group policy to make teachers bring in laptops

[iamjezz]

Im looking for a solution to make teachers bring in the laptops that have been given to them, looking at once a term and as they have vpn kms 180 days is no good. Reason being we want to make sure they stay upto date ect and over vpn there a lot harder to manage.

[computer_expert]

Disable the computer accounts in AD?

 

This would prevent domain account logons, but not sure about local users though.

[iamjezz]

It would work but i would have to check which computers to disable ect, looking for a automated process and if they dont use vpn they wont even notice.

[MordyT]

A group policy change on those PCs to who is allowed to logon to the PCs (make a separate local group if you want this to be offline workable, this can be done with GPO as well). A scheduled task that runs every x days on the PC to remove all users from that group. They bring it in, you re-add them to the local allowed group.

[free780]

A scheduled task the logs off the laptop if it cant ping the default gateway of your school. With a message about bringing it in. If you wan't to updates. You can have a wsus server facing outward, just configure it to obtain updates from windows update but you approve which ones. or better still SCCM with a external facing DP,SUP.

[jamesbmarshall]

Im looking for a solution to make teachers bring in the laptops that have been given to them, looking at once a term and as they have vpn kms 180 days is no good. Reason being we want to make sure they stay upto date ect and over vpn there a lot harder to manage.

 

Rather than force them to come back, why not look at managing them with Windows Intune in conjunction with SCCM? That way as long as they're online you can make they get the updates they need.

[nicholab]

You can some stuff with maraki.

[iamjezz]

A scheduled task the logs off the laptop if it cant ping the default gateway of your school. With a message about bringing it in. If you wan't to updates. You can have a wsus server facing outward, just configure it to obtain updates from windows update but you approve which ones. or better still SCCM with a external facing DP,SUP.

 

Thats something i can look into as we manage more or less everything with SCCM already so shouldn't be too much more work.

[robjduk]

I have not set it up yet but believe direct access allows you to update them from afar.

[Duke5A]

When I read the thread title group policy to make teachers bring in laptops I thought it would be awesome to be able to use GPO to control user's behavior. Man, the custom templates I would write for some people...

 

Anyways, how are your updates pushed out? I recently started using Local Update Publisher in conjunction with WSUS to push things like Flash, Java, Chrome, etc. It has been working great, but a lot of my users will take their laptops home over extended breaks and by the time they come back the machine is horribly out of date. I was thinking about making my WSUS server public facing, or at least forwarding the ports needed to make WSUS work. We own the outside domain name that matches our internal domain, so I could call out to WSUS in GPO by the full name (http://wsus.ourdomain.com) and it would resolve correctly on both the outside and inside. I haven't gotten to trying this yet, but it looks doable.

[plexer]

Directaccess if your o/s versions support the latest ver as it's awesome they are connected to the domain as if they are still internally plugged in so it's much better than a dialup vpn type connection all updates and remote access tools will work just they would for a fixed desktop.

 

Ben

[itwasntme]

Rather than force them to come back, why not look at managing them with Windows Intune in conjunction with SCCM? That way as long as they're online you can make they get the updates they need.

 

This would be nice - just wish Intune pricing was a little less expensive (200 devices at ~£10/yr each last time I checked?).

 

+1 for the DirectAccess suggestion though, works pretty well assuming they have a reasonable home internet connection!

[jamesbmarshall]

This would be nice - just wish Intune pricing was a little less expensive (200 devices at ~£10/yr each last time I checked?).

 

Check again!

 

I believe the pricing is somewhere in the region of $6 per staff member per year for education, but you should speak to a licensing re-seller for a quote.

[itwasntme]

Check again!

 

I believe the pricing is somewhere in the region of $6 per staff member per year for education, but you should speak to a licensing re-seller for a quote.

 

The price I have just had back this morning is £8.46 per user per year - too expensive in my opinion (200+users), but could be an option for devices we can't use DirectAccess with.

[Firefox]

You could use Orchestrator to check the last logon attribute of every PC and if the value is >X then disable the account.