Google Apps

[Bruce123]

After some toing and frowing we have settled on Google Apps (as opposed to Office 365) as our Cloud based productivity suite and I wondered what experiences other educational establishments have had with planning / implementation. The main reason for choosing it is the collaboration features it has over Office 365, perhaps making it more suited to students working together on projects/assignments both in and out of the classroom.

 

We are keeping our on-premise Exchange for staff email, and students will use Google Apps (staff may also have Google Apps email too).

 

Have people created their Google Apps domain within the same email address space as their on-premise email (e.g. [email protected]) or have they created a sub-domain for apps email addresses ([email protected]) or a completely separate domain? If the former, how did you handle discriminate routing of incoming emails (some to internal exchange and some to Google)?

 

How have you sycned the Google domain with the accounts in AD? Have you used GADS or is there another method? If we use GADS how often do you run a re-sync? I am concerned that if it was too infrequent it would make the time to reset a password in AD to reflect Google Apps password unacceptably long. E.g. If it is run once per hour the student may have to wait up to 15 minutes for the password change to replicate to the DC that GADS points to plus 1 hour for GADS to re-sync to the Apps domain, so potentially looking at 1h:15m. When expecting the student to wait more than 15 minutes is too long. Do you sync passwords anyway or just accounts (with App accounts have separate password)? Is Single-sign-on possible? We have up to 30,000 student accounts, so would it even be possible to run it once per hour to resync?

 

A big concern there is is how we can ensure Safeguarding (i.e. protecting young and vulnerable learners)? Obviously, the extra interactivity that comes with Google Apps can enhance collaboration and help students to learn and achieve. But how can we prevent things like Cyber bullying / sexual harassment ? E.g. a student from one class messaging a student from another?

 

The Google Vault would allow us to retrospectively search for any message / email / chat and for us to define retention periods for those. But this is more reactive than proactive. Does it ultimately come down to training and awareness?

 

Have organisations employed Google+ and Hangouts in the classroom? I understand from the Google blurp that this isn't part of Google Apps for Education so does this mean it isn't subject to the same safeguards and assurances (e.g. Google not scanning personal data for advertising)? And I also understand it isn't included in Google Vault data (yet). Then again, it offers great potential for collaboration / working from home.

 

How did the teaching staff take to the "new" Interface and whole cloud based way of working? Did they get training? What about the learners? What level of support do they get and from where? I imagine after 20 years of Office it may have taken some a bit of to wean them off it? Did some staff just persist with using locally install Office and ignore Google Apps?

 

Did you get an external consultant in to assist with planning and deployment? What is valuable in the end?

 

I am really surprised about the lack of information online about these issues, when I do a key-word search on Google surprisingly little that comes up.

 

Many Thanks,

 

Bruce.

Edited July 20, 2014 by Bruce123

[Jonah]

A few answers to one or two of the questions..

 

We use GADS for new accounts, etc, running every hour.

 

Passwords are handled via GAPS (https://support.google.com/a/answer/2611859?hl=en) and is pretty much instantaneous so shouldn't cause any issues.

 

We use SSO using ADFS, it can be fiddly to set up but is well worth the effort in the end. A little info here - Google Apps and Active Directory Federation Services | IT Link Maine

 

You can limit what is available within Google Apps for students/years, etc, so any of the "messaging" type apps can be disabled.

Edited July 20, 2014 by Jonah

[Bruce123]

Thanks for answering some of my questions Jonah.

 

One other question I meant to ask (Jonah and everyone) is about Google drive.

 

According to Google documentation (and confirmed in testing) it can be run behind a proxy server (picked up from Chrome) but only if it is non-authenticating.

 

The problem is ours (and I imagine the vast majority of Schools/College's proxy servers) are authenticating-only and don't allow anonymous connections out via the proxy.

 

How have people addressed this issue?

 

A) Not deployed the drive? Which would be a shame as I believe the virtual drive would help smooth the transition to Google docs (e.g. by allowing users to double click on a 'Google docs file' in the drive and have it automatically open in Google Docs, which is a method familiar to most users).

 

B) Deploy it, but bypass this restriction in some way. If so, how?

 

C) Other?

 

It's a real shame Google haven't resolved this glaring issue with running the drive behind an authenticating proxy. I believe it's been on their 'to-do' list for 2 years now.

 

Thanks,

 

Bruce.

Edited July 20, 2014 by Bruce123

[NotSoFast]

I'd be interested in this too. We are just using the web apps. What I'd really like to do is have Google Drive mirror everyone's home directory, but I don't think it can be done. Please prove me wrong someone!

[rdk]

To answer a few of the questions.

 

Google+ premium features (https://support.google.com/a/answer/2677443?hl=en) is becoming standard as from sometime this week. As an admin I received an email about this the other day. Not sure if it means Google+ is a core service, but it does give admins more control. Be aware that students need to be 13+ to have a Google+ account, which restricts it to the upper year levels and teachers in our school. We have trialled G+ private communities as classroom discussion boards and it does work but hasn't really taken off. I would advise you to make a rule with staff that G+ accounts created with school email accounts are strictly professional only - that way they can communicate with students but also use the accounts on the G+ communities which are great resources for PD and answering questions etc.

 

A few G+ communities you may want to join are "Google Docs & Drive", "Google Apps in Education" & "Google Apps for Education".

 

Your teachers will definitely want to have a google account (I guess making two accounts for you) so that the sharing/commenting functions of Google Docs works OK. We started this way when we first went Google, but eventually shifted everything to gmail. You will find that if students are used to emailing teachers with their current account you could try saying the google account is only for docs, but it won't really work and students will start using the gmail account to email teachers and if teachers don't check it things can get lost. You could set up automatic forwarding from gmail to exchange and this may work for a while.

 

You want to have contact sharing on to get the full benefits of sharing & collaboration, but be aware you teachers will appear as "John Smith" not Mr Smith, and in nested email conversations they will appear to students as "John & me" and things like that.

 

When google says Drive doesn't work behind an authenticated proxy (and it really doesn't) they mean the desktop sync version. All the online Drive functionality works fine. We have 1000 users (students and teachers) all using Drive online only and very few have asked about the sync feature. All our newer kids (last couple of years) are more or less unaware they have network space as they save everything locally or in Drive. Trying to sync their home drives with Google Drive, even if possible, would be a quick road to insanity with the work that would be involved.

 

With student safety you can put a list of "bad words" in the admin section that stops email with these phrases being sent or delivered (and you can get yourself a forwarded copy if you wish). This is not set-up straight from the box - you need to do it. Lots of bad word lists on the internet. As an admin you can change anyone's password and log in to see sent/deleted email if you are worried about particular kids. Maybe write into you policies that student email is not private and can be checked at any time. We consider Vault more a regulatory compliance thing than anything else, but you can get email out OK. We have set retention at 999 years (I think).

 

Happy to help with other queries.

[Bruce123]

To answer a few of the questions.

 

Google+ premium features (https://support.google.com/a/answer/2677443?hl=en) is becoming standard as from sometime this week. As an admin I received an email about this the other day. Not sure if it means Google+ is a core service, but it does give admins more control. Be aware that students need to be 13+ to have a Google+ account, which restricts it to the upper year levels and teachers in our school. We have trialled G+ private communities as classroom discussion boards and it does work but hasn't really taken off. I would advise you to make a rule with staff that G+ accounts created with school email accounts are strictly professional only - that way they can communicate with students but also use the accounts on the G+ communities which are great resources for PD and answering questions etc.

 

A few G+ communities you may want to join are "Google Docs & Drive", "Google Apps in Education" & "Google Apps for Education".

 

Your teachers will definitely want to have a google account (I guess making two accounts for you) so that the sharing/commenting functions of Google Docs works OK. We started this way when we first went Google, but eventually shifted everything to gmail. You will find that if students are used to emailing teachers with their current account you could try saying the google account is only for docs, but it won't really work and students will start using the gmail account to email teachers and if teachers don't check it things can get lost. You could set up automatic forwarding from gmail to exchange and this may work for a while.

 

You want to have contact sharing on to get the full benefits of sharing & collaboration, but be aware you teachers will appear as "John Smith" not Mr Smith, and in nested email conversations they will appear to students as "John & me" and things like that.

 

When google says Drive doesn't work behind an authenticated proxy (and it really doesn't) they mean the desktop sync version. All the online Drive functionality works fine. We have 1000 users (students and teachers) all using Drive online only and very few have asked about the sync feature. All our newer kids (last couple of years) are more or less unaware they have network space as they save everything locally or in Drive. Trying to sync their home drives with Google Drive, even if possible, would be a quick road to insanity with the work that would be involved.

 

With student safety you can put a list of "bad words" in the admin section that stops email with these phrases being sent or delivered (and you can get yourself a forwarded copy if you wish). This is not set-up straight from the box - you need to do it. Lots of bad word lists on the internet. As an admin you can change anyone's password and log in to see sent/deleted email if you are worried about particular kids. Maybe write into you policies that student email is not private and can be checked at any time. We consider Vault more a regulatory compliance thing than anything else, but you can get email out OK. We have set retention at 999 years (I think).

 

Happy to help with other queries.

 

Thanks for all the advice and information.

 

When you say online Drive functionality works fine, do you mean saving to the 'drive' from within the web browser logged into Google Apps (i.e. no drive letter on the computer)?

 

What I was actually thinking was have the Google drive software installed on the desktop (so users see a drive letter), but with no automatic synchronisation (as you said we don't necessarily want or need all existing files on their on-premise home drive synced).

 

Also, relating to forwarding/relaying emails to on-premise exchange (for staff); does Google perform filtering on these (for spam/virus)? If so, how does it handle the emails that don't pass the filter and therefore aren't relayed? Can we verify what emails were blocked to confirm whether the sender really didn't send an email they claimed to have (or not)? I assume we can create white lists for emails that should be allowed (e.g. from a particular domain)?

 

Thanks,

 

Bruce.

[rdk]

Here's a screenshot of the spam settings you can have a look at: https://drive.google.com/file/d/0Bwyns3GzKFY-djhCUGZIVXEtZ2c/edit?usp=sharing

 

I don't think the google drive on the desktop (drive letter or folder) will work as that would be "syncing to Drive" (ie syncing what's in the desktop folder and what's in Drive online) and it won't work behind an authenticated proxy. It will work when at home (if the kids have personal devices that can leave the school) but would be a mess as you would never be sure what is synced and what is not. I think you have to bite the bullet and start thinking about just working online - uploading and converting to Google file formats is straightforward, as is just using the online space for file storage.

 

The converting from Word etc generally works quite well - the biggest issue is that any sort of table formatting is lost - ie merged cells, selected borders removed etc. Drive has just been updated (rolling out - some users have it some not, and not everyone across a domain) and you can now upload/share/edit Word documents without converting to Docs format, but its still doesn't handle tables at all well.