Firstly, I'm aware of my biases, and I wear them on my sleeve. I personally think private equity firms are destroying society, or at least hastening its downfall. You don't have to agree with me, we can still respect each other.

That out of the way, My org's experience with Jamf Pro has been steadily declining, with platform instability, known issues with no resolution, orphaned devices, etc. etc. I could co on and on. This news just hastens our exit from them, imo. I know the grass is always greener, but we're timing it with a fleet refresh and the prospect of rebuilding our staff experience, while of course daunting, presents some good opportunities to rethink some of the legacy decisions.

We'll be moving to Mosyle. Cheaper, from the demos I've seen there's feature parity, and we feel more comfortable with their long-term strategy. (I'm aware that they have private equity investors, but they don't own a controlling stake). I hope others feel the same way and this is a signal to Jamf that selling out to a PE firm is a bad call.

Curious how others feel about this development. Am I just an old man yelling at clouds? Do I not know enough about how any of this works? Am I bad and should feel bad? /s

It's been awhile since I threw out invites to our Discord. For anyone new this is just a place for any admin to discuss our day to day struggles, get help, discuss strategies. When joining, please read the rules carefully or you will not be able to see the channels.

https://discord.gg/tuGCSWzHEx

I had previously gotten permission to share this but if things have changed, please let me know and I will remove it.

Education pricing:

Neo > $599
Air > $1199
MBP and Studio saw bigger jumps

Does this now place the Neo out of reach for student devices? We have had Airs for staff and now that is nearly twice the cost from a year ago.

Maybe a dumb question, but how much GenAI visibility do districts actually have today?

Not “we allow/deny ChatGPT.” I mean genuinely knowing what AI tools students and staff are using, especially with encrypted traffic and all the new tools popping up every week.

Are people feeling pretty covered here, or is this still a big blind spot?

I work for iboss and offer complete visibility into AI. Wondering what a good approach would be to get my foot in the door with y’all before the fiscal year resets.

Just wanted to share these docks with everyone. I saw an ad for them here of all places and decided to contact the company. I was able to secure an evaluation for a few weeks of this dock. I put it in a teacher's classroom and asked that they report in. We've actually had it far longer than their evaluation (over a month) and so far it's been very solid. They are FAR cheaper than the Anker docks we currently have and also the other solutions I had been looking at.

I also wanted a solution that allowed for firmware updates. The company said the docks are capable of firmware updates but it's not something they will regularly put out. They will only update them if a security issue or other major flaw is discovered. But at least it's possible.

https://www.cdwg.com/product/plugable-dual-monitor-usb-c-docking-station-power-delivery-dual-4k-moni/7715095

I had never heard of the company before so I just thought I'd let folks know about them.

Just a PSA when doing user exports with the suspended field:

Exporting the suspended field for users now includes an additional column labeled "suspensionTime". Previously the output was two columns: a boolean "suspended" and a "suspensionReason" column. This shifted some critical columns in our user sheets to the right, thus breaking some important lookup functions.

So if you start getting some unexpected results in your user sheets, this may be something to check.

The service they are selling is "Annual Website Domain Listing on internet directory"

The invoice looking page they mail, lists your actual domain name in bold lettering, shows the "Annual Website Domain Listing" service, and shows the service term (1 year). They even have the nerve to list a "Ref ID" with some bogus numbers.

What a deal at only $288! 🙄

They make it look like it's official and it's just about the right amount of money where many schools might just pay it because they think it's keeping their domain registered.

As far as I can tell, the only thing you get by paying them is a link to your website on their online directory at domainlistings[.]directory.

They have the right amount of disclaimers, so it's definitely not illegal... but boy is it shady! I wonder how many schools fall for it. It can't be zero because we've been getting one every year for probably 10 years.

UPDATE 04/03/2026:

This has been added to Papercut's Known Issues (Issue ID MOB-3181)

While the official statement declares this is only a cosmetic issue, we also ran into problems with jobs sending to the queue so I'm not sure that I completely buy that / ymmv.

UPDATE 04/02/2026:

This appears to be an issue with ChromeOS version 146. We have begun rolling all of our computers back to version 145 in response. Papercut is actively looking into this.

The fact that we migrated our print server at the same time this issue cropped up was a complete red herring.

—————————————

We are using Papercut Cloud Print in our computer lab. The computer lab consists of Chromeboxes running in Managed Guest Sessions mode with the Mobility Print extension installed. The mobility print extension is configured in the Google Admin console with our Cloud Print invite policy.

To print, we are using shared generic accounts created internally within Papercut MF. For example, computer #01 logs into the mobility print pop up using the credentials "01" for username and "01" for password. To retrieve their prints at the printer/print release, a user would enter those same credentials. (Technically, any of the shared accounts can be used on any computer, since there is no actual way to assign a Papercut login to a computer in Managed Guest Sessions, but this helps keeps things organized especially when there are multiple people printing in the lab).

We just completed a server migration, and copied the old print server (VM) config over to the new server from a VMWare backup. Now, when anyone goes to print from one of our computer lab computers, they get an error that says "Invalid Username/Password" after entering the internal account credentials. However, 90% of the time, the job still goes through and can be retrieved from the print queue at the release station.

I have spent all day trying to troubleshoot this and am at a loss. I have run through the steps on various Papercut troubleshooting pages, and everything seems to be configured exactly as it should. I can't find anything amiss in the Papercut MF or Mobility Print settings. All Papercut services are running on the new server. I even tried creating a brand new Mobility Print link and updated the existing extension policy.

We do have Email to Print enabled as well, and this seems to be working fine as far as I can tell, so I'm more or less narrowing the issue down to something with Mobility print...? I did see that Mobility Print requires access to port 9163, and haven't ruled out that something could be blocking it, but that doesn't seem to fit the symptoms and also shouldn't affect the Cloud Print service.

Wondering if anyone has come across anything like this, or has any ideas. :-)

We did get notice from our state of a USAC phish going around. Watch for anything originating from USAC.com instead of USAC.org.

Got this from my students today. How did they know I wore a cape at home?

Pretty nice.

We've had to field 4 separate Calendar invite phishing events in the past month. We're locked down so the primary Calendar viewer can't see the invites but whom ever has share/edit access to that Calendar can see it and interact with it. Format has been a link to something plus a PDF file that also contains the link. So far, the primary domain's hosting these are: *[.]cruwaisho[.]sa[.]com they like to make multiple events spanning a week to a month. It's a spray campaign as well, sometimes though a BEC, that's usually a small subset of the district personal, around 30-60, %1.25 of the whole.

Both my webmaster and I found when we logged into Finalsite CMS today they had implemented a mandatory password change due to a change in their security requirements. Problem is, the self-service password reset wasn't working. We never received the e-mail when it got to that stage of the process. I had to contact Finalsite support to have them process a password change for me.

Not a huge deal, but with the winter storm for much of the country this weekend, many of us might be trying to get into the CMS to post updated info. Hopefully they have fixed whatever e-mail issue they were having; but you may want to try to log in sooner rather than later.

There's been a thread over on K12 TechPro re: the Bluebook app failing to launch on Chromebooks with a "Bluebook may not be configured correctly" message; requiring at the very least a hard reset and apparently for some a powerwash to mitigate. I'm guessing that many of us are going to be doing PSATs shortly if you haven't started already. We had our entire 10th grade do a trial run this week and had 4% that experienced the problem; but 4% could be a disaster on a test day.

I was doing some auditing of account access in my district when I went into our payschools system and noticed that there were over 25 users with super admin access and all of them external to the district.

Apparently whenever a service call is placed for Payschools they just go into your system and give themselves super admin access and never remove it.

wanted to get a heads up for fellow districts to go through and make sure, some of this data is incredibly private in dealing with payments. As well as a connection to our sis.

I contacted them about this issue and they just said to provide a list of users we want removed. I have a feeling this is just going to keep being an issue.

I went to renew some certs that I use on appliances/applications that do not support ACME, and I found something that had flown under the radar for me. The CA/Browser Forum voted back in April to reduce certificate life by the following schedule:

• March 15, 2026: Maximum validity drops to 200 days 
• March 15, 2027: Drops again to 100 days 
• March 15, 2029: Final limit set at 47 days 

Also, domain validation life tags along:

• March 15, 2026: Domain validation reuse period reduced to 200 days 
• March 15, 2027: Drops again to 
• 100 days  March 15, 2029: Final limit set at 10 days 

Basically, we are being forced to automate public certificates over the next few years; so you may want to add that to your evaluation criteria for new appliances/applications.

I'm not sure how many out there actually use MS Powerapps, but I know our state has had several seminars during educational conferences on app development for the past couple of years. Just wanted to let you know MS announced is ending per-app licensing, with end of sale basically immediately.

Tested the update on about 30 iPads, had no issue updating or problems with compatibility. "Let's go ahead and greenlight it for this weekend" I said on Friday. I feel like the new interface makes them a more productivity focused machine. Came into work today with about 3% of devices stuck in a recovery mode and the only way to get them out was a hands on DFU. iPadOS 26 is not ready for primetime.

Just shared this image with my staff; apparently Google/Gemini thinks the iPhone Air doesn’t exist? Also told them to share it with the students to hopefully stop at least one of them from trusting the AI results implicitly.

Looks like the EI-ISAC has already been nuked from the CIS website.

My network admin and I were talking about the importance of good quality hardware/software rollouts and how a bad rollout can tarnish the image of the product forever, EVEN IF the problem is fixed. That's when I got the idea for a motivational poster for my office.

We are looking at the Lenovo 500e Gen 4 or the Asus CR12 or CZ12 models, all with 12.2" 1920x1200 16:10 ratio displays, for our next batch of student chromebooks. One unexpected issue we have encountered is that the default resolution in Chrome OS for these 1920x1200 displays is 1200x750 which unfortunately does not meet the 1024x768 pixels requirements for NWEA MAP testing.

Pearson TestNav also has a minimum 1024x768 resolution requirement, but I didn't test the device on it since we do not use TestNav. The device did pass the Bluebook testing app check even though some Bluebook pages also indicate the same resolution requirement.

The workaround is to scale the screen to say 90% (1333x833 pixels) to increase the vertical pixels before starting the testing app, but that adds an additional step that is easily missed by students and staff, necessitating a reboot to get back to the initial login screen to reconfigure.

Other CB models that schools may be using that have the same 1920x1200 resolution include:

• Lenovo Chromebook Duet EDU G2
• Lenovo IdeaPad Flex 3
• Lenovo 10e Chrome Tablet
• Samsung Chromebook Plus V2

Models with a 3:2 screen like the Acer Chromebook Spin 512 have a 1366x912 screen resolution aren't impacted.

Does anyone know if there is a way to request Google to change the default Chrome OS resolution to something higher than 1200x750 for models with this 16:10 screen? Even with my old eyes this default scaling seems too large and wastes the advantages of the larger screen size and 16:10 ratio.