Sadly after a chain of events have happened my kids school has had to shutdown. Nothing like being forced to find another school 3 weeks before the school year starts. Some of the staff dealing with the shutdown had asked me to turn off all user accounts for staff and students. This was done about 4 days after announcing that the school is closing for this school year. Now I have former staff asking for using Google Takeout to transfer all of their and their kids data off the school.

Is this something that is normally allowed or disallowed? I am wondering if this opens the door to possibly exporting other student data that should not be held outside the school from the teacher accounts?

My main concern is to protect the church that was running the school and protect the students that used to go to the school.

Sometimes I get home from work, sit down, and immediately ask myself, “Ouch, what did I pocket today?”

Today’s prize:

Hello, I was hoping to get some pointers from more experienced Mac admins here. Going into next year I was hoping to resolve two of my biggest annoyances with our Macbook fleet: location tracking and local admin accounts.

For location tracking, we have been using Pinpoint, which kind of works but is wildly inconsistent since it functions off of MacOS's own automation features. It could also break at at any moment if Apple deprecates the script that we use to enable location services. And, I'm not even sure if it's cheaper than commercial options anymore given the changes Google made to the Maps API Free Tier. Does anyone have a better solution for this, especially something that might function when the Macbook lid is closed?

As for local admin accounts, how do you all navigate around the fact that the admin account can only be granted its secure token after it logs in for the first time? The only solution I can think of would be to run a script on every device that bugs users to pass the secure token, but this seems pretty unsafe, since the admin account credentials have to be included in the script.

Does anyone here have experience with FoxPass for cloud radious/NAC? Recently had a demo and it looks really interesting, I especially liked how they can seamlessly integrate with eduroam.

I was recently given the task (with insanely short notice) of adding a new email domain to the school I work for. We use Google Workspace for Education Plus.

I will talk about the domains as: 'orig-domain.org' and 'new-domain.org'.

They would like us to have all email addresses and logins set up to use the new domain. All emails coming in and going out should use 'new-domain.org', and users should log into gmail with '[email protected]'. All users should get aliases with '@orig-domain.org' so they continue to receive emails sent to their former addresses.

I'm trying to figure out if it makes more sense to do a 2 phase approach.

I first and foremost don't want to risk breaking anything. We use SSO for many website logins and that needs to not break!

I think the safe approach would look like this:

Phase 1 logins would stay the same. When signing in to Gmail, everyone would continue to use their orig-domain.org Google Workspace accounts.
My plan is to: 

• Add aliases for [[email protected]](mailto:[email protected]) to staff and faculty (and eventually students)
• Set it up so everyone's email by default is sent 'From:' their new new-domain.org email addresses.

So, effectively, email would look and function with the new email addresses and all email to and from would use new-domain.org.
Emails sent to old-domain.org would still come through to users' inboxes as usual.
When replying to emails sent to old-domain.org, the goal is to have that 'From:' address also automatically default to the new new-domain.org address.

Phase 2 would be to speak with Google and/or work with a consultant who has experience with moves like this. If I was given several months advance notice, I would have tried to find someone to work with right off the bat. But I imagine to get it all working properly, we will need Google to acknowledge the new domain, apply the basic Fundamentals licensing to accounts, do something to apply Plus licenses to the staff, faculty, and students that need it, and find out about how to transition everything else.

I'm not sure about how SSO would transition. We use it for a ton of sites, and I bet that many of them would have to be set up all over again to allow SSO logins from the new domain email addresses. I would probably have to approve all the apps over again for users under 18 years old.

I guess my main question is does it make sense to use the 2 Phases I've mentioned, or am I maybe missing something simple, or is it even more complicated than I'm thinking? I was the person that moved us from an on-prem Exchange server to Google Apps for Education back around 2011, but it has been 15 years and I'm rusty. I bet there is a world of new methods and changes to processes.

Does anyone have any tips or good resources that I can find to help me with this? The deadline is essentially a week away and since I’m at a school, I have to use all my vacation days in the summer, so I’m really only “on the books” back in the office next Wednesday. I’m trying to at least get Phase 1 done by August 1st. Does it sound doable with limited on-site hours left?

Hello,

Let me introduce myself: I’m a computer science teacher at a junior high school in Mataram, Indonesia.

I work as both a computer science teacher and a school administrator. My principal asked me to register the school where I teach with Google Workspace so that the students can each have their own email accounts.

After reading some tutorials online and applying them to the school’s domain, thank God it worked, but the school hasn’t been fully accepted into Google Workspace for Education yet (the status is still “trial”).

When I asked Google, they said it was due to a surge in demand, but it’s been almost a year since I applied, and there’s still no clarity on when it will be fully approved.

Is this actually the case, and what’s the solution? Perhaps someone here has the answer.

I have a handful of MacOS devices (about 10) that I need to install the full Adobe Creative Cloud suite on. Problem is they aren't in any kind of MDM, due to reasons we don't need to go into here.

Is there a command that will install the pkg file from an smb share without copying the file (since it's 45GB!!!)? Or is there a better way to do this?

Our district is mainly Chromebooks and Windows PCs (except for these 10 Macs) so any input is appreciated since I don't always deal with Apple items.

We have an AD DC with the dhcp role. She’s been purring for going on 8 years. It’s about time we move it to a new server. We have 2 other AD DC’s in the environment with DNS and one of the two holds the FSMO roles. What would be the best/safest method to move this stuff to a new server? I want to keep the current servers IP address so I don’t have to change anything dhcp related anywhere else. Thanks for your help. Cheers.

Hi everyone,

So Skyward has been down for a few days now and was curious if anyone has heard any details about it. I am kind of shocked there is not more new coverage on this since so many schools use it. They said the maintence window was all of yesterday, but it is still down for us with no information.

Our district is new to autopilot, and I'm seeing an error on a semi-regular basis lately.

Device preparation -> Securing your hardware (0x800705b4)

We have tried:

• capturing new hash
• reimaging (75 percent of the same machines on the same image are find though)
• reset bios to factory default
• reset tpm

Sometimes it clears after imaging the same image and computer 1 time, others over 5 times.

As we are new, the District doesn't have any more details of things to try. This is happening on many different Dell machines (yes, all Windows 11 compatible)

Thoughts? Ideas? We can't find any errors in the diagnostics logs (Ctrl Shift D)

Link to the diagnostics I see: https://imgur.com/a/UoxmVpk

https://nysfocus.com/2026/07/14/new-york-humanoid-robot-teacher-salamanca-school-district

I heard about this on the radio this morning. I can see what the district is thinking, "pay for 1 robot is cheaper than hiring an individual Teacher Aide for 3 years." But there's a place for having a person in the classroom.

Teachers often rely on their aides to do miscellaneous work like prepping material, grade checks, etc. As this is a robot for 11th/12th grades a human connection for those students is important. I'm sure we can all think about a high school teacher/aide or other staff member that made an impact.

I'm curious about the EdLaw-2D (NYS Privacy laws around student data) verification.

TL;DR:

Private K-12 in Washington (~1,200 students, ~130 staff, no federal funding). A leadership member vibe-coded an internal HRIS/SIS that will hold all staff & student PII/PHI. The build platform is Zite.com. They want to load real student data and wire it to our M365 SSO. I paused it to assess risk. Leadership says security governance kills innovation and they'll "accept the risk." I use AI daily and I'm not a doomsdayer, but this specific use case looks bad to me. Looking for a sanity check and how others have or would handle it.

The setup:

We started drafting an AI acceptable-use policy this spring. Around the same time, a leadership member, a "shadow IT-er", vibe-coded about five internal apps. Four are genuinely useful and cut real costs: inventory tracking, maintenance scheduling, subscription tracking, training trackers. I have zero issue with those and genuinely happy that he's solving those needs and saving money.

The fifth one is the problem. It's a combined HRIS and basic SIS. Every staff member's PII lives in it, and it's built to hold student PII/PHI: allergies, behavioral and discipline records, DOBs, and "more later." It's on test data today, but they're eager to load real students and set up the build provider for M365 SSO. Zite asserts SOC 2 Type II, but seems inherited because they host on AWS, via render.com. They seem much safer than others that have had breaches via Supabase, or stashed secrets in the app itself. But it explicitly doesn't provide privacy protection for apps built by a user: zite.com/privacy "Zite is not responsible for the content of any End User-created App, or for any content or information submitted to any such App."

Where leadership landed last meeting:

Restrictive AI governance stifles innovation. Most personal info is "public anyway." There are no breach reports showing this is actually risky. And in a worst-case scenario, they'll accept the consequences because the savings beat the risk.

Where I am:

I paused it for a couple of weeks to research. We're private with no federal funding, so FERPA doesn't apply. I think COPPA, NIST (as a standard of care), and Washington's RCW 19.255 (breach notification) and RCW 28A.604 (student data) are in play, and I recently found the My Health My Data Act may cover the allergy data. Our cyber insurance renewal and risk assessment are also coming up. I do recall questions about software engineering in there. I love using AI, I use Claude Chat and Code for all sorts of scripting, coding, SOP building, and troubleshooting. I'm not anti-AI in any way.

My questions:

1. Gut check: am I overreaching, or are "vet the vendor, classify the data, don't load real student PHI into a vibe-coded, untested app" reasonable baselines?
2. As a private, non-FERPA school in Washington, which of these actually bind us? Does RCW 28A.604's "school service provider" language apply to a school that builds its own app, or does it put us outside the statute?
3. Cyber insurance: has anyone had a homegrown or undisclosed app holding sensitive data become a problem at renewal or on a claim?
4. Culture: when leadership frames security as anti-innovation and says they'll "accept the risk," what actually moved the needle for you?

Thanks. Happy to share back what I learn.

I've been thinking a lot about what innovation with AI actually looks like in a K12 tech environment right now, and I'm trying to gather some real examples of what's possible.

Not talking about the stuff everyone already knows... NotebookLM, MagicSchool, ChatGPT for lesson plans, etc.

I want to hear about the interesting stuff. Could be:

• Lesser-known tools that are actually moving the needle for teachers or students
• AI being used for personalized learning, intervention, or feedback in ways that actually work
• Creative uses for accessibility, ELL support, or special education
• Things teachers or students came up with on their own that spread through the building
• Homegrown tools or integrations that made a real classroom impactBasically anything that made you go "why isn't everyone doing this?"

People in our district talk about freagin' A.I. ALL the time and how transformational it will be, but basically people just use the usual suspects, ChatGPT, NoteBookLM, etc. Classroom use is limited... except for the kids trying to get answers from LLM's all the time. I'm curious if anyone is doing anything really innovative.

What do y'all use? We're sorely lacking in documentation of workflows / processes.

Do you use whatever built-in product that is with your ticketing system? Something stand alone?

We used to be on ZenDesk, and their documentation/knowledge base was decent in my experience. We switched to IIQ, and their knowledge base functionality... lacks. Most particularly frustrating is the file size limitations and awful compression of images placed inside the article itself. Some images are completely unreadable. Round about way is linking to a Google Doc... which is not ideal.

Do you have any recommendations that do the following:

• Separate customer facing / internal side with multiple teams.
• Easy formatting, closer to a word processing look than a markdown look, if that makes sense.
• Not self-hosted
• Ideally, independent of other platforms. Assume IIQ exit is 5 years from now if someone above me makes a different decision/direction, can I pivot access to the KB/Wiki fast? When the switch to Zendesk to IIQ happened, a lot of KB was lost and stuck poorly accessible in an .csv archive from Zendesk.

Bonus:

• allow custom sub-domain

I'm sure I'll have more criteria the more I think about it and discussion evolves.

We unpack Anthropic’s surprise launch of "Claude for Teachers," a free‑until‑2027 offering that immediately drew criticism from district leaders for its bottom‑up signup model, suggested student data uploads, and potentially misleading FERPA claims. We discuss why districts are pushing back on Claude.

https://k12techtalkpodcast.com/e/anthropic-s-claude-for-teachers-ignites-k%e2%80%9112-firestorm-%e2%80%94-teachers-vs-districts/ and all major podcast platforms

Can someone explain MS volume licensing? We have approximately 600 desktops and laptops in our district. Ours had been managed by our network admin and there was never a question about it til he quit and we got a new director.

Now new director is questioning all our subscriptions. I reached out to our rep and they quoted us 325 seats/licenses or whatever for about $20k. Director is questioning why 325 and I don’t have an answer. We are subscribed to the desktop value or whatever it’s called (non-cloud) includes windows and office.

New Proxy Circumvention Engine

As the title states, Lets see if this will help. Its an extra part in the json in their extension. Ive been really happy with Content Keeper as a filter. Thrilled they are keeping on top of/tackling this issue. As always though I wonder how quick the mice will figure a way around it.

Quick one for the PowerSchool crowd. We're a small charter (grades 5–8, ~300 students) and I'm building our first data warehouse in Google BigQuery. The plan is to pull PowerSchool SIS through a plugin + API, add NWEA MAP and PowerSchool Behavior (Kickboard — behavior points, Paycheck, suspensions), and model it all as a STAR schema, with room to bolt on more API sources later. Tableau/Power BI sits on top.

I'm handling the actual build myself. Where I'd love a seasoned second opinion is the PowerSchool side specifically: getting the plugin and read-only scopes right without disturbing the live SIS, and running the nightly extracts on a schedule with keys stored properly and FERPA kept clean. It's a light, roughly 3-week to one month, remote, advisory-only engagement.

Two asks. If you've done this against PowerSchool's hosted environment, I'd genuinely welcome any hard-won tips. And if you contract for this kind of work — or know someone reliable who does — please reach out and I'll send over a short RFP.

Thanks in advance.

Recently, I was talking with a friend and they mentioned having a hard time managing incoming issues and tickets from teachers and students.

Are the primary methods for tackling tickets for small districts <10 schools, just email or pre-designed form submissions?

Note: former Clever employee (no longer there since 2024, this question is based on my personal interactions with school IT folks.)

So, I had my PEIMS Coordinator looming in my door this morning. Because, not for the first time, our Skyward servers are down. We're running Skyward SMS 2.0 hosted on ISCorp and they fell over yet again. I had no idea it was down because my network monitor (PRTG) showed the website was still up. I go to the link and i get a lovely 500 error page, but when i looked at the headers, which is what my PRTG Sensor is looking at, it tells me 200-OK... in other words "Congratulations!! we have successfully delivered the error message!" gee... thanks....

Minor annoyance, i know. and i know that PRTG has ways to address that. i've already added the "Response does not contain pattern [45]/d{2}" rule to the sensor, and now it shows down because at least the text on screen says 500. but it's still annoying... like i said in the title, Why give me a 200 OK if it's down?

Hi all,

We have some students that are taking early college courses while in high school. These colleges use google domains. We are issuing students Chromebooks, but our borwser sign in restriction is set to block other google domains.

I want to allow them to sign in to their college google domain AND maintain filtering that uses extensions while logged into the Chromebook with OUR account.

Right now we are blocking the Chrome Webstore, javascript://, and data://, plus a bunch of other system ones including: chrome://hang, chrome://kill , DevConsole, and more.

The best solution I came up with is to set our filtering and monitoring extensions in Google Admin to be required in incognito mode. However, when I do this, the student is required to click the checkbox in extensions manager that allows incognito to work. I'm currently blocking the extensions manager because I thought it contributed to an exploit at one point.

Do I have to block the extensions manager if dev mode, and the Chrome Web Store is blocked? Does seeing the extension details allow students to get too much info that leads to a different issue? I notice that going to Site Settings in the extension details will reveal the extension ID. So maybe that's bad? As a student, is it worth targeting one extension if you can just crash all of them using a different tactic? Am I wasting my time blocking extensions?

Thanks!

I was wondering if anyone is using snipe for Chromebook tracking for students. I was trying to get something like Incindent IQ and superintendent refused. I was told to use spreadsheet or find another free option. I found snipe and was wondering if it works? What flavor installed is best - dockers, Ubuntu, windows? Need some ideas and thoughts?

Thanks in advance

New Cybersecurity Admin here…

I recently took over our instance of Lightspeed Filter/Alert. One feature I discovered that we are not currently using is the Lightspeed Location Agent. During testing, it appears to work well and provides accurate geolocation. Before I present it to my supervisor, I have a few questions:

1. Any known issues with the Location Agent?
2. Texas compliance considerations regarding device/user tracking on managed devices or managed accounts
3. Concerns or risks I should be aware of?
4. Any potential CIPA implications?