theCrystal’s Move to the Cloud Manual

Updates neededVersion 2.3 (Sept 2016)

1. Write Appendix 4: School records in 3652. Publish

a. Crystal web siteb. Proof read…

i. MOE team ii. Hurunui Beth

Chapters:

1. The Vision[Target audience: Principal and E-Learning leader]

2. Serverless schools (aka cloud computing)[Target audience: School Senior management team}

3. Steps[Target audience: stakeholders]

4. Conversion to a cloud environment … management issues[Target audience: E-Learning leader]

5. Workgroup Networks – practical[Target audience: School - In house ICT support]

Links

Crystal identity site Crystal standards (TaaS) Crystal web site Crystal FAQs

Appendix:

Appendix 1: Scripts Appendix 2: ITIL Appendix 3: Budgets Appendix 4: School records in 365

Chapter 1- The Vision.This is Geoff’s interpretation and is unlikely to match the actual reality although he would like to think so.

Crystal evolved from the Nelson Marlborough Loop to meet the demand for some digital services not provided by the N4L.

In the meantime, pressure has been growing from within both the education community and other government services for better data driven management and services.The MoE identity service (ESSA) failed to meet these growing demands.

The MoE have been working to develop a scenario to meet these demands.This scenario has three elements each with its own vision, timeline and support team .…

a. Cloud migration Vision: Increasing the MoE are providing the ICT infrastructure needed for schools to

operate in the digital environment…. virtual cloud servers are just the next step. Drivers:

i. The general move from local servers to the cloud environment.ii. Why spend money on a server infrastructure if it is not used.iii. Microsoft is offering incentives for schools/MoE to move to the cloud

environment. Timeline:

i. 2016: Proof of Concept trials with a few schoolsii. 2016/17: Process documentediii. 2017: Approved suppliers may implement the migration process.

Crystal action: Crystal has been providing this service for years but is now formalising the process with this document.It should be noted that Crystal definition of the migration is more extensive than the MoE’s … Crystal includes multi-cloud (not just 365), SSO (Single Sign On), user name and password synchronisation and automatic provisioning (cloud account adding and editing).

b. Data aggradation Vision: Data driven learning and decisions require secure valid reliable data.

At present this is impractical so the system is looking to …i. Commercial products that can meet aggregation expectations.ii. Aggregating SMS data. This is current MoE work stream.iii. A cross system IAM (Identity) toolset that will permit this process

Timeline: Term 3 2016 Proof of concept trial (Nelson Girls) with a commercial product. Yet to be evaluated.

Crystal: Ideally Crystal could pass many of its services across to a commercial product however schools need to be assured of the support and funding streams before committing to this process.

c. IAM

Vision: To build a IAM system that federates with Real Me and other government departments including MoE, NZQA, Online testing, TKI etc.

Drivers: Interdepartmental and data driven decisions cannot happen without this. Timeline: 2018 Proof of concept. Crystal action: Crystal will have to hang in there until more is known. Ideally Crystal

could firstly morph to a compatible system as the MoE’s system and from there fade away as the MoE new system grows in functionality.

Conclusion: Crystal will slowly pass its services across to these emerging initiatives over the next 2-3 years. Crystal charges and functionality will slowly diminish as these new services pick up the load.

Chapter 2: Serverless or Cloud based digital Schools

Keywords: Serverless, Cloud

Premise:Schools need to ask the question- “do we really need our expensive server infrastructure” especially when the MoE is supplying a free alternative?

This paper is for schools that have no perceived need for servers and do not require the school to have total ICT assets ownership... aka cloud based ICT services.

On site server costs average out to about $20 000+/year.Try working out a CBA (Cost Benefit Analysis)- you will be surprised.

Schools with rolls less than 700 should seriously consider this option.  Many Crystal schools are already well down this path … tick off the steps and see how far

you have to go?

Assumptions:

1. Schools should not rely on one vendor based cloud solution (Microsoft, Google, Amazon)o Why?

1. Demands, needs and vendor solutions change rapidly.2. Schools need to ensure interoperability and federation (aka can change and

work between Clouds easily).3. At some point the MoE will also start to work in this space … so systems

must be able to merge with whatever emerges.o Options?

1. A possible emerging MoE model2. Commercial product: Edsby/Clever3. N4L’s Tahi4. Crystal

2. Multi cloud … school should have automatic, interoperable and provisioning management on multiple clouds including … 365, AccessIT, CareersNZ, Chromebook management, COL groups, NZnet, Dreamcatcher, Eduroam, SMS’s, ETV, ClickView, Google Classroom, Google+, Hapara, Moodle, My Portfolio, Sumdog, Tuakara, Wikieducator, N4L F5 remote access, NZQA, N4L filtering.

3. Automatic user provisioning, password management (including SSO when possible) and data aggregation should be an expected aspect of a Cloud based system.

4. There should be an accompanying active menu linking all content in the different clouds and resources.

o Options?

1. Commercial product: Edsby, Clever.2. Crystal Launch

5. There must be an associated IAM (Identity and Access Management) tool set that can manage multiple clouds, identities, aliases, roles, logons, permissions and rights.

Long term it could be expected that one product be able to manage these demands. Currently the options are …

o The MoE is considering a IAM (see vision) but this model has not been developed to

the point where functionality can be described.o AZURE – potentially this could meet all expectations but currently it cannot (too

immature?) at managing SSO, permissions and federation across all clouds.o Edsby – should be able to manage expectations but is an overseas brand and the

MoE do not seem to looking for Edsby to fill this role.o Crystal uses a shared AD (Active Directory) supplemented by a full SQL.

It is intended that Crystal continues to use this model until one of the above options become mature enough to take over.

Note: Resources should be used to benefit learning not to build empires based on brand.

The Issues:When a school addresses this issue as to whether they can go  'serverless' there are eight considerations. 

1. Identity Management (IAM): o In theory a school does not need IAM (aka Usernames, passwords etc) but in

practice effective educational cloud services is required to know the exact identity, associated aliases and roles of the different users.

o Without an IAM system users will have many logon names, passwords and roles (aka

different digital Identities) inevitably resulting in confusion, frustration and compromise in the classroom.

o In 1:1 (one person:one device) (eg TELA laptops) or BYOD environments the user

and device identities effectively becomes one and can be managed as such. In practice this means that devices (aka also users) can roam in a secure,

valid and reliable manner.

2. SMS's ... Use a cloud based SMS.

Primary schools have multiple choices – no issues. Technical centres tend to use an adapted SMS. Secondary school have limited options ...

Wait ...  until the MoE creates a central repository of student data Use a cloud based system such as Edge or Assembly. Lease a hosting option over fibre. (e.g. EdSerf).

Option 3 seems to be the best and easiest choice until option 1 become available.

3. Secure storage ... hosting critical documentation using secure environment.

What type of information?

o Often secondary schools have NZQA and other confidential documentation that

requires secure archiving. o Special schools also have a requirement for secure storage (e.g. ORS data). o Email records: Schools often have policies where staff and management emails must

be archived for a finite length of time.

Where can they store that information … where they can ensure full sovereignty rights  

Historically Crystal serverless schools have stored critical data on EdSerf (a private cloud owned and managed by a collective of Nelson schools).

Although there are commercial options schools still favour this option on the premise that is a trusted environment and is easier to manage data.

4. Printingo Printing in schools with more than 3 classrooms usually use a server orientated

device called a “Print Server". A print server caches and manages print jobs a central point which means there is only one point you need to go to manage multiple users, devices and printers.

You don't 'NEED" a print server but once you get above 10 devices it makes life so much easier.

There is a strong argument for heavily reducing the paper printing demand in a digital environment ... thus eliminating the need for a print server.

It is suggested at the same time that you address the BYOD and roaming cloud printing environment.

o Options availablePrint server can only run in the local environment (aka on site). Cloud printing is not yet robust enough for heavy print loads.

Buy a new print server from your vendor. Recycle an old device (server) as a standalone server ($200?) Ask your Print support company to install and remotely maintain a local print

server. Fuji Xerox offers this option (mostly free).

<< I haven’t seen a completely cloud based solution for schools with rolls 200+ yet. Most serverless schools have recycled their old servers into simple standalone print servers while waiting for a solution. Some print companies will look after this server remotely – this seems a good workaround.>>

5. ICT supportMuch of the benefits of moving to a serverless  digital environment is that ICT support costs are significantly reduced ... but there will still be some in-house jobs that still need to be done.It is VERY important at this point that the reader notes the appendix documents in order to understand the nature of these jobs

6. Network Management Utilities:

o These network utilities include DHCP and DNS and perhaps print management.  

The standard methods of managing this in the N4L environment is to...

1. Request the N4L to manage these services (free) on their firewall/router device. (preferred option)

2. Use a small device such as a MikroTik router (<$100) if you want a local DNS.

o Monitoring...

It is advisable to have a monitoring system in addition with a secure remote access service (N4L F5 remote access service).

Crystal offers a free monitoring service. The N4L F5 remote access service is free and secure if a little clumsy. The N4L install a Raspberry Pie for monitoring at each school but this is not

available for school use however the N4L do have a limited set of monitoring tools.

Chapter 3: Steps

1. Strategic ICT plan ... Have you got one? If not contact the Connected Advisory Group and build one.The school should do this to avoid false starts.

2. CBA (Cost benefit Analysis)Work up  two lists ...

1. A  timeline of what needs to be done and when ... if you go ahead.Is the timeline practical?

2. A financial list of Pro's and Cons (known as a CBA - Cost benefit Analysis) to see if it worthwhile.Remember to include ... capital costs, ICT contract costs, teacher and teacher aide time

3.  Checklist ... have you checked on these?

o Teacher Aide ... have you a TA (Teacher Aide) that can do the level 1 support jobs

It can be expected that this person will graduate to level 2 support but have a support fund  in the meantime. (see appendix- ITIL)

o Wireless: Most wireless systems do not rely on your server however it pays to

confirm this with your ICT support.Ideally wireless and BYOD functionality, user lists and passwords should be driven by the IAM system.Ask your ICT support about this?

o Web site: Where is your school and library web sites hosted? If it is on your school

server, you will have to move it to the cloud.

o Library: Where is your library system hosted? If it is on your school server, you will

have to move it to ... A cloud based library system (e.g. Koha or AccessIT)

The preferred option.or

Host it on a server farm (E.g. EdSerf)or

Host it on a standalone local server.or

Leave it where it is.o Storage: This used to be on your old server usually in the 'Shared' or 'Home' drive

format. The school will have to move their local file structure and its contents to a

cloud based environment.Most move to Microsoft 365 using the OneNote  toolset especially build for this. (see Appendix)

Users need to be taught how to access their cloud drives using the new cloud vocabulary.  Allocate some resources to do this.

o Personal storage: This should be based in the cloud. Google, 365 and Moodle all

offer unlimited storage with the IAM system keeping it secure.  It is usual that this be used for personal storage space. User should be responsible for their own backups.  Allocate some resources to ensure users do this..

o School: The security and level of access are the main factors here

 If the data is not confidential (resources, minutes etc) then cloud storage (aka Google/365) will suffice (see Appendix). 

If the data to be kept is very confidential (IEP/ORS reports?), access needs to be verified (NZQA?) or needs to be mirrored for redundancy then the school should be looking for either ...

Some form of local storage (with backup). USB hard drives can be a short term solution where the

access management requirements are not high. Leasing space from a server farm

Secure storage space can be leased from EdSerf. If controlled and managed access is important a server can

be leased from EdSerf at a minimal cost. Using Crystal file service for small volumes with access would be

managed by Crystal's NetAdmin. 

VendorsThere are currently only a very small number of vendors that offer this cloud migration service.

Crystal provides a full cloud based alternative using a hosted network with its own built in IAM (username) and SSO (Single sign on) system called NetAdmin.

o NetAdmin. and it associated hosting system is completely in the cloud.o Crystal does offer a network monitoring service that can help with managing

serverless schools.o Crystal can offer a small amount of secure server space to hold critical school

documento Crystal has a long history offering these types of services and can offer a CBA (Cost

Benefit Analysis) upon request.o Crystal populates your wireless system.o Crystal provides...

Free training on Crystal services. Training and online support for L1 and 2 support people. Crystal can help with L3 remote support but remember  you should get the

best L3 person for the job.Example: Print issues- use your printer support person.

MoE plan on offering at least some of these core services in the future EdSerf  ... offering hosting services at a competitive rate. Commercial vendors ... tend to focus on a one supplier (usually Google Apps or Microsoft

365) with the associated advantages and disadvantages.

Chapter 4: Conversion to a cloud environment… management issues(Practically this means moving from a Windows or SmartNet domain to a Workgroup environment)

Keyword: WorkgroupConversion

Concept: Conversion from a Windows, OSX or SmartNet network to a simple workgroup networkTypically school move from a NOS (Network Operating Service) to a Serverless environment.Crystal can assist in this metamorphosis.

The Issues:

1. Identity and Access management (IAM). Crystal looks after this.Crystal hosts the user's identity, logon etc on a hosted server.

2. Logon script: This is the common script that organises your users and network. The script tends to be very simple- maybe not even needed for schools with rolls less than 100.The logon script also configures the print server (see below)

3. DHCP and DNS: These two protocols are IP services that are needed to run a network.The good news is that there are a number of devices that can do this - therefore it is a question of convenience.

o The easiest is to ask the N4L to do this for you.o If your network is complex your ICT will recommend another method.

4. Printing... printing has two options.

1. Devices and users can print straight to printers. This works well in schools with only one printer however if the school has multiple printer, photocopiers and scanner then the multiple manual changes starts to become burdensome.

2. Print server... a printer server collects (spools) print jobs from multiple users and prints to multiple destination.

Print server can also manage accounting and logs. Print servers tend to run on basic and cheaper machines. Schools with rolls >100 tend to use Print Servers.

GuidelinesPolicies are the hidden rules that make work stations follow the network rules set by the server.Removing  the network server means that it is also best to remove those polices.Ideally the workstation should be best built from fresh - but time wise it is best to try to edit an existing configuration.

1. Windows- removing the policieso Take the device off the Windows domain (Right select My

Computer/properties/Workgroup.)o Add a 'standard' username with a known simple password ... add a logo script (Right

select My Computer/users etc)

o Put a UNC link to the logon script so that the machine will run the script every time

the machine starts.2. SmartNet - removing the policies

o Uninstall the SmartNet logon from each device.o Delete proxy option (Browser\Options\connections\Lan settings- untick)

3. Logon script - making a logon script. (see LogonScript FAQ)

Chapter 5: Migration – practical

Keyword: Migration

Objective: How to migrate to, configure and manage a “Workgroup network “

Steps:

1. DHCP and DNS services … these need to be transferred to the N4L router.

2. Distribution pointSchools do not need a server however they do need a central distribution point for print management services.

o Options: A Minimac, Windows standalone or a USB drive.o Crystal supports the windows option as it represents best value when using a

recycled server. If a recycled server is not available and there are other costs, then the other options should be explored.

3. Management Services: These are best managed through a logon script that every managed device should run on power up/logon. (aka in the startup folder)

o Unmanaged devices do not need to run this script.o Logon script (see the separate FAQ for the script code below)

1. Kixscript: This is a simple script language that empowers the commands2. Mapped drives: Only needed with old apps like MUSAC3. Printer: Enabled a central printer pool and print accounting.4. Personalises the digital environment.

4. Deviceso Changing old networked computers

1. Windows domain: These need to be taken off the domain, domain policies withdrawn, and user profiles deleted.

2. SmartNet: Remove the SmartNet logon script from Startup, remove registry fixes (WSUS)

o New computer configuration: Add log on script to startup folder. Edit Crystal Kete.o School devices: Edit Crystal Kete.o BYOD device: Edit Crystal Kete.

5. ImagingImaging is where each managed computers disk is cloned from a master thus loading all the Apps and configuration a school needs. This is becoming less popular as schools adopt BYOD. BYOD computers are not managed and users are expected to preload their own software.

o Imaging options

i. Do not image but rather use the “preloading”  tools.ii. Physical disk to disk copy using  a hardware device (Jaycar XC4697)

iii. Full Windows WDS service. See Crystal administrator guide to Windows disk imaging. This uses a central Crystal Windows distribution server that contains a library of suitable images that Crystal schools may download use. The products keys need to be changed and recent updates loaded.

1. This imaging is limited to <4 simultaneous devices.2. Please implement outside classroom hours.3. Quick-fire: Windows- press F12 on boot and select network option.

6. Printingo Print servers and spooling... print server make print management much easier

Hint: Make a folder with the drivers in c:\drivers on that new print server.o Loading printers

i. The easiest way to add drivers is to go the  print server and double click on the printers – that will force the drivers to be loaded.It may be that the UAC could stop the drivers from loading with the script. 

7. ProfilesThere two types of profiles (the metadata that hold users settings and information)

o Roaming: This is where the profile follows the user and loads onto the local computer.

This requires a domain network and significant resources.o Local (static): Where a user’s is built on each and every computer the user logs onto.

The metadata cannot roam between computers.

Workgroup networks use local profiles thus effectively restricting cross user use of devices.Workgroup Managers need to ensure that they have access to each device has a user’s account (localadmin) and a back door account (Administrator) to every computer.

Appendix

Appendix 1: Scripts

Log On Script

Keyword: LogonScript

Command line Script (Windows – Open source)

@ECHO OFFrem *********** Logon script preload *************echo login script now running...clscmd /c "start \\10.250.140.11\FPinger\Collect.exe -s:10.250.140.11  -UserName -Desktop -StartMenu"cmd /c "C:\Program Files\Hector's World\Hector.exe"

Kixstart script

;BREAK OFF

;'=================================================;'Map Printers by Group;'=================================================;'USAGE:    MapPrinter "\\SERVER\PRINTER SHARE", "True";'USAGE:    MapPrinter "\\SERVER\PRINTER SHARE", "False";'NOTE: Drivers must be installed on pc/server running this login script or user must have permissions to install driver!;;'=================;' Printers;'=================;'If INGROUP ("") Then;    MapPrinter "", "";    MapPrinter "", "";'End If;***********Setup Printers*********************************************

;'NOTE: Drivers must be installed on pc/server running this login script or user must have permissions to install driver!

?"Adding Common Printers and Default Printer"AddPrinterConnection("\\TAHPRINT\TheHub")AddPrinterConnection("\\TAHPRINT\E-Space")

SELECT

Case INSTR("@WKSTA","SUELT")          ?"Setting Default Printer For SUELT"          SETDEFAULTPRINTER("\\TAHPRINT\Library-Office")

Case INSTR("@WKSTA","ROOM1")          ?"Setting Default Printer For ROOM1"          SETDEFAULTPRINTER("\\TAHPRINT\Library-Office")

Case 1

          ?"No Default Printer Set

ENDSELECT

;************************** Registry Settings *************************

;***********Setup Mapped Drives****************************************

?"Mapping Drives"  + chr(13) + chr(10)

;**** Setup Common Mapped Drives ****

?"S:(Shared) " + chr(13) + chr(10)  USE S: "\\tah-filesrv\Data\Shared Data" If @error = 0   ?"S: Drive Connected Successfully"  ENDIF

;**** Setup Mapped Drives for Tahunanui Staff ****

;IF INGROUP ("TahStaff")?"M:(Shared) " + chr(13) + chr(10)  USE M: "\\MUSACserver\MUSAC" If @error = 0   ?"M:

;IF INGROUP ("Staff")?"M:(Shared) " + chr(13) + chr(10)  USE M: "\\musacserver\MUSAC" If @error = 0   ?"M: Drive Connected Successfully"  ENDIF

;***** Welcome Message *******************************************

;initialisations$CRLF = Chr(10)+Chr(13)$varMessage=""$constOK_Button = 0$constInformation_Icon = 64$constExclamation_Icon = 48$varStyle = $constOK_Button$varTimeout=1

;Title$constTitle_Welcome_Message = "Welcome...please note our changes during the Easter Holidays !!!"

$constTitle_Anouncement = "Your Folder Redirection is working now !For this reason your Login might have taken longer! You can save now your Files directly under the blue MY Document Folder. We apologise for any inconvenience ! "$varTitle = $constTitle_Welcom_Message

;** Welcome Message: Time of Day (TOD)$WelcomeTOD = "night "IF(00:00<@TIME) and (@TIME<12:00) $WelcomeTOD = "morning "ELSE IF (11:59<@TIME) and (@TIME<18:00) $WelcomeTOD = "afternoon "ELSE IF (17:59<@TIME) and (@TIME<23:59) $WelcomeTOD = "evening "ENDIFENDIFENDIF$varMessage = "Good " + $WelcomeTOD + @FULLNAME

;** Welcome Message: Date and Time$varMessage = "It is "+@DAY+", "+@DATE+" "+@TIME + $CRLF + $VarMessage

;** Welcome Message: Special AnouncementIF LEN($constAnouncement) <> 0   $varMessage = $varMessage + $CRLF + $CRLF + $constAnouncement   $varTitle = $constTitle_Anouncement   IF $boolExclamation = 1      $varStyle = $varStyle + $constExclamation_Icon   ELSE      $varStyle = $varStyle + $constInformation_Icon   ENDIF   $varTimeout = 0ENDIF

;** Display Welcome Message$Selection = Messagebox ($varMessage, $varTitle, $varStyle, $varTimeout)

;***** END OF LOGIN SCRIPT:The_EndEXIT 1

Appendix 2: ITIL

Levels of ICT support 

What is ITIL?ITIL is the ICT support standard used in most institutions. The ITIL model promotes a standardised procedure so that 'incidents' are always and correctly addressed but also ensures that this is done at the most appropriate level of support. There are three levels of ICT support with associated hourly rates.

Level 1 - Basic. This is the users first contact. In schools it is usually a teacher aide or receptionist. 90% of all ICT problems can be solved at this level.

o This means that 90% of ICT incidents can be resolved instantly with little cost with the

minimum of training.

o If the incident cannot be resolved at level 1 then the 'incident' escalates to level 2

(that is the job is issued with a ‘ticket’). Level 2 - Advanced. Level 2 concerns tend to be resolved in house or local specialists by

following ITIL's suggested 3 steps ... The incident is ticketed (recorded). o The ICT support resolves the incident and if appropriate writes an FAQ.o The FAQ is a critical action as it records the 'fix' for future users but more importantly

enables the user to solve similar future incidents themselves. o This step is important as it enables the user to take ownership of their own virtual

world.o If the concern cannot be solved at level 2 then it is the school's ICT support to

assemble the relevant information and promote the incident to level 3.  Level 3 - Engineering. Occasionally a problem requires a high level engineer. The school’s

ICT support assembles all the relevant documentation and seek guidance in selecting the appropriate engineer (Crystal can help here). It is important that the school ownership if the incident is to avoid cost overruns.

o Remote schools: Remote schools have very specific problem. ITIL level 1 in- school

support and as such relatively easy to access. Training can be down by various agencies such as the Crystal, MoE or even other Level 2 technicians. 

o ITIL level 2 are typically community based IT support. This is usually available in

towns of 1000+ but in smaller centres school often have to 'buy-in' this assistance.o ITIL level 3 engineers are not common. These are best contracted via IT companies

or other larger educational networks. Maybe educational organisation can aggregate in order to acquire these services (COL’s, Area schools).

Appendix 3: Budgets

Managing your budget Many schools waste valuable resourcing by not following a set of basic rules. 

Ask first - your expertise lies in education not IT. Ask around other schools, or the CLA. Watch out for biased advisors. 

Fact: Seldom is a mistake made when using collaborative ICT expertise ... but ... 80% of ICT projects have cost overruns when an ICT policy decision is made by one person. 

Make sure your network documentation is kept current - it enables your ' experts' to make a quick and knowledgeable decisions. 

Get the ITIL model (see above) working.  Make a three year forward planning budget ... it forces a rationale to be applied rather than

knee jerk purchases and makes your ICT program more predictable.  Schools can deliver a rich, reliable, secure ICT environment for ongoing annual tech support

costs of between $225 and $300 per device. Note that “ongoing” includes preventative maintenance and responsive break/fix support.

o This does not include the technical services associated with major additions or

changes to the network. The factors that determine the ongoing annual cost of support per access device are ...

o Age and quality of the cabling, switching, servers, and access devices as this largely

determines reliability. o The complexity of the system, which is largely a factor of the number of operating

systems being supported, the number of software applications being delivered, and the ability to offer a unique or customise experience to each user.

Appendix 4: School records in 365

<< To be written>>