iamjezz Posted July 25, 2014 Posted July 25, 2014 Im looking for a solution to make teachers bring in the laptops that have been given to them, looking at once a term and as they have vpn kms 180 days is no good. Reason being we want to make sure they stay upto date ect and over vpn there a lot harder to manage.
computer_expert Posted July 25, 2014 Posted July 25, 2014 Disable the computer accounts in AD? This would prevent domain account logons, but not sure about local users though.
iamjezz Posted July 25, 2014 Author Posted July 25, 2014 It would work but i would have to check which computers to disable ect, looking for a automated process and if they dont use vpn they wont even notice.
MordyT Posted July 25, 2014 Posted July 25, 2014 A group policy change on those PCs to who is allowed to logon to the PCs (make a separate local group if you want this to be offline workable, this can be done with GPO as well). A scheduled task that runs every x days on the PC to remove all users from that group. They bring it in, you re-add them to the local allowed group.
free780 Posted July 25, 2014 Posted July 25, 2014 A scheduled task the logs off the laptop if it cant ping the default gateway of your school. With a message about bringing it in. If you wan't to updates. You can have a wsus server facing outward, just configure it to obtain updates from windows update but you approve which ones. or better still SCCM with a external facing DP,SUP.
jamesbmarshall Posted July 25, 2014 Posted July 25, 2014 Im looking for a solution to make teachers bring in the laptops that have been given to them, looking at once a term and as they have vpn kms 180 days is no good. Reason being we want to make sure they stay upto date ect and over vpn there a lot harder to manage. Rather than force them to come back, why not look at managing them with Windows Intune in conjunction with SCCM? That way as long as they're online you can make they get the updates they need.
iamjezz Posted July 28, 2014 Author Posted July 28, 2014 A scheduled task the logs off the laptop if it cant ping the default gateway of your school. With a message about bringing it in. If you wan't to updates. You can have a wsus server facing outward, just configure it to obtain updates from windows update but you approve which ones. or better still SCCM with a external facing DP,SUP. Thats something i can look into as we manage more or less everything with SCCM already so shouldn't be too much more work.
robjduk Posted July 28, 2014 Posted July 28, 2014 I have not set it up yet but believe direct access allows you to update them from afar.
Duke5A Posted August 5, 2014 Posted August 5, 2014 When I read the thread title group policy to make teachers bring in laptops I thought it would be awesome to be able to use GPO to control user's behavior. Man, the custom templates I would write for some people... Anyways, how are your updates pushed out? I recently started using Local Update Publisher in conjunction with WSUS to push things like Flash, Java, Chrome, etc. It has been working great, but a lot of my users will take their laptops home over extended breaks and by the time they come back the machine is horribly out of date. I was thinking about making my WSUS server public facing, or at least forwarding the ports needed to make WSUS work. We own the outside domain name that matches our internal domain, so I could call out to WSUS in GPO by the full name (http://wsus.ourdomain.com) and it would resolve correctly on both the outside and inside. I haven't gotten to trying this yet, but it looks doable.
plexer Posted August 5, 2014 Posted August 5, 2014 Directaccess if your o/s versions support the latest ver as it's awesome they are connected to the domain as if they are still internally plugged in so it's much better than a dialup vpn type connection all updates and remote access tools will work just they would for a fixed desktop. Ben 1
itwasntme Posted August 6, 2014 Posted August 6, 2014 Rather than force them to come back, why not look at managing them with Windows Intune in conjunction with SCCM? That way as long as they're online you can make they get the updates they need. This would be nice - just wish Intune pricing was a little less expensive (200 devices at ~£10/yr each last time I checked?). +1 for the DirectAccess suggestion though, works pretty well assuming they have a reasonable home internet connection!
jamesbmarshall Posted August 6, 2014 Posted August 6, 2014 This would be nice - just wish Intune pricing was a little less expensive (200 devices at ~£10/yr each last time I checked?). Check again! I believe the pricing is somewhere in the region of $6 per staff member per year for education, but you should speak to a licensing re-seller for a quote. 1
itwasntme Posted August 7, 2014 Posted August 7, 2014 Check again! I believe the pricing is somewhere in the region of $6 per staff member per year for education, but you should speak to a licensing re-seller for a quote. The price I have just had back this morning is £8.46 per user per year - too expensive in my opinion (200+users), but could be an option for devices we can't use DirectAccess with.
Firefox Posted August 7, 2014 Posted August 7, 2014 You could use Orchestrator to check the last logon attribute of every PC and if the value is >X then disable the account.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now