The head doesn't employ you.
As Tony says, the laptop is the school's property and, as such, it is my belief that there should be no need for anybody to have elevated priviledges.
None of the teaching staff where I work have elevated priviledges on laptops but we are very ammenable when it comes to installing extra gubbins for them.
The head doesn't employ you.
But on the subject of local admin priv's, all teachers have local admin priv's on our network and I am starting to think it is a bad idea. Random bits of software and hardware are being purchased and installed, and some which is being pinched from other schools. I'm going to be writing a policy document for laptop use, as there is nothing guiding it other than a 'you have to pay for it if you break it, and you should cover that with your own insurance when it isn't off site' policy.
Yes in theory the head doesn't employ me but they are the boss and that's what counts!
Do you give staff local admin rights whilst logged on as a domain member and if so is it just a case of adding their domain username to the local admins group? this may be an adequate solution in this case.Staff have local admin rights on their school laptops and also a local account with admin rights for when at home
chrbb (20th February 2008)
I allow all staff users local admin rights on laptops only. Staff always want/need to install/test new software they come across and I'd rather they do it on the laptop and not on a workstation connected directly to the domain!
Also, lots of staff have broadband and as we all know, the majority of broadband packages are still supplied with a USB modem, which of course requires drivers to be installed. Some staff also like to install the Google Toolbar (for example), which I don't mind too much.
There are some which install MSN Live Messenger, iTunes and Football Manager, but I really couldn't care less. It's my job to ensure the laptops are working correctly. It's the ICT Co. who should monitor/evaluate what staff are doing with laptops.
We issue staff with laptops which is installed with all the necessary software they need for day to day use.
The laptops are sync'd with the network via .bat scripts every time they login (when connected with a network cable/wireless) to update as required.
On the network they are totally locked down however on their laptops they have administrator privileges and full liability/responsibility for any inappropriate use.
They are warned what is acceptable and what is not prior to being issued with a laptop.
The teachers here can do anything they damn well like with the laptops and there isn't a thing I can do about it. I can't even get them to sign a bit of paper taking responsibility for the machine (the head doesn't care, you see). They have full local admin rights but when on the network they only get what is set for all which amounts to being able to delete printer queues and that is it.
I did get proper anti-virus on the machines - set to update from the network or home or anywhere - so that is something, I suppose!
Well ours are set up with a local admin account for staff to login to at home if they need to setup broadband etc, but their domain account for when they logon at school is restricted and locked down, they don't have local admin rights for this account. Never had a problem, staff sign aup, I've set up proxy on and off 'buttons' for home broadband use if they want to login using their school account. Except recently as I said I've an inkling that the head isn't so happy with the arrangement! But am going to add them to the local admin account and see if that helps.
We are evaluating this too. It really gets to you when staff go 'My machine is slow, You need to buy me a new one NOW!' when they have football related wallpapers, a BBC News ticker, MSN and loads of other junk installed.
Our machines aren't great but we do try to keep them nice and maintained, a lot are Pentium 4 1.8ghz ex student machines but with 768mb RAM and my XP/Office/Groupwise staff image they run perfectly adequate!
Have to laugh when we loan out a laptop with DeepFreeze on and they come back the next day complaining it is faulty as their broadband settings etc aren't saved
We have a really tight GP for the laptops, no way would they be given admin rights!
Not only would it mean that they would probably create software problems (not knowing what they are doing) but they would install unlicenced software etc etc.
There isnt anything that they cant do (that they are allowed to).....
We rarey have problems with laptops, only with the dreaded m$ syncronization.
Do you guys not have as we call "fiddlers" who want all thier software on there?
what happens if they do mess it up? I bet there is no punishment. Just means work for ICT dept.
Last edited by burgemaster; 22nd February 2008 at 09:35 AM.
There are currently 1 users browsing this thread. (0 members and 1 guests)