Netsweeper with Schools Broadband

[SchoolsBroadband]

morning @Blue_Cookeh,

 

we've just seen this starting to happen over the last 48 hours (we are still in beta though so we do expect a few bugs). @ROB_mason is on this at the moment with Netsweeper. Watch this space we'll be in touch.

 

Thanks

 

Dave

[RobMason]

FWIW if you're on the new system with the Auth agent I've seen an issue where users' sessions expire in Netsweeper overnight and then in the morning they're considered "noauth" and forced back down to a Pupil profile.

 

I assume this is because the auth agent is only run via a Logon script if you followed SB's instructions. Most of our staff (we're 100% Windows 10) don't actually log off their devices regularly, they just put them to sleep which obviously just locks their session rather than logs them out. I'll have a play around with task scheduler or something today to force a reauth every X minutes or something, unless @SchoolsBroadband has already caught this?

 

Morning,

 

We can ammend the timeout if you have staff that do not like to log out, a couple of schools have asked for the session to be infinite and we do a weekly purge of authenticted users over the weekend. We do advise the best course of action is to get your staff to log out but understand this can sometimes be tricky.

 

Thanks,

 

Rob

[Blue_Cookeh]

Morning,

 

We can ammend the timeout if you have staff that do not like to log out, a couple of schools have asked for the session to be infinite and we do a weekly purge of authenticted users over the weekend. We do advise the best course of action is to get your staff to log out but understand this can sometimes be tricky.

 

Thanks,

 

Rob

 

Thanks for the quick replies guys - seems like there are plenty of options. I'd rather let sessions timeout semi-regularly - I'll see what we can do on our end, pesky users

[RobMason]

Thanks for the quick replies guys - seems like there are plenty of options. I'd rather let sessions timeout semi-regularly - I'll see what we can do on our end, pesky users

 

No worries, if you need any help just shout.

 

Thanks,

 

Rob

[DeGrimmy]

We've had Netsweeper at our primary school for a while now, and we moved to a transparent proxy a couple of months ago. Since then, we've been having an issue where staff sometimes gets pupil level filtering. After a very long back and forth with Schools Broadband support, we've been told that the filter will reset to pupil level filtering if a member of staff is logged in to more than one device at a time, which is a fairly ridiculous restriction in a school environment. Has anyone else had a similar issue with Netsweeper?

[mavhc]

We've had Netsweeper at our primary school for a while now, and we moved to a transparent proxy a couple of months ago. Since then, we've been having an issue where staff sometimes gets pupil level filtering. After a very long back and forth with Schools Broadband support, we've been told that the filter will reset to pupil level filtering if a member of staff is logged in to more than one device at a time, which is a fairly ridiculous restriction in a school environment. Has anyone else had a similar issue with Netsweeper?

 

How does it tell who is who as a transparent proxy?

[DeGrimmy]

How does it tell who is who as a transparent proxy?

The users are authenticated through an Active Directory security group.

[snagrat]

How does it tell who is who as a transparent proxy?

 

There is a client that runs on the device.

 

Only issue we have with users dropping back onto the default filter is because there is a timeout (default 24hours) and if the authentication hasn’t happen again with in that time then they become unauthenticated.

 

However SB can increase this for you. I now have ours set to 7 days

[DeGrimmy]

There is a client that runs on the device.

 

Only issue we have with users dropping back onto the default filter is because there is a timeout (default 24hours) and if the authentication hasn’t happen again with in that time then they become unauthenticated.

 

However SB can increase this for you. I now have ours set to 7 days

We've had ours increased to 7 days as well, but it doesn't seem to have made a difference.

[SchoolsBroadband]

We've had Netsweeper at our primary school for a while now, and we moved to a transparent proxy a couple of months ago. Since then, we've been having an issue where staff sometimes gets pupil level filtering. After a very long back and forth with Schools Broadband support, we've been told that the filter will reset to pupil level filtering if a member of staff is logged in to more than one device at a time, which is a fairly ridiculous restriction in a school environment. Has anyone else had a similar issue with Netsweeper?

 

Hi @DeGrimmy,

 

I've just sent this over to @RobMason who is our product manager. This isn't something I was personally aware of but let me look into it for you and I'll get back in touch.

 

Thanks

 

Dave

[IrritableTech]

Does anyone know if there is any issue calling the logon script provided as a scheduled task every few minutes? We've been thinking about this approach to combat the fact that log on and log off scripts don't run on switch user.

[mavhc]

I don't use netsweeper, but in general I only have transparent proxy for guest machines, everything else is defined with wpad, so uses Kerberos for identifying users

[Dom_]

How's everyone dealing with Bing not being inspected? Bit of a prevent concern when we can't see what the kids are searching

[Arthur]

How's everyone dealing with Bing not being inspected?

Block Bing?

 

That's what I did after this...

 

www.edugeek.net/showthread.php?t=202871

[Dom_]

Block Bing?

 

That's what I did after this...

 

www.edugeek.net/showthread.php?t=202871

 

But if you block Bing you also block clipart :-\

[Edu-IT]

But if you block Bing you also block clipart :-\

Is that really an issue given the above? I would say clip art falls further down the priorities.

[Dom_]

Is that really an issue given the above? I would say clip art falls further down the priorities.

 

I'd say so in primaries, especially when HTTPS inspection is do-able (just disabled for some reason)? Safe search prevents the stuff above, need to know what the little darlings are searching though...

 

Plus, if it's disabled for Bing, what else is it disabled for? Do you block all other search engines? There's no documentation saying Bing is excluded from HTTPS inspection (in fact the last mailshot that went out stated "It provides 100% web traffic inspection - (including SSL), blocking content & keyword searches as well as URLs"), so if we hadn't stumbled across it we'd be totally unaware...

[RobMason]

We've had Netsweeper at our primary school for a while now, and we moved to a transparent proxy a couple of months ago. Since then, we've been having an issue where staff sometimes gets pupil level filtering. After a very long back and forth with Schools Broadband support, we've been told that the filter will reset to pupil level filtering if a member of staff is logged in to more than one device at a time, which is a fairly ridiculous restriction in a school environment. Has anyone else had a similar issue with Netsweeper?

 

Good Evening,

 

There should be no issue with staff logging into multiple devices but this is something we can control/enforce, our standard setting is a maximum of 5 devices unless otherwise advised by the school. If you drop me a PM with your school details I can check the agent settings for your site. The only time the agent will not report authentication is if an IP address changes while the user is already logged in, we normally see this with laptops that have both wired and wireless connections running at the same time.

 

Thanks,

 

Rob

[RobMason]

Does anyone know if there is any issue calling the logon script provided as a scheduled task every few minutes? We've been thinking about this approach to combat the fact that log on and log off scripts don't run on switch user.

 

A couple of schools have done this and I believe it resolved their issues,

 

FYI for all, we are currently testing a new version of the Netsweeper WAGENT that will have a number of new features including but not limited to;

 

a) run as a service

b) send authentication updates to the webadmin servers on a schedule (timers can be fine tuned)

c) be available as an MSI allowing deploying via GPO without the need for logon/logoff scripts

 

Once the WAGENT has passed all required tests we will make it available to exisiting customers,

 

Thanks,

 

Rob

[IrritableTech]

A couple of schools have done this and I believe it resolved their issues,

 

FYI for all, we are currently testing a new version of the Netsweeper WAGENT that will have a number of new features including but not limited to;

 

a) run as a service

b) send authentication updates to the webadmin servers on a schedule (timers can be fine tuned)

c) be available as an MSI allowing deploying via GPO without the need for logon/logoff scripts

 

Once the WAGENT has passed all required tests we will make it available to exisiting customers,

 

Thanks,

 

Rob

 

That’s really helpful. Thank you Rob.

[Dom_]

I'd say so in primaries, especially when HTTPS inspection is do-able (just disabled for some reason)? Safe search prevents the stuff above, need to know what the little darlings are searching though...

 

Plus, if it's disabled for Bing, what else is it disabled for? Do you block all other search engines? There's no documentation saying Bing is excluded from HTTPS inspection (in fact the last mailshot that went out stated "It provides 100% web traffic inspection - (including SSL), blocking content & keyword searches as well as URLs"), so if we hadn't stumbled across it we'd be totally unaware...

 

Is everyone just blocking Bing then?

[synaesthesia]

I should hope so - it's outright dangerous and there's no safesearch system I've found that makes it usable.

[Dom_]

@SchoolsBroadband should this be blocked as standard if it can't be filtered then?

[synaesthesia]

@SchoolsBroadband should this be blocked as standard if it can't be filtered then?

 

Need to be careful as some bing domains are used for other services such as speech recognition

[sister_annex]

A couple of schools have done this and I believe it resolved their issues,

 

FYI for all, we are currently testing a new version of the Netsweeper WAGENT that will have a number of new features including but not limited to;

 

a) run as a service

b) send authentication updates to the webadmin servers on a schedule (timers can be fine tuned)

c) be available as an MSI allowing deploying via GPO without the need for logon/logoff scripts

 

Once the WAGENT has passed all required tests we will make it available to exisiting customers,

 

Thanks,

 

Rob

@RobMason is there any news on this? We're planned in to migrate to the inline over HT. We've been given the normal agent with the setup instructions however I was wondering if this way was the better option (depending on testing)?

 

Cheers