Getting stick for locking down staff laptops

[Oops_my_bad]

We recently rolled out a few dozen new staff laptops. With SMT approval and various bits of policy'ing we rolled these out locked down. This allows staff to do almost anything conceivable on their laptops apart from installing software. (Cue "I can't install my printer/broadband/dildo at home!!!!111")

 

I am starting to get a bit of stick because staff are complaining they can't install stuff and the laptops are pointless. Of course I agree we will install any software they want providing it's all above board etc, and in any case most of their software runs directly off CD. OK so this is making me a little unpopular (afterall we aren't here to make friends are we?) but how can I say I am managing these laptops if we're letting staff install all kinds of crap on them? Conversely I know it's frustrating and perhaps it does affect their T&L - so what's a guy to do?

 

In the last company I worked for, they didn't even let their MD install software on his laptop - but they had very specific application requirements that didnt change unless a big roll out was happening.

 

bah, I don't know. I guess I just want a little advise on how to deal with it all. I love my job but this is the only issue really getting me down (sounds stupid I know) I might be a bit wet behind the ears but I think it would be bad to back down on this as it will just open the floodgates. As I say SMT are in approval (but then again I havent got round to locking down their laptops - yet) They have supported me by saying stuff like some staff have been here for years, don't like change, etc.. All I am trying to do is run the network like any business would do

 

Yours

 

Frustrated :twisted:

 

PS I wasn't sure if this is in the right forum, if not feel free to move

[GrumbleDook]

I have to admit that we are fairly relaxed here ... we give staff a local account as well as the locked down domain account. They get used to using one for work and one for home. They have local admin rights on the laptop as the 'home' user but with the caveat that they have to look after the machine.

 

We do have a number of lusers each year who infect their machine (easily spotted thanks to ePO) or plain bugger it up .. but rarely the same person twice.

 

An alternative is to give them a virtual machine on the laptop that they have complete control over.

 

We can manage it here as we have the support staff ... and the benefits of having staff that are becoming happier with IT ... outweighs the problems.

 

For us it means that staff are more likely to be able to tell students what to do when they need help / advice but the staff are more confident ... but this has taken a number of years to get to this point.

 

Above all ... we have it in the laptop contract that the laptop may be seized and checked at any point for unlicensed software (causing a number of staff to look for open source solutions) or general health checks. We also have the warning that laptops are only to be used for work purposes due to it being a taxable perk if used for personal stuff.

[Grommit]

We give the laptops to the staff with the local administrator account and they can do what they want..

 

But they cannot put it onto the School network... not even the internet...

 

Every one of our classrooms has a PC, all department offices have PC's as well as the staffroom.. so there is no need for them to have the laptops on the network..

[srochford]

Giving someone a laptop they can take home but then can't connect to the school network seems like a complete waste of time.

 

I could be completely wrong, but I'd guess they're given the laptop so that they can work at home. They then bring the laptop into work the next day and want to print out files; copy files for students to use etc and you say "no".

 

We have an approach similar to Grumbledook and this seems like the most reasonable. We will wipe/reinstall a machine if a user causes problems but we don't see it as our job to make life difficult for teachers (or other staff)

[Geoff]

Teachers using our laptops get a local login that has local admin rights. They can also login to the network normally if they want. Laptops come in regularly for 'servicing'. If there's any need, we'll re-image them. If the laptop attempts to do anything naughty on the network it gets blown away by our NAC box (Packetfence).

[pallen]

We have a policy here that covers anything connecting to our network. The security settings are the same, restricted access to install programs and use floppys etc. I inform the staff who are interested in buying laptops that they will have the same restrictions as desktop PC but with the ability to be used anywhere in the school.

 

There are very few staff who need a laptop in order to be able to work at home and continue in school. Those who do work at home do so by email or bring it in on a USB pen. It may be different for larger schools who have a team of IT support, but here there is only me, and I dont have the time to check what is installed on laptops that i do not controll. If the teacher wants local access to it, it does not go on the network and comes under their controll when it comes to licenses etc. If there is a problem, it will be remiaged with the software it had on it when it was purchased. Any other software will only go on if it comes with licenses.

[_Bat_]

We have a similar approach to grumbledook as well. Local user with admin rights with the option of logging onto the network if they wish.

 

I wish they didn't have the option of logging onto the network though because no-one can seem to get their head around the idea of two separate user accounts... one local and one domain. It causes so much confusion for the teachers that most only ever use the local account nowon their laptops.

[bossman]

All staff have laptops and they have local admin rights as they only use them for internet at school. I have imaged them all using Acronis and it takes only minutes to get them back to brand new.

 

As they all have remote access via TS they don't really use the laptops that much, they tend to use them as a personal desktop at home rather than buying their own. Using them this way allows the Staff to evaluate software and other things which is very helpful to them as they are locked down tight on the network.

[mrforgetful]

We too have them set up with a local Admin account for them to use and also possible to log on to the network with their normal restricted account which can access C drive to get to files they did at home using the other account.

[ruggie_uk]

I only have the one login for them but I give each teacher's network login local admin rights on their own laptop.

It has worked pretty well so far as I insist on a half termly inspection and upgrade session.

We had a training session to instruct them on what is risky behaviour and to be honest it has worked pretty well. They are using judgement as to what is ok to install and anything they are unsure about they are bringing to me. I'm happy at this and it is a nice middle ground between being helpful to them and still maintaining as much control as is realistically practical.

[maniac]

our staff users all have local power user rights to their laptops thanks to a handy script which adds the local group memberships at startup. This allows them to install printers and other hardware, but not software we still do that for them so we can audit what's being installed.

 

Sometimes we will grant a user local adminstrator rights for a short period of time if they have things like home broadband software they need to install with the laptop at home, this is easily managed by group memberships in AD.

 

Mike.

[OutLawTorn]

At one of the schools i work at, Year 7 students and some teachers have their own laptops. They have a domain account that has user rights (gets their printers/etc installed via group policy) then a local account with full access. Generally we haven't had too many problems with their domain accounts, since its the "home" accounts that get full of junk.

 

We then have an image of the laptops (since the hardware is the same on all of them) that includes windows, office, virus scanner and other school related software using altiris/ghost and if they have a problem with any aspect of the software it just gets reimaged. They have been told to keep backups of any work and files elsewhere, so if they lose anything its on them.

[ReverentCreature]

The laptops I have given out are "Romaing workstations" and so are literally the same as their classroom workstations. I given them temporaty admin rights ONLY for if they want to add their home wireless connection into Control Panel or want to install their home printer.

 

Some staff have complained that they cant do things but I just remind them that the statement they signed states that they will not use their laptop as a personal computer and that its illegal for staff to install stuff that they did not purchase!

[Jake]

We pretty much just gave up, teachers were installing masses of games on their laptops, some even put porn on there, or rather they said their son/daughter/niece/nephew did...yeah? and what were they doing using it anyway..its a laptop for the teacher, not for the teacher to freely lend out to whomever they want to use it.

 

After multiple occurrences of it happening, no punishment being dished out and several heated conversations about why they cant do what they want with "their" (sorry...I thought it was the schools and you were just borrowing it) laptops. We just gave up, now they get admin rights and are free to do whatever they, or as is more likely their son/daughter/niece/nephew, want to do with it. We find that most just use the laptops as a free computer for their kids anyway

[Skoggmeiger]

Do any of you install software firewalls on the laptops?

[danIT]

We lock down teacher laptops, so far as they even have to ask permission from line managers to get us (IT techs) to give them admin rights to install broadband on there laptops.

 

1. Teacher sacked accessing inappropriate materials

2. Teacher suspended following enquires about running a business abroad via school equipment while at home. Also some school time use to manager stocks and shares. Looks like he will resign, as a multial agreement between his union and the head

3. Teacher used to let son use laptop for MSN, IM and general surfing. Not suspended, but had to give up laptop for good.

4. Teacher accessing inappropriate material in school time, excessive internet use within school. laptop removed

 

We are pleased with how our SLT/SMT react when matters arise so our staff tend to be responsible.

 

Speak to your Head if you are getting stick, or the person who allocates laptops?

[Oops_my_bad]

Thanks for all the views. I think the temporary granting of local admin sounds like a good way of getting round the "setting up my broadband at home" plague which we seem to have here at the moment. Other than that i'll have to see how it goes. We do seem to be getting less (if none at all) issues with locked down laptops technically, but maybe it's because they aren't using them for their porn and crapware?

 

I wonder how staff laptop issues are dealt with under BSF? I can't see them providing unlocked laptops somehow :s

 

scrogg: We have an LEA wide agreement for Sophos endpoint. Whilst I deploy the firewall onto all laptops and PC's it is not yet configured as I haven't got round to it yet.

[Brewer]

"i cant install my home broadband on my school laptop"

Buy a router.

 

We currently only support staff home broadband installs if they buy a decent router, usually just a netgear or D-link, as no install required and we make sure they have security setup.

 

we've decided to deep freeze our new staff laptops and have them all setup to a pre-defined standard, with access to everything staff need for theirday to day lives. Occasionally we may have to add some software to it, and re-freeze the laptop but it seems to be working better than giving them local admin access, no more limewire on our school lappies.

[mattx]

In my view Laptops for staff [ the majority, not director of studies and a few other important roles ] are nothing more than a status symbol.

It's a classic case of - ' I have a laptop, therefore I am either better or more important than you '

 

Laptops in my opinion are a nightmare to manage, they go missing, they get stolen, they break easily, they get lent to other members of the family who then install or try and install crap on them. Teachers who have them never seem to bring them back into the school. Blah Blah Blah - I could go on. /RANT over.

[TechMonkey]

The best one we ever had was a teachers son 'upgraded' the laptop he had been given to XP. We only knew this after he brought in and asked us if we knew why it was running slowly and where his programs had gone. This laptop was one of the original Laptop for Teachers HiGrade models so you can imagine the speed of it. I think 15 mins to startup isn't an over estimation!

 

Ohh how we laughed.

[sahmeepee]

Laptops in my opinion are a nightmare to manage, they go missing, they get stolen, they break easily, they get lent to other members of the family who then install or try and install crap on them. Teachers who have them never seem to bring them back into the school. Blah Blah Blah - I could go on. /RANT over.

 

I agree with pretty much all of that! We had one come in the other day which was 4 years old and had been used...... once! We have a one-or-the-other policy: they can have them on the Internet at home or plug them into the network here.

 

The fad for staff laptops seems to have passed here really, coinciding strangely with the prevalence of home DVD players. Those that do use them for serious work are generally more than happy with offline files but no internet at home.

[Mr.Ben]

With SMT's approval I supply locked down laptops to staff.

 

With the proliferation of wireless in homes there is no need for staff to install crappy usb adsl modems etc. The school's policy is this - have wireless or don't use the internet at home.

 

I supply my teaching staff with instructions on how to connect the laptops, and a tool to clear the schools proxy settings.

 

So far, so good. I have had issues with some older members of staff getting upset that they can't install itunes etc, but I'm firlmy of the opionion that I need to keep an eye on software on laptops as it is my neck on the line.

[daveyboy]

Full admin rights here.

 

I get to call in the laptops at anytime and I just re-image them. They are told this when they get them and sign on the dotted line.

 

I have been known to call the same laptop twice a week for three weeks running until the said staff member got the message.

 

1) Laptops are given on merit - if you cannot show you are making good use of them - you lose them. Constant offenders (like above) are given a month - after which they are taken away and given to someone else.

 

2) Staff must pay for the damage - one staff member gave hers up after paying for a new screen. (dropped)

 

3) They cannot 'log on to our network' but use the internet (with Securus) at home and at school. We also have wedav access to files on our network and we also use ePortal - so no problems there.

 

4) Most have learnt to email us when they try some new software - mainly to stop 'The Wheel of Mis-Fortune' when I call them in. Some have got clever and bring them in after the software trial so I can re-image them without any hassle.

 

5) Power supplies are always a problem and our staff guard them with their life, as we charge them for any loses - If its not in the bag when it lands on my desk - they get the bill. 'At home' or 'I lent it to so and so' is not acceptable. (The same for mice, patch leads and VGA cables.)

 

6) My Headmaster & Director of ICT see them as a luxury item that the school pays good money for. They want 'Best Use' from them and have made the rules - I just implement them.

 

7) Every staff member gets a 2GB pen drive (free) to assist in their work & are used to backup laptops whilst I image them.

 

8) If they land on my desk and the staff member has NOT backed up their work, and they ask me - THEY MUST donate a prize for one of our student competitions - i.e. £10 Woolworths or HMV voucher, etc, etc OR they lose the lot. Their choice.

 

My Headmaster & Director of ICT are fantastic...........