One-One Laptop - How would you lock them down?

[baztech]

I am in a primary school with a one-one laptop program (parents purchased the laptop, kids get them a 10yrs and use them until they graduate at 12yrs old).

 

This year we ran it with the kids (10yrs old) being local admins and not being domain joined, it was less than ideal. It resulted in games being installed, wallpapers changed, colour schemes changed, toolbars galore etc etc. Small issues but they build up and result in lots of time wastage.

 

How would you manage this kind of environment?

 

I am thinking a local admin account and a domain account. The domain account is for whenever they are at school, the local admin is for home usage. Or perhaps no local admin access although I think we'd cop some backlash from parents.

[baztech]

We do this with IPads and use meraki to lock down and apply our own profiles to the devices, but same principles could be applied to laptops from experience I'd give them a standard user account rather than a local admin as this limits the opportunity to break the device. Explain in whatever documentation that the schools is responsible for installation and maintenance of the device whilst the child is at your school and when they leave all school owned software and restrictions will be removed and the device handed over.

We use configurator, all locked down which works great. But they are school owned so we can do what we want.

 

In terms of our 1-1 student owned laptops would:

 

1) Have students login via our domain user for any school work / homework

 

2) Students use their own local account (regular user)

 

^^ Does that make the most sense? Is there a better option?

 

All laptops are wiped when they graduate as it has our enterprise licensing.