Staff Laptops at Home

[ICTM-Services]

Hi Everyone,

 

I just wanted to see what people are doing in regards to Staff that use laptops on site and then take them home at the end of the day.

Currently we are using cached profile in conjuction with offline files, it works fine but would like to see what others are doing.

 

Kind Regards,

 

Scott

[6Foot2]

We had cached profiles/offline files with a previous network (Viglen/Classlink 7) A good long while ago we moved to a vanilla network.

 

We now configure our laptops for staff with 'Primary & Privileged' users and remote access to the network via an LEA supplied RDP solution.

[CHiLL]

We don't do any form of caching or syncronising. We just create a local user on the laptop and they can access that at home. If they need to access their school drives, they can connect in either via RDS or Home Access Plus+. The laptop is also using BitLocker encryption, in case of loss or theft and they've saved sensitive data on it.

[chazzy2501]

we use direct access with local profiles. simple, fast and seamless.

[DCUK6]

Ive always had offline files setup so they can use laptops at home.

 

Weve recently changed it up though, no offline files and they have to use our remote service.

They login to their laptop at home using normal network username but everything is blank as it doesnt have server access. They then remote in.

 

Means we can monitor everything to.

Downside is that they have to have internet access. Upside is no documents are stored on the laptop as everything is redirected.

[ICTM-Services]

Lovely Thanks guys for replying, this GDPR means you have to look at these things a lot more carefully .

[DCUK6]

Yeah, GDPR, im still trying to secure funding for a centrally managed encryption service.

 

Even though no documents are stored on the laptops you obviously have username and basic details. +It will stop people accessing windows without the drive password.

 

The key thing ive always looked for with encryption is that it regulary reports back to say the laptop is still encrypted. This way if they lose a laptop when you report you can show it last connect on this date and it was still encrypted. Better than saying it was encrypted 3 years ago and should still be encrypted.

[ICTM-Services]

What about managing BitLocker from Windows Server does that still not have the desired requirements?

[TwistedHelixis]

At all my primary school we stopped using offline files many years ago and then setup a remote access gateway. We have recently decommissioned remote access and the staff now access all their files using Google Drive / File stream.

[Reboot_IT]

Don't give them laptops... problem solved!

[ICTM-Services]

I couldn't agree more!

[christhetech]

Don't give them laptops... problem solved!

 

That's just it though. It's not problem solved, just creating a whole new bunch of issues. If the staff member has a school asset that they can take home to use, at least you have some control over the device and how it can be used. If they are using their own device at home, that's a whole different can of worms.

[atcoates]

Unfortunately these days staff are being asked to do more and more and most teachers will spend a significant amount of time at home planning etc. Our job is to deliver a cost effective secure solution that facilitates that.

[Mujja]

We disable Folder Redirection for laptop users. Off-site they login using the cached profile and then use VPN and run a shortcut on Desktop which maps network shares.

 

The process was in use before I started here. I did demo Offline files but it was tried before my time and there were reasons the feature was never used which no one remembers.

 

Direct Acces was looked at but now the drive is towards Azure AD with OneDrive, might never happen though.

 

We try to get users to use Google Drive but they are free to use whatever they want until they lose their data and then it's our fault.

[psydii]

Previously: roaming profiles offline files and bitlocker. (Since win2ksp3)

 

Now:OneDrive and bitlocker and vpn for sims.(since 1709)

 

Firmware/boot menu protected by password.

 

No Admin access for users.

 

SCCM and other management services published to the internet.

[safehands96]

We use a bit of kit called Ericom (wasnt my choice) seems ok but its web based so can limit what can be done. Seems ok at the minute though for what teachers need

[theeggmaster]

We don't give them laptops, but most of our work is done on G Suite for Education. If they do need certain apps, I have RemoteApp set up. I also have HAP set up if they need to upload/download files into/from their 'My Documents' folder or the shared area.