Locking PCs

[colly72]

Hi all,

 

We are currently reviewing our policy in terms of PCs installed around school and specifically, the issue of locking PCs/laptops, when teachers and other staff are not using them. At the moment, we state in the staff handbook that PCs should always be locked when not in use but we don't actively enforce this, with something like Group Policy, as this has caused issues in the past, with staff leaving PCs logged in, then other staff not being able to use them and also PCs being locked half way through lessons.

 

I'm trying to establish what other schools do to mitigate the issue, whilst also stopping teachers being at my door every few minutes because the PC has locked automatically. Does anyone have any good practice that they could share?

 

Thanks in advance.

[Steve21]

Standard GPO here that goes to screensaver, and locks when it exits.

 

Screensaver won't activate with any fullscreen items like movies etc, and if it's a normal screen e.g. Worksheet they just need to hit the mouse once in a bluemoon anyway. (Most freeze the projectors and do other work anyway when sheets up)

 

Switch user is enabled so no issues with other teachers logging on

 

Steve

[DavR]

Just implemented this here for start of September, at the same time as updating and enforcing a new password policy. There's no hard and fast rule exactly as to what password policy / locking you have to enforce, but with GDPR coming I've been using the line "to comply with current data protection standards". Just make sure you have SLT on board to back you up.

 

We have user switching enabled, teachers have a 15 minute timeout, admin staff have a 10 minute timeout. Teachers are already in the habit of using the freeze tool on projectors / displays, so there really is no business case for needing to leave screens unlocked for any longer.

 

I've had surprisingly few complaints to be honest, most people recognise this is a legitimate security issue.

[hardtailstar]

Ours is 15 minutes I think.

 

But educating teachers on keeping laptops/pcs locked when not in use is much longer!

 

We regularly find in holidays staff leaving laptops on show in classrooms etc when they are told to lock/hide them away in cupboards.

[LeMarchand]

Standard GPO here that goes to screensaver, and locks when it exits.

 

Screensaver won't activate with any fullscreen items like movies etc, and if it's a normal screen e.g. Worksheet they just need to hit the mouse once in a bluemoon anyway. (Most freeze the projectors and do other work anyway when sheets up)

 

Switch user is enabled so no issues with other teachers logging on

 

This is what we do. Only one person makes a fuss about it, but as they have yet to either report it through the approved mechanism or get the head to tell me to change the policy I'm not prepared to change it.

[DavR]

This is what we do. Only one person makes a fuss about it, but as they have yet to either report it through the approved mechanism or get the head to tell me to change the policy I'm not prepared to change it.

 

There's always one.... even if you give them the option of how to change or resolve something, they'll still prefer to moan!

[enjay]

Same as @Steve21 here. The remaining risk is the policy is set to kick the screensaver in 15 minutes, which is a sensible time-out when teaching but quite a big window of opportunity if you pop out of your classroom at breaktime. I might consider reducing it and telling people to use "freeze" if they want to leave something up for a long time.

 

If I could also get teachers to turn their projectors off when they're not actively in use, I'd be a happy man but that's a different battle!

[markwilfan]

I had one of those ideas you have in the shower the other day. We don't currently enforce locking of pc but regularly tell people to do it by various methods.

 

We have had a spate of my tech and I coming across pcs not locked and have had a few "confrontations" when we try to tell the culprits.

 

To mitigate the angry feelings I have set up a mailbox called lyp (lock your pc) with an auto reply set up. If we find a pc that we can get to the emails on we send and email to lyp with what pc and what we could get to. This then in turn emails the staff member with a blurb about locking their pc pointing out the implications and links them to our policy. This also means it gets logged too which is nice.

 

Worked well so far. No more arkward conversations being made to feel like we are in the wrong.

[TechMonkey]

If we find an unlocked PC we normally do one of 2 things. If they are known as having a good sense of humour we try and find the weirdest picture of Winnie the Pooh possible at the biggest resolution. It is then made full screen and the PC locked. You've just pooh'd on their computer. If they are an unknown quantity or known to be of short temper a word document is opened and a message left, in as large font as possible, telling them to please lock their PC.

 

The kids in the classes of the former group now openly remind the staff or else they will get poo'd or tell them off if they unlock their PC and find the picture. The latter group have been given a warning.

[mavhc]

Inject staff who forget to lock their PC with RFID chips, when they're out of range, auto lock

[enjay]

If they are known as having a good sense of humour we try and find the weirdest picture of Winnie the Pooh possible at the biggest resolution. It is then made full screen and the PC locked. You've just pooh'd on their computer.

Love it!

 

I know of a school where the IT staff, caretakers and even cleaners were told to remove any staff laptop/iPad found unattended and replace them with a note saying "your laptop can be collected from the Headteacher". Change of practice was very quick! For locking PCs, this could obviously be replaced with an email to the Headteacher (stating whether SIMS was open or not).

 

With single sign-on to many systems (and browsers remembering passwords to the rest), locked PCs are a serious threat to data security, and with it DPA/GPDR compliance.

[DavR]

All very entertaining and inventive ways of dealing with the problem. The Pooh method particularly is uniquely primary school, I worked in an office once where anyone who left their desktop unlocked got pranked with "amusing" wallpaper. Tempers were frayed by that game.

 

But seriously though, automatic lock needs to be set in policy these days. Get authorisation from the head and just do it, quote DPA/GDPR, shrug your shoulders and say "we have to".

[enjay]

Inject staff who forget to lock their PC with RFID chips, when they're out of range, auto lock

 

Joking aside, I've seen Bluetooth keyfobs which would do this. You could get these and insist staff wear them on their ID lanyards.

[LeMarchand]

Joking aside, I've seen Bluetooth keyfobs which would do this. You could get these and insist staff wear them on their ID lanyards.

 

You can also use phones, but this would be a lot of work pairing phones.

[mavhc]

For <£10 you could install USB RFID readers, then auto lock when your rfid tag is removed from it, attach rfid tag to user via string.

[enjay]

You can also use phones, but this would be a lot of work pairing phones.

 

Staff don't have to take their phones with them when they leave the room, they do have to take their ID with them...

[LeMarchand]

Staff don't have to take their phones with them when they leave the room, they do have to take their ID with them...

 

Good point! Though in most of my schools they're more likely to keep their phone with them than their ID!

[enjay]

Good point! Though in most of my schools they're more likely to keep their phone with them than their ID!

 

We're pretty hot on ID here, YMMV of course.

[TechMonkey]

All very entertaining and inventive ways of dealing with the problem. The Pooh method particularly is uniquely primary school, I worked in an office once where anyone who left their desktop unlocked got pranked with "amusing" wallpaper. Tempers were frayed by that game.

 

But seriously though, automatic lock needs to be set in policy these days. Get authorisation from the head and just do it, quote DPA/GDPR, shrug your shoulders and say "we have to".

 

Yes, it is a sanitised version of the game played by one of our ex-accounts ladies. She would find an actual picture of a poo. I usual use

or

 

I have gone through various methods from sending a screen shot of what is open on a screen to SMT, typing an email but not sending or adding an address or writing a letter stating what of their information could be lost. As there was no will or desire from on high to push this as a priority I ended up running my own guerrilla campaign to hit them where it hurts. Ridicule by pupils.

 

We do have auto lock on but I was forced to set it to be 15 mins so still find open PCs. I even looked at all the PCs on my route out on the last fire drill (I knew it was a fire drill, it was advertised as a fire drill) and found some. I was criticized for this as being too picky as in a fire everyone should get out rather than worry about their PC. My reply was that if I was being naughty that was exactly how I would get on a companies PC, set the fire bell off and find an unlocked on. Apparently I have to much time on my hands, have too vivid an imagination and I am too paranoid....

[enjay]

As there was no will or desire from on high to push this as a priority

 

No desire from on high to ensure compliance with the DPA or GDPR? Okay.....

[TechMonkey]

No desire from on high to ensure compliance with the DPA or GDPR? Okay.....

 

Yep... & that is all I'm going to say on that.

[jimmy_2k]

One of my last places. We would open up their email and email the rest of the IT Team. "Tea on me for the week!"

[NB9457]

Yes, it is a sanitised version of the game played by one of our ex-accounts ladies. She would find an actual picture of a poo. I usual use

[ATTACH=CONFIG]45529[/ATTACH]

or

[ATTACH=CONFIG]45530[/ATTACH]

 

I have gone through various methods from sending a screen shot of what is open on a screen to SMT, typing an email but not sending or adding an address or writing a letter stating what of their information could be lost. As there was no will or desire from on high to push this as a priority I ended up running my own guerrilla campaign to hit them where it hurts. Ridicule by pupils.

 

We do have auto lock on but I was forced to set it to be 15 mins so still find open PCs. I even looked at all the PCs on my route out on the last fire drill (I knew it was a fire drill, it was advertised as a fire drill) and found some. I was criticized for this as being too picky as in a fire everyone should get out rather than worry about their PC. My reply was that if I was being naughty that was exactly how I would get on a companies PC, set the fire bell off and find an unlocked on. Apparently I have to much time on my hands, have too vivid an imagination and I am too paranoid....

 

I must say the fire drill part may be a little bit picky, if a teacher is stood away from their PC, at the board say, teaching, their priority when that alarm sounds is ensuring the pupils and themselves leave the building as quickly and safely as possible, if a PC is unlocked, so be it, there may be sensitive info but also lives at risk. Even if it's a drill, it has to be treated as real life, hence why we are told to leave any objects and get out as safely and quickly as we can.

[enjay]

I must say the fire drill part may be a little bit picky, if a teacher is stood away from their PC, at the board say, teaching, their priority when that alarm sounds is ensuring the pupils and themselves leave the building as quickly and safely as possible, if a PC is unlocked, so be it, there may be sensitive info but also lives at risk. Even if it's a drill, it has to be treated as real life, hence why we are told to leave any objects and get out as safely and quickly as we can.

 

Our teachers lock the classroom door once the room has been evacuated, meaning the unlocked PC is "safe". Unfortunately, we're aware of instances of students setting the alarms off then rummaging through bags in empty classrooms, hence the decision to lock the doors.

[mavhc]

Get the server to lock all client PCs automatically when the fire alarm goes off, with the message: there's a fire, go outside!