Remote Tech introhugugggigig ygcufuyfuyfyuf

huhp

1. Remote Technicians Introduction HBL ICT

2. Welcome! You’re a Remote Technician! This guide takes you through what we do, who for, and the tools you’ll get to use.

3. We’re here for the devices, but devices need users… The key devices we’re here to support are : Our job is to keep the device running for its individual or group of users. What they then do with it is normally helped by other teams, but we have the job to make sure it’s available and working. Laptops Desktops Printers Smartphones

4. Our Customers On the next slides we’ll introduce who we work for, this will make it easier to identify the customer and the type of work they are doing; also what is likely to be on their device. Each customer organisation has their own code for their computer build , more on this later.

5. Hertfordshire Community Trust (HCT) "Hertfordshire Community NHS Trust (HCT) is the principal provider of community-based healthcare services to the 1.2 million population of Hertfordshire. We have around 2,000 staff and every day we deliver a wide range of high quality health services to people in their homes, in local clinics, in schools and in our community hospitals. We support people at every stage of their lives, from health visiting and school nursing services for children and young people to community nursing, rehabilitation and palliative care". ( HCT website) Head office is in Welwyn Garden City Sites are all over Herts, plus also they do Vaccination services in Norfolk, Suffolk and Cambridgeshire Computer code is 100

6. Hertfordshire Partnership University Foundation Trust (HPFT) Head office is in Hatfield Sites are all over Herts, plus also they do partnered services in the other counties above. Computer code is 150 “We provide health and social care for over 400,000 people with mental ill health, physical ill health and learning disabilities across Hertfordshire, Buckinghamshire, Norfolk and North Essex. We employ over 3,500 staff who deliver these services within the community as well inpatient settings. We also deliver a range of nationally commissioned specialist services including Tier 4 services for children and young people, perinatal services and medium and low secure learning disabilities services”. ( HPFT website)

7. Herts and West Essex Integrated Care Board (ICB) NHS Hertfordshire and West Essex Integrated Care Board (ICB) is the local NHS organisation that plans and oversees how NHS money is spent and makes sure health services work well and are of high quality.   The ICB’s role is to join up health and care services, improve health and wellbeing and reduce health inequalities. We have a budget of around £2.8 billion, for the 1.5 million people who live in this area. The budget is set by NHS England. ( website) They are our hosts and employers – head office is in Charter House Computer code is 200

8. Herts Valleys CCG Head office is in Hemel Hempstead Computer code is 210 Becomes part of Integrated Care Board (ICB) from 1 st July – look out for details. “NHS Herts Valleys Clinical Commissioning Group (CCG) was created in 2013 to organise the delivery of healthcare to 627,000 people living in west Hertfordshire. CCGs are made up of our local GPs and other healthcare professionals and are responsible for ‘commissioning’ – planning, designing and paying for your NHS services. We work to help people stay well and to improve NHS services to meet the needs of local patients”. ( website)

9. West Essex CCG Our newest partner Head office is in Epping Computer code is 400 Becomes part of Integrated Care Board (ICB) from 1 st July – look out for details. “NHS west Essex Clinical Commissioning Group (CCG) is made up of 32 GP practices across Epping Forest, Harlow and Uttlesford. As members of the CCG, they guide the organisation. They also make sure the CCG is getting the most from the money it is allocated from the Government”. ( website)

10. Beds, Luton and MK CCG Head offices are the three from the original groups above – Luton is “Arndale House” (Luton), Beds is “Capability House” (Silsoe) and MK is in Bletchley. Computer code was 250 (Beds) 260 (Luton) or 270 (MK), any new PCs get 300 “NHS Bedfordshire, Luton and Milton Keynes Clinical Commissioning Group (BLMK CCG) was formed on 1 April 2021 following the merger of Bedfordshire Clinical Commissioning Group (BCCG), Luton Clinical Commissioning Group (LCCG) and Milton Keynes Clinical Commissioning Group (MKCCG). We are responsible for planning and buying (or ‘commissioning’) NHS-funded healthcare for the almost 1 million people living in BLMK. The creation of the single CCG gives us a real opportunity to meet the wider healthcare needs of our communities, utilising the greater joint working across health and social care that has happened in response to the Covid pandemic”. Note : we have two Remote Tech staff in Milton Keynes , from when we first took on supporting the region.

11. That’s a lot altogether! It reflects the success of HBL ICT selling its support services for ICT, to these organisations we call our partners. So, in a day you can be talking to Doctors, Nurses, Clinical specialists, Senior leaders, administrators, management from the CCGs, many more. Look to get to know what each organisation does and how it works, ask any questions if you need.

12. What’s on the computer? The next slides will set out what’s on each computer and how it can work. The solution is the build. A lot depends on the organisation, and also where the device is. There are still many desktop PCs, but focus has been more on laptops since the Covid-19 pandemic. These enabled staff to work remotely.

13. The base build Windows 10 Enterprise Membership of the Active Directory domain called Nebula Microsoft Office 365 Microsoft Teams Sophos AntiVirus SCCM Software Centre, for delivering apps Cisco AnyConnect – VPN solution There are other services backing these – such as Windows Defender Advanced Threat Protection (ATP) for extra security, and Nexthink for PC health/good performance.

14. Then each organisation gets… Its home page (intranet) Clinical system – Paris (HPFT) or SystmOne (HCT) Other icons for the organisation To enable HBL ICT’s services, every PC has the ServiceNow Customer Portal icon and also the Bomgar “B” icon for remote support.

15. The Nebula login Our build joins the computer to the domain, so, you need a valid Nebula account to be able to log it on. Staff get a logon by their manager requesting it. They are given their ID and initial password when they start. They log on, change password to their own choice : 8 or more characters, with a capital and number – not used before + not easy to guess. Self help available through the “Reset Password” feature, from Specops . Staff lodge three questions to answer if they need in future. Password expires after 60 days. Between 8am and 4.30pm the Access Management team help with Nebula accounts. Phone [phone] option 2, or customers can chat (no appointments).

16. HPFT have Imprivata The Nebula login is one you’ve got to remember – three times wrong and it locks the account. But once they login, HPFT have several other systems all needing a login. So the Imprivata OneSign system was bought to “learn” your logins to the other systems such as Paris, SPIKE, and it will automatically type them in for you. To save staff remembering the different passwords. The login screen looks like this (left) but still takes your Nebula details. Between 8am and 4.30pm the HPFT Digital Support team help with Imprivata. Phone [phone] option 2, or customers can chat (no appointments).

17. Workplace vs home or mobile Workplace (directly connected) Direct link Login at your PC The Nebula data centre At home or mobile Login at your PC OFFLINE The Nebula data centre Internet own, or mobile Cisco VPN

18. Logging on at work Our laptops can connect directly to the domain (Nebula, or as the indicator says, xherts.nhs.uk ) They can either do it through a docking station or direct ethernet cable in the side. Example docking stations pictured left. Or, all laptops have a connection to the Corporate WiFi called N-Corp . Desktops are usually cabled to the domain but many do have a WiFi aerial that can be used if a good signal. If you have a direct connection, you can log on with your latest password and this is how staff must log on for the first time on a computer. There are some workplaces without a direct connection, they need to use an offline way, see next slide.

19. Logging on at home or mobile To work at home or mobile, staff must have logged on a laptop in the office first. That means that the laptop has a profile for them and can log them in offline with the last password it knew for them. Once on, they must get internet. HCT provide most of their laptops with a “Cellular” SIM card from EE. Our duty is to make sure this works within the laptop – a valid line is needed. Some HPFT and CCG laptops have these too. Or staff can use their WiFi at home – just find it in the list and type the password. Staff have to help themselves get on this. Lastly a login to the VPN, which uses the Nebula account and it must not be locked or password expired.

20. What can stop the user logging on? Three wrong passwords received by the Nebula domain means the account will be locked out . There are a few ways this could happen : - Wrong password at a computer’s login or lock screen Wrong password at the Cisco VPN Outlook setup where by mistake it asks for Nebula not the NHSmail (see next slides) Wrong password at a printer that uses Nebula. A temporary account has come to its end date. An account has been disabled. These include if a CSAL form was submitted for a former colleague, or HBL also now do audits that CSAL if accounts not used in 60 days. X X X The Cisco VPN will not login if the Nebula account is locked or password expired. Staff can unlock/reset with their Specops questions. Between 8am and 4.30pm the Access Management team help with Nebula accounts. Phone [phone] option 2, or customers can chat (no appointments).

21. What can stop the computer logging on? Firstly it might not actually be connected where it is. Some of the symbols that show this are on the left, the “globe” or one that has a X or ! meaning there’s a fault. If the network symbol is the EE “rising bars” that only means it has open internet, it needs to add VPN to get securely connected. You get the “TV” symbol if VPN connected. You can always get the asset number of the PC (see next slides) and try a ping test. If you ever see the Airplane mode symbol (the last one) please turn this off. One other reason is that the PC might have been isolated in Microsoft Defender, because it’s not security compliant – has a malware problem or lacks the correct updates. Check this.

22. IT assets Our computers are their organisation’s IT assets. HBL ICT’s Deployment Team manage the issue of the computers when the stock has been bought. These asset stickers are on laptops, in front of the keyboard, or on the base unit of desktop PCs. HPFT manage their own assets and thus is a green sticker with the IT prefix. All others are managed by HBL ICT and thus is a blue sticker with the ICT prefix. Then, a 5 or 6 digit number. The computer name comes from this. Organisation code - L for laptop - D for desktop - Asset number Please contact the Deployment team if the asset sticker is missing or damaged.

23. NHSmail Nebula is the first key account that a member of staff has with us. The second one in terms of general IT is the NHSmail account. You might be familiar with this, in that every organisation who is a member of the @nhs.net community (and agrees to its terms and conditions) is part of one global address book for all of England and Scotland. Everybody lists as “LASTNAME”, “ Firstname ” (ORGANISATION) Along with an email address that uses numbers to avoid clashes. Between 8.30am and 4.00pm the Application Support team help with Mail accounts. Phone [phone], or customers can chat (no appointments).

24. We’re the (substitute) admins Although Application Support are the primary email admins, we can still do the job when they are closed. Your own account is a Local Admin * and that means for the organisations discussed earlier, you can act as admin for their email accounts. Plus also many other local ones like GP Surgeries. You can : Reset passwords Do account leaving and joining See users’ license and mailbox capacity (though our team can’t change them) See users’ shared mailboxes and distribution lists and change them. Between 8.30am and 4.00pm the Application Support team help with Mail accounts. Phone [phone], or customers can chat (no appointments). * For this reason, when you log onto NHSmail you’ll need to do multi factor authentication, get a code in a text message.

25. The NHSmail rules Again this is not primarily our job, but it’s worth knowing the rules of NHSmail – say if you speak to a new starter at an IT Clinic. You have an individual email address and mailbox. Its standard capacity is 4 GB , or can be raised to 50 GB. Everyone also gets an “online” or “In-place” archive of 100 GB. Passwords are 10 + characters with a capital and number or can have three non-easy words together (all lower OK) Must change once in 365 days If not changed, the account goes inactive, then deleted after a further 90 days If marked as a leaver and account not picked up by anyone else in 30 days, goes deleted_permanent . Between 8.30am and 4.00pm the Application Support team help with Mail accounts. Phone [phone], or customers can chat (no appointments).

26. Shared mailboxes Key to the way Mail works in our local NHS organisations are the shared mailboxes. You may know these are mailboxes of their own, but with individuals given access to them. Those individuals are either owner , who can decide who joins the mailbox, but once ownership is in place we can only get the decision from them. Then there are members who also can see the mailbox and send messages from it. The email address is <organisation prefix>.<suffix>@nhs.net In older times single user mailboxes could be set up for groups, e.g. [email protected] and for this you need to know the address and password. They’re not encouraged nowadays. Between 8.30am and 4.00pm the Application Support team help with Mail accounts. Phone [phone], or customers can chat (no appointments).

27. Outlook 365 Outlook is part of Office 365 . One key part to know is that it’s installed locally on the PC, but to be able to use it, your NHSmail account must : Be joined with your Nebula account For that, your NHSmail address must be with one of our local organisations. Must have an Office 365 license. And for that you must have accepted the NHSmail policy (AUP). Most new users get a Nebula account and an email account and they go together. But it’s possible to bring an email from another organisation and join them later – this is set by the CSAR the manager sends in. Many other items need the user to have a Nebula account and email joined together. The ServiceNow portal is one, organisation’s intranet page is another. The Access Management team change a Nebula account to have an email address added. The Application Support team do email account admin including Office 365 licenses. They manage how many are used in each organisation and report back for management.

28. Outlook 365 and storage Outlook brings together all the features of your mailbox – mail, calendar, contacts, tasks, categories etc. It’s based on a profile which we have to set up called NHS_mail . This downloads a copy of your mailbox all into one single file called the “Offline storage” (OST) This means that (in theory) you can work offline with Outlook and update your mailbox later, although our copies are usually online all the time. It still says “Connected to Microsoft Exchange” although these days that’s a cloud server based on Office 365. You can easily re-profile Outlook if performing badly and delete the OST, a new one will download. One for us to watch out for are desktop PCs where multi users log on and leave their user profiles. Having large Outlook OSTs can eat up the C: space and degrade performance.

29. Microsoft Teams Teams is the Microsoft collaboration app and came into its own early in the Covid-19 response where the NHS gained a national license to use it. It’s well known how much it’s used for meetings, video calls, messaging, and other apps. All of our computers have Teams as well as mobile phones too. You are a member of Teams through your NHSmail account. Our job is to make sure the software is installed and you have the Teams icon, then, it starts and logs on, and can use the devices of your computer (camera and microphone). Colleagues may need your support getting headsets to work. Once all that’s done it’s all up to the user and their organisation what they do.

30. Software One of the main parts of our work is installing software. We have admin accounts on Nebula computers and that means we can enter our credentials and enable software to install. The NHS’ IT Governance includes Software Asset Management (SAM), a key area of governance in IT. Our colleagues who run this, will help you when you’re requested to install software. They must be satisfied that the software title is paid for if it needs paying (vendors release a license key or login to a cloud portal, for example). Otherwise, valid for use in the NHS. Other colleagues check it’s secure and will run with our builds. You’ll get to know where you can install software from when given the go ahead.

31. The Software Center One of the common ways to get software to a PC is through the Software Center . It’s our delivery portal for the Microsoft Configuration Management software branch. (part of Endpoint Manager). Any PC can go on it, it’s secure so needs to be on VPN if you’re not on a main office network. PCs can get icons here for software that they have been granted access to in SCCM. Some are titles for all PCs, others more specific. You click on the icon you want and do Install – it silently does it.

32. The Smartcard Put simply, without the Care Identity Service we can’t use computers to do clinical work. The card that is known as the Smartcard is issued to members of staff who qualify for one, under a carefully controlled scheme. You have to be sponsored to qualify for a card and produce correct ID for it to be issued to you. Our laptops are all bought with a card reader slot and these cards fit here, otherwise for desktop PCs or laptops where needed, an external USB card reader is used. Our job is to make sure the hardware, and the software called Identity Agent and Oberthur , are working and get the user to a login and connect to the service. VPN is needed if you’re remote. Between 8am and 4.30pm the Access Management team help with cards and accounts. Phone [phone] option 2, or customers can chat (no appointments).

33. SystmOne SystmOne by TPP is the major clinical database used by Herts Community Trust (HCT) and also many GP organisations in our area. This is installed on the PC’s C: drive and is kept up to date by using a number of batch files. Users normally get validated onto it by logging their Smartcard on first, but it is also possible to get a SystmOne login just for the app, for temporary use. Our job is to make sure it’s installed and the software connects. HCT have a dedicated team for logins and support. GP organisations use TPP Helpdesk.

34. Paris Paris is the major clinical database used by Herts Partnership FT. This works differently to SystmOne . It’s based on a series of Remote Desktop Protocol (RDP) servers at its vendor, Civica . It’s started by clicking the icon and it “borrows” a HPFT user’s Nebula credentials to log on – their account must not be locked or password expired. It also “borrows” their network drives and printers and makes their profile on the remote server, starts the app, and they log on and use as if it was on their own PC. HPFT’s Digital Support do the logins and admin.

35. Printing The next slides give a summary of how we print across our partner organisations. Printing is done securely, it can usually just be done at the workplace. By and large printing is not allowed at home.

36. HPFT Printing A number of software solutions on the printers and their servers, make the FollowYou system. A special badge issued by HPFT validates the user onto the device, or they can log on with their Nebula account. “ FollowYou ” means that a print job once it is sent, is securely held and can be picked at any suitable Ricoh device. Software such as PaperCut and Nuance manage prints and scanning. Our job is to make sure the devices are cabled into place and network settings done, software installed.

37. HCT / CCG Printing KonicaMinolta are the partners for these organisations. The BizHub series or sometimes other printers are used. Once again they do all the functions – printing, scanning to email and copying. Badges are issued to be able to validate onto the device, then a securely held print job is chosen for release. Ysoft are the software solution partner. Again our job is to take a print device at the site and cable it in, obtain and put in IP addressing, and install the management software. There are some desk-based printers and scanners mainly around HCT and usually from Fujitsu.

38. Smartphones and tablets The next slides give key info about the hundreds of smartphones we support across the organisations. Phones can get quite complex but remembering some key rules makes them easier to support. Any given phone model is always set up the same way, again easing things for us.

39. Smartphone basics Organisation’s dedicated team buys the phone and line, delivers We assist getting the phone set up and enrolled in Airwatch and Sophos, Outlook installed. User carries the phone and uses securely with standard apps and integrated with Nebula/email. You’ll get to know who arranges phones for their organisations. In HPFT only, it’s the Digital Support team . In all other organisations, HBL has a Telecoms team , part of Deployment. These colleagues deal with the phone providers and arrange new / replacement handsets or transfer of a handset to a new colleague – may use the same number or take a new one. It’s important we don’t try to set up a phone if the new user hasn’t been formally requested to have this handset plus a line.

40. Setting up the phone Organisation’s dedicated team buys the phone and line, delivers We assist getting the phone set up and enrolled in Airwatch and Intercept X, Outlook installed. User carries the phone and uses securely with standard apps and integrated with Nebula/email. Our latest phones are built with a management system called Knox from Samsung. This makes sure it enrols as a managed phone and leads on to install the Hub . Earlier phones without Knox can be diverted off the standard Google setup onto Hub, by entering the username afw#hub . We do the rest to configure it, becomes familiar after a few goes!

41. If a phone is transferred First of all we ensure that a phone line is transferred to the new user and they have got instructions on whether to keep the SIM card, change for a new one, so on. We talk them or show them through a factory data reset. At the same time we delete the Airwatch record of the device from the previous user. This is because Airwatch won’t re-enrol a device which is already on the system. The phone, once reset, is then configured for the new user who goes onto enter their Nebula password at the Hub (it re-enrols), set a phone passcode, and we finish it off with Sophos Intercept X and Outlook.

42. Apple iPhones and iPads We do set up iPhones and iPads where they are provided to staff who qualify for a device. The Apple setup is more along the lines of a retail device but we need to be careful to register it to an AppleID that keep its management within the NHS, rather than a personal account. It’s key for us to document how we set it up. Once that’s done we add Airwatch (Hub) to the phone and enrol it. We don’t install Intercept X. If we’re upgrading a phone it’s simple enough to do as long as we know the AppleID the colleague is using, plus their old device is to hand. Apple want to message you on the old device to warrant that you allow a new device to join.

43. How do we do support? The final slides are about the ways we support our partner organisations. All our work in support is logged in ServiceNow , the IT Service solution we use. We’ve developed a solution from ServiceNow called Agent Workspace.

44. Remote appointments Firstly we offer Remote Appointments. As long as we get a phone number to call, we will phone the customer during a half hour slot. They don’t have to have logged a ticket first. They can simply lodge a request for us to begin talks about the question or problem. We triage the problem, using Bomgar if we can remote on, or talk through a solution. Other times we log a ticket to other teams with details gathered. Booked through the ServiceNow portal, can do this 24/7. Can be booked for themselves, or on behalf of another user. (so we can book appointments for customers if more time needed). Slots weekdays at 8am, 8.30, and on hour and half hour to 11.30. No appointments 12-2. Then 2pm, 2.30, and on hour and half hour to 4pm .

45. Phone calls Until further notice we remain as “IT Support” on the phone lines, reflecting we used to be the first line IT Service Desk. (Remote Analysts). We pick up the calls using the dialled numbers for each organisation. There’s a lot of time saving ways that customers can help themselves before they call, but a lot still prefer to get through on the phone and explain their problem – we log it and get basic info to where to send the call or ticket. 01707 685560 option 1 for Herts Valleys 01707 685562 option 1 for HPFT 01707 685566 option 1 for West Essex 01707 685567 option 1 for HCT 01707 685568 option 1 for BLMK 01707 685555 straight through, for ENH CCG or general use.

46. Charter Appointments Charter House appointments are booked when the problem involves a device, usually meaning a laptop or smartphone, needing to be physically seen. Such as if there’s a damaged or failed part, to change a part, or to change a device in full where it is an option. Alongside the stock of computers mentioned earlier, we can deploy spare computers. More about this when you take on Charter Appointments. We have a KB article, KB0015192 with more info. Appointments available Mon-Fri 9am, 10am, 11am, 2pm and 3pm.

47. Shipley Appointments Sherwood Place appointments are booked when the customer is from the Milton Keynes or Bedfordshire region and it’s more local for them to travel here. The customer can travel to the office at. Sherwood Drive, Bletchley, Milton Keynes MK3 6RT Please note, the Access Management team also hold a clinic on Smartcards here on Wednesdays, an option for local customers including GP and Pharmacy. Appointments Mon – Fri 9am, 10am, 11am, 12pm

48. IT Clinics and site visits Part of our team’s origins are the field services around the sites of our partner organisations. If customers can’t travel with laptops, plus where there are desktop PCs and printers, we go to site. Taking a repair kit and spare parts as needed, we do work on the clinical or office sites. We offer the IT Clinics where we take a place in the building and customers are invited to come and see us with questions or problems, no ticket needed in advance. More about this when you take on Site visits. We have a KB article, KB0015195 with more info. Clinics are on an agreed schedule with HCT, HPFT and Herts Valleys. For HPFT we can partner with the Digital Support team.

49. Support tools Name Purpose Link ServiceNow Agent Workspace For logging and viewing tickets, appointments https://hblicts.service-now.com/now/workspace/agent/home Cisco IP Communicator Your desk phone line Installed to PC, Access Management grant a phone line. Cisco Finesse Phone call distributor https://dc1-vce-cucm-ucx1.nebula.xherts.nhs.uk:8445/desktop/container/?locale=en_US WallboardFX Check for free phone lines to transfer calls http://hbl-port01:8080/WallboardFX/#display AD Users and Computers View Nebula accounts, reset passwords, take PCs off domain for rebuilds Installed to PC Specops Helpdesk View customers Nebula self help status, reset passwords https://passwordhelp.hblict.nhs.uk/specopspassword/helpdesk/Start.aspx ?

50. Support tools Name Purpose Link Bomgar Representative Console Remote assistance onto PCs. Installed to PC. Digital Automation team grant an account NHSMail portal View NHSmail accounts, reset passwords, shared mailboxes, leave/join work. https://portal.nhs.net/ NHSmail account, set to Local Admin level by Application Support team. Charter Appointments diary To book appointments https://outlook.office.com/calendar/[email protected]/view/day ADBal Computer and AD account info viewer https://adbal/home Snow Software license info viewer https://snowlicencemanager/Pages/Login.aspx Airwatch Mobile device manager https://cn531.awmdm.com/AirWatch/Login?ReturnUrl=%2FAirWatch%2F#/AirWatch/Device/Dashboard Sophos Central console Security app manager https://central.sophos.com/manage/login?redirect=%2Fdashboard

51. Finally…. We’re here for the NHS colleagues in our area. We need to work safely, especially if on site, and respect our patients and service users, even if we just help a system or computer that has their data. There are rules to adhere to on confidentiality. Understand the organisations, their key systems and what staff do, to best be able to help. Some are clinical, others office based. Some are very interested in their computer systems, others trying to learn. Enjoy working with us and the HBL ICT teams we work with. Any questions please ask.