Suggestions for safeguarding software in a non-AD environment?

[accesstomusic]

Hi.

 

I'm looking at safeguarding software that can be effectively used in an classroom environment that doesn't use Active Directory (there is just 1 generic student user account for all Macs/PCs).

 

When I looked at Impero, a lot of the functionality, especially the reporting side of things relies on users having AD accounts. I suspect this is the same for most products.

 

What I'm looking for is a product that can pick-up safeguarding keywords and alert the Safeguarding Officer in real-time. Does anyone have any suggesions?

 

Thanks.

[Al_NetSupport]

Hi.

 

What I'm looking for is a product that can pick-up safeguarding keywords and alert the Safeguarding Officer in real-time. Does anyone have any suggesions?

 

Thanks.

 

Hi @accesstomusic . As you asked for suggestions in the forum thought it would be ok to chip in. NetSupport DNA does not require AD accounts, and certainly is something you can download and try for free to see if it meets your needs first.

 

On the safeguarding side, it will monitor all keyboard and search activity and then trigger real time alerts based on our keyword library. You can include or exclude apps for monitoring and tailor keyword topics and severity to suit your requirements.

 

You can see a summary of our full safeguarding details here : Safeguarding - NetSupport DNA - IT Asset Management or feedback from other schools here NetSupport DNA for Schools - Overview of IT Asset Management for Education.

 

Hope thats helpful

 

Al

[IrritableTech]

Hi.

I'm looking at safeguarding software that can be effectively used in an classroom environment that doesn't use Active Directory (there is just 1 generic student user account for all Macs/PCs).

When I looked at Impero, a lot of the functionality, especially the reporting side of things relies on users having AD accounts. I suspect this is the same for most products.

What I'm looking for is a product that can pick-up safeguarding keywords and alert the Safeguarding Officer in real-time. Does anyone have any suggesions?

Thanks.

Issue is unless you can quickly identify the exact user who is causing a concern you may not be safeguarding as much as you hope. Also consider your prevent duty - how can you be sure who is promoting extremeism if it ever happend?

 

First step to safeguard and cover the organisation I think is to look at proper account management. Then start looking at bolt on services.

[accesstomusic]

Issue is unless you can quickly identify the exact user who is causing a concern you may not be safeguarding as much as you hope. Also consider your prevent duty - how can you be sure who is promoting extremeism if it ever happend?

 

First step to safeguard and cover the organisation I think is to look at proper account management. Then start looking at bolt on services.

 

Completely agree with this, although I need to be looking at ~12 sites across the UK so this will not be a quick fix. I was wondering whether there was a 'sign-in' facility that could be used prior to students using the Internet - kind of like how it's done in Hotels when accessing their Wi-Fi.

[Al_NetSupport]

Completely agree with this, although I need to be looking at ~12 sites across the UK so this will not be a quick fix. I was wondering whether there was a 'sign-in' facility that could be used prior to students using the Internet - kind of like how it's done in Hotels when accessing their Wi-Fi.

 

It's a real challenge as naturally the ideal position is that everyone has their own unique domain account and then tracking, in relative terms, is faily "easy". In practice that concept doesn't fly when you move onto ipads for example, and is quite different with a chromebook. If students have their own phones on site too, then your efforts will always be partial in terms of possible exposure.

@IrritableTech is spot on (as usual), with the the priority, but in paralell, gathering safeguarding intelligence and meeting your KCSIE obligations can be met even without knowing the logged on user. You can still gather intelligence about the terms being searched for - perhaps prompting school assemblies to address a topic, might be a different course of action if terms triggered all relate to Body image, dieting and laxatives for example - which might trigger PD topics with typically teenage girl cohort, vs. searching for extremist material which would link to Prevent policy. The other flip is the requirement for children to have access to resources "self service" (such as on FGM) and then have the ability to report concerns, this can also be done with some products without the need for domain accounts.

 

So perhaps the process is to both look at solutions that capture intelligence and provide students with a means to seek help and in paralell look at infrastructure so user identiy is more visible.

 

Al.

Edited July 10, 2017 by Al_NetSupport

[IrritableTech]

Completely agree with this, although I need to be looking at ~12 sites across the UK so this will not be a quick fix. I was wondering whether there was a 'sign-in' facility that could be used prior to students using the Internet - kind of like how it's done in Hotels when accessing their Wi-Fi.

 

That's an option usually found in your edge filter - which internet filter prosuct are you using?

[psydii]

With no on-prem AD I'm going to hazard a guess that you've gone all in and have Office365 / Google G Suite?

 

How about: Make an AD domain for the filtering platform to use?

 

Most decent filtering systems allow a 'default' set of sites for non-authenticated users, and then if you request a restricted asset ask for authentication (web form/popup) to evaluate whether you are authorised for the site/page/resource. For this you don't need an AD DC at each site.

 

Sync them to the 'on prem' AD using AzureAD Connect. The 'on prem' AD could of course be VMs in Azure or at a central location.

 

 

MIS->(prefered tool)->Google->(SAML)->AzureAD->(AzureAD Connect)->ADDS->Edge Filter

 

or

 

MIS->(prefered tool)->AzureAD->AzureAD Connect->ADDS->Edge Filter

 

https://support.google.com/a/answer/6363817?hl=en

or

https://docs.microsoft.com/en-us/azure/active-directory/active-directory-saas-google-apps-tutorial

 

 

It would take about a week to set that up from a standing start.

[LanSchoolUK_Adam]

Hi accesstomusic,

 

To chime in here, with LanSchool we can provide safeguarding (keywords/keyphrases/website usage/login times and durations etc) and Active Directory is recommended but entirely optional.

 

We can track users against AD and G-Suite, but in an authentication-free environment (such as in EYFS, where all pupils in a class typically share a common login), we can track by the PC's machine name, which works fine in a fixed-seat environment.

 

For hot-seat, it is possible, through the software, to have a pop-up window appear at the start of class that the pupil simply types their name into in order to continue to use the PC, and we can track against that during their session as well. The same system is used in libraries and drop-in centres where there are no user accounts in place.

 

I believe this meets the description in the OP - dropped you a PM so we can discuss further.

 

Regards,

 

Adam

[Gez_Impero]

Hello @accesstomusic

 

Much like Netsupport DNA we too do not require AD accounts when it comes to capturing keywords within your establishment. When a capture has been triggered, in real-time, this includes the device name that has triggered the capture along with the current logged in username.

 

As loyal customer of Impero Education Pro I want to ensure that you are using the product to the fullest and would like to discuss how we can further better your experience.

 

I will PM you my details shortly so that we can arrange a resolution.

 

Kind regards,

Gez Vaughan

Pre-Sales Manager

[psydii]

To simplify my earlier suggestion, Microsoft have put Active Directory as a service in preview:

 

https://blogs.technet.microsoft.com/enterprisemobility/2017/07/11/new-public-preview-azure-ad-domain-services-admin-ux-in-the-new-azure-portal/