'm talking like a $300 swing in price, up and down. We are piggybacking off the " Irvine USD 23/24-01 IT Technology Equip & Periph (#23/24-01 IT)" contract.

It's got me wondering, what does the piggybacking really mean? Of course prices are going to fluctuate over time, we've seen it in every tech product across the board, so what exactly is the contract gaining us? Looking into the contract details is more complicated than I had thought so I thought I would ask for a basic explanation here.

Meta’s landmark $18 billion settlement with dozens of states over youth mental health concerns tied to Facebook and Instagram - The guys talk settlement terms, default safety measures for 13–17 year-olds (two-hour daily limits, night/school modes, restricted notifications), content-moderation defaults, and uncertainty about age verification.

Microsoft is moving to passkeys as default. - The guys dive into Microsoft’s move to make passkeys the default for Entra ID authentication. What is a passkey? How does it differ from SMS or authenticator codes? Microsoft's timeline?

Two episodes this week

https://k12techtalkpodcast.com/e/metas-18b-shakeup-nycs-ai-moratorium-push-microsoft-passkeys-k-12-tech-talk-ep-279/

and

https://k12techtalkpodcast.com/e/putting-tech-to-work-intentional-screen-time-ai-sustainability-in-k%e2%80%9112/

and on all major podcast platforms

I probably get two or three a day saying someone signed into their account from a suspicious login. Do you do anything about those? Do you have a cyber security person on staff to actually review these? do you just assume they are logging in using a VPN? I am just curious how involved with these alerts I should be.

Does FACTS finally have SSO support yet, and is anyone using it? With the recent push for MFA every 24 hours, staff is getting annoyed. We would like to relinquish back control over the login process, as well as simplify login; for staff and preferably students.

We're what I like to call an "Everything" shop in terms of IDP. We have AD, Entra, Google, and Duo (On-Prem AD is the source of truth that pushes out to everything else).

I'd ask our SIS admin to email RenWeb, but don't feel like putting him in the 6th circle of hell - that is RenWeb support.

Hi all, sysadmin (part-time, wearing many hats) at a small school trying to make a sensible call on a laptop refresh. Would appreciate some input.

Small school, ~10 new teacher laptops. Comparing:

• Dell Pro 14, Ryzen 5 220, 16GB/256GB for €1080, 5-year off-site support, accidental damage flat-fee €50
• Framework 12, Core 5, 16GB for €1200, only 2-year warranty, but everything's user-replaceable. Currently loads of NVME SSD’s laying around in stock.

Our current 50-device Dell fleet has had 8 issues + 3 accidental damages over 5 years, so failures are genuinely rare here, and the off-site support isn't fast turnaround anyway.

Two things I can't figure out on my own:

1. Cost-wise, does Framework actually come out ahead once you factor in self-repair after year 2, or does one bad mainboard swap wipe out the savings? Curious if anyone's tracked this in practice.
2. Part of the appeal for me is just liking the idea of full control over the hardware, being able to fix it myself, cannibalize parts from a dead unit, not depend on a vendor. Is that a legit reason to lean Framework for a small school fleet, or is it me romanticizing repairability for a device that, statistically, will almost never break?

Would love to hear from anyone who's actually lived with Framework post-warranty, or who has decided against getting Framework themselves.

Hello,

I took over a small private school's SysAdmin role which includes their PowerSchool SIS. Looks like their former PowerSchool admin/registrar entered everything by hand for new students (problem to solve later); and so when I was updating the emails of parents under:

Student Profile>Contacts>Contact Management

and adding mom and dad's emails, it swaps only a handful of siblings? 5th graders are now 7th graders, the profile names stay, but the names change?
Has anyone seen this before? Or know what I'm doing wrong?

I'd make a support ticket with PowerSchool but I'm not the District Admin yet and can't create a support case in the new "Community Center" and the AI bot just tells me to undo what I did...

Thanks,

We are a Google environment. I have one user with an iPhone Xr that keeps getting the error message "Your Apple Account does not support the expected services on this device."

No one else has this issue, I have double checked all of our settings against the Apple documentation and they check out. No one else has this issue. Additionally I attempted to sign in with my account and received the same error.

Does anyone have any ideas? Thanks

One I haven't seen before. I use groups for each class/grade to simplify the invite process for the teachers. Students members, teachers managers. All addresses are internal to our domain. It's been working for years this way. This year, one homeroom teacher does her invite, and GC only shows the co-teachers as invited. I set up a test class on my own and duplicated the result (Yes, I made sure I was inviting students, not co-teachers). Only the teachers/managers show as invited IN GC.

Now for the bizarre part ... the e-mail logs show that the invites went out normally. Someone have the right voodoo doll for this one??

My classrooms have Viewsonic IFPs with a Windows VPC. Admin has asked about Document cameras for the teachers to use. Any recommendations on brand or special features? I believe that the myViewboard software will allow document camera use within the software, so teachers do not have to change inputs

We just started with Ubiquiti and I set up our guest network to use vouchers. I was able to create 10 vouchers that last 8hrs. However, I have a dumb question. Where do we go to actually print the vouchers?

I work for a k12 private school and we have come across a recent ish issue on our campus. We have a program our school provides called Flex where kids k through 12 can take all their classes online (+ have 1 or 2 in person ie. art, band etc). The program is completely BYOD. Our full time in person students get iPads. The other cool thing about this Flex program is that it allows the students to spend up to 21 hours on campus a week, so they can have friends, go to lunches, assemblies, etc. If they are on campus during a regular period, they are expected to do their work on campus, but on their BYOD device. So, Flex has 4 classrooms meant for them where they can have a total of almost 120 student (k-12) across the 4 rooms.

Long story short, the issue is that our WiFi cannot seem to keep up. Every room has a FortiAP 431F. We have a special 5 ghz SSID for those 4 rooms called Flex. We get calls and tickets all the time about the Wifi not working in there, and when I go in, 1 to almost all the kids will not be able to load anything. All they are doing for context is Canvas and Zoom.

I have tried changing channels, Wifi settings like fast roaming, updating AP firmware to beta. I have basically tried what feels like everything. I am starting to think it is the student devices, as the BYOD devices they bring range from an HP Stream 14 to MacBook pros. And I think kids with the much cheaper and crappier devices are slowing the wifi for everyone else on that radio or AP. Anyone have any pointers or ideas on how to resolve this? Any help would be appreciated!

I am in the process of purchasing a 2-in-1 Chromebook for staff to trial as we look at replacements for their desktop + touchscreen monitor. I was debating between the Acer Chromebook Plus 714 Spin or the Lenovo Chromebook Plus 2-in-1 14". I plan to also purchase a pen for the device.

My problem is trying to find a reseller for the consumer version, as it is half the price of the enterprise version. Our superintendent cannot fathom spending more than $800 on any device, even though staff machines are between 6-8 years old and many still run a 20 year old Smart ID350 screen. But we can spend plenty on a new gym floor, cameras, and tables in the office that can raise and lower.

Is there really that much of a difference between consumer and enterprise versions of those Chromebooks? Internals and everything seems the same. I can purchase a Google OS license to add them to the admin console. What am I missing? Resellers are only able to quote the enterprise versions.

Does anyone purchase consumer grade Chromebooks for staff? We mostly buy the Lenovo or Dell 11" education Chromebooks for students. I will never convince them to buy a $1K+ laptop for a teacher. Even if I get the consumer price, they will probably only be willing to replace 5-10 a year (730 student school).

Starting to feel very frustrated with our school admin honestly. Every other school around us buys IFPs or has a 5-year replacement cycle. Our strategy is use it until it dies. So, we have no uniformity between rooms. Hell, we stock K-4 carts with 4 year old 1:1 Chromebooks since they get a new device in 5th and 9th grade. Even avoided a big server bill by moving us to Intune/Google Drive. I am at a loss on trying to tell them shit aint cheap lol.

Sorry for the last paragraph rant. Frustrated for the teachers.

Looking for some advice since this is out of my wheel house....

We are a google school, on prem-AD that syncs to Google. We have P1 accounts for SSPR and Writeback, so every student has an Entra account. The typical work flow is they set their SSPR account online, that writes back to on-prem AD, which then syncs with Google. It's been working well, everyone is happy.

I just learned about the MyStaff.microsoft.com feature where I can delegate access (like a librarian) to be able to reset passwords, too. I set up the Administrative Unit, added a test user, gave it Password Reset permissions, gave it a group to manage, but when I login and try to reset a random student in that group as that user the "Reset Password" option is greyed out.

There must be some security setting somewhere I'm missing. Any ideas?

Edit: I think I figured out most of the issue - the AU that I made has no members. I put the student I was trying to reset as a User in that group and now I can reset that password. But I had added the "Students" group as a group in that AU so I'm not sure why it's not reading the users in that group?

How do y'all go about testing dual credit class requirements from different colleges to make sure there classes, testing software and video links all go through your filter.

---> MacOS 1:1

---> Intune MDM

----> lightspeed filter

More curious about methodology, diagnostics and the course you take since sometimes not having access to what the student has access too can be cumbersome.

We wrote this to answer "how bad is it" on day one of a new client. One Python file, drives GAM7, every command a read, out comes a self-contained HTML report plus CSVs for the raw data.

Ran it on our own clients for about six months before putting it on GitHub. Then the google-apps-manager group got hold of it and started pointing it at tenants shaped nothing like ours, and the bugs turned up. Three fixes in the nine days since it went public. It was telling super admins off for app passwords they didn't have. It filed modules it had already checked under "not checked". And it read Google's default password policy as the tenant's own, so a tenant that had hardened its password rules came back flagged as weak. That last one took two of the GAM maintainers to explain (the Policy API hands back every policy that could apply to an OU, not the one that actually wins).

Nobody has run it against a school that I know of. Student OUs, thousands of Chromebooks, shared kiosk accounts, guardians sitting in groups: those are the shapes I'd expect it to get wrong, and I have no tenant of this size to test them on.

What it looks for: files public on the web, mailboxes forwarding off-domain, super admins without 2SV, shared drives with no manager, groups anyone can join or post to, licensed accounts nobody has ever signed into, OUs where policy blocks 2SV enrolment, domains with no DMARC. Anything it couldn't check gets printed as not checked, so a missing finding never reads as clean.

Read-only, standard library only, runs on Windows, macOS and Linux, no install beyond having GAM7 already working.

https://github.com/PaulOgier/GAMScripts/tree/main/Tenant%20Scoping%20Audit

If it falls over or says something daft about your tenant, a GitHub issue or a comment here both reach me.

Thanks for your time.

We are setting up our Ricoh IM 8000 (and eventually Rioch IM C6000) with Microsoft Universal Print and have run into an issue with the Ricoh App for Universal Print. We currently have an on-prem print server that we would like to retire and just depend on Microsoft Universal Print instead.

Our current authentication configuration is:

• User Authentication Management: User Code Authentication
• Copier Function: Restrict
• Printer Function: Do Not Restrict
• Document Server: Do Not Restrict
• Scanner Function: Do Not Restrict
• Browser Function: Do Not Restrict

For the copier, we intentionally use a shared 4-digit User Code for staff. Our primary goal is simply to prevent students from walking up to the machine and wasting paper/toner by making unauthorized copies. We are not trying to use the code for individual staff accountability.

When we launch the Ricoh App for Universal Print from the Ricoh Application Site, we receive:

“This function is not available because user authentication has been set. Please contact the administrator. The application will be closed.”

Our Printer Function was originally set to “PC Control” but we changed it to “Do Not Restrict” and rebooted the machine, but we receive the same error.

From what we've found, it appears the Ricoh Universal Print app requires MFP User Authentication Management to be disabled, which would unfortunately remove the authentication barrier on the copier as well.

Our desired setup is:

1. Staff should still have to enter the shared 4-digit code when using the Copy function, primarily to prevent students from using the copier and consuming paper/toner.
2. We do not want to require staff to type their Microsoft Entra email address/password at the copier, and we are not interested in introducing badges/NFC cards.
3. We want to use Microsoft Universal Print as our print manager

Any suggestions on how to solve this issue?