keeping office and curric separate

[adamyoung]

How do people keep their office and curriculum networks separate, if you do at all?

[webman]

We used to have them all on one subnet, but just have the admin machines join a different domain to our CC3. Then we integrated both networks and never looked back since

[Disease]

We have an Admin and curriculum network seperated by a V-LAN on our switch. Admin can access Curriculum but Curriculum can not access Admin.

[Roger]

Separate, different IP ranges, one way trust, curric trusts admin, works fine.

[ChrisH]

Originally the two networks only physically met at the Internet router and now there is a connection from admin to curriculum but only to the mail server with 2 nics.

[darkest_star]

We have an Admin and curriculum network seperated by a V-LAN on our switches and we subnet different areas of the school to Admin or Curriculum depending on the conection to the switches

[DMcCoy]

I'm not sure I see any great advantage with keeping the networks seperate. I combined both networks 2 1/2 years ago, and haven't run in to any major issues. I find that most of the same services are required for both sets of users, so they might as well be provided from a single source.

[ChrisH]

In Lancashire thats just the way the LEA have recommended or set up the networks. Our internet access originally was from a router with 2 ports. Its now our microwave dish to a vlaned switch. I dont like having two networks as it means doing a lot of stuff twice in some cases but for now were stuck with it. Eventually I hope to move to one network.

[secman]

We look after two schools. The Primary Scholl has two separate IP Address Ranges as supplied when they attached to the London Grid for Learning via the LEA. This is known as "Option 1" and seems to be being used by a fair number of schools in our area. At the Senior School we are on "Option 2" mainly because we have our own firewall and this gives us 16 "public" addresses to use for things like a web server or VPN (if we ever get the time to look at something like that!) Internally we use one IP Subnet and separate the users currently by Domains. This may all change though as we intend to move to one Domain soon and lock down everything via security and permissions.

[john]

Ours are two lans but really one (confusing hey!) Its two IP ranges, two subnets, they share various servers, but have some independant ones

[dodgydave]

We are intending to combine our 2 Networks this summer using Permissions to lock down the standard stuff and IPSEC for securing the SIMS traffic.

 

We just need to persuade staff that allowing kids to use their logons to print in colour unsupervised is definately not a good idea (its bad enough as it is) and that locking the machine when you step away from it is not just there to annoy you.

Is anyone using Smartcard authentication or anything similar for admin access? we are just bouncing a few ideas around at the moment.

[Guest richard]

We have 2 seperate domains sharing the same ip range. The admin doamin used to use a trust to connect to the curriculum domain to allow it access internet, exchange server and various shares but since we migrated the curriulum domain to Windows 2003 (the admin domain is Windows 2000) I have had some many problems that I am seriously considering merging the 2 doimans into one.

[tosca925]

We used tohave them seperate but around 2 years ago we joined them to one.

 

Not had any issues at all.

[broc]

We have one network for both admin & curriculum. We use group policy to prevent students logging onto staff laptops & vice-versa. (Stops teachers 'borrowing' laptops from curriculum). Single file server with seperate 'staff' and 'student' drives in same RAID5 array, dedicated SIMS server, print server, proxy etc.

 

We do have issues with staff leaving machines logged on, unlocked although staff have been told many many times. (You can tell a teacher, but not much!) This was true before we joined admin & curriculum.

 

I reckon the biggest threat to our network is lax attitude from staff towards security. I have documented the threat to SMT and staff have been warned by SMT it is a disciplinary matter if security is breached because of them.

 

Brian

[webman]

If you bring the Data Protection Act into the warnings about security aimed at SMT they may listen

[pete]

We have two separate domains, though physically joined at the network level. This is unlikely to change in the near future for the reasons broc mentions - teachers do not ensure they are logged of.

 

Both SMT and I are unwilling to implement anything that makes it easier for them to compromise our network.

[GrumbleDook]

Use GPOs to force a 5 minute screensaver that is password protected.

 

And then force a logout after 30 mins of inactivity.

 

We don't do that here because we have them trained ... takes a heck of a lot of work, but worth it in the long run.

[pete]

Use GPOs to force a 5 minute screensaver that is password protected.

 

my users are obviously more rubbish than yours:

 

"I can't remember my password"

"The computer's locked me out" (screensaver password)

"I went to help [kid in class] for x mins and when I got back to [computer running the interactive whiteboard] it was locked - can you help me?"

"I've deleted $swathe_of_shared_area 6 months ago, can you restore it?"

 

I'll be keeping both my domains for the moment TYVM, the worst that can happen is they'll total their curriculum drives.

 

obRant: $Teacher needs training so they can do $thing_which_they_can't_do (and which they _need_ to do to keep their _job_) but doesn't want to do training because "$teacher_union & $labour_gov says we don't have to." FFS.

 

Herding cats is easy by comparison.

[Face-Man]

We have had two seperate physical networks and then 2 Vlans and this summer we are moving to a forest arrangement with seperate Vlans and IP adresses so that we ge t the best of both worlds shared files and resources and limited computer access to data.

[woody]

We merged our networks last summer and I must admit, it has cut down on a lot of duplicated work. But I agree that the threat of teachers leaving their laptops on, or even blatently allowing pupils to use their account is high. However, all our staff need to access SIMS Lesson monitor and so need to be connected to the admin server. Whether we merged the networks or not, sims would have been accessible in the classroom, and the possibility of a breach in security due to teachers was the same.

[broc]

I wondered about imposing automatic screen savers too but I thought it would play havoc with their interactive whiteboards! It's bad enough if power management kicks in and turns the display off because they forgot to switch on mains adapter/plug in mains adapter etc.

 

We merged the networks like Woody says mainly because of Lesson Monitor. We had to set up a network share to SIMS and trusts between the two networks and it caused no end of trouble, especially with the SMT who half the time were on the Curriculum network and half the time were on Admin and never knew where their data was or which password to use or which domain to log on to.

[acb_]

Re: locking screensavers

 

We have just introduced these - a short delay for admin machines, a lesson plus a little bit delay for whiteboard machines. Too early for feedback yet...

[pmassingham]

We are currently on a single NT4 domain. When we upgrade to Win 2003 and XP we will still use a single domain with OUs to 'separate' curriculum and admin.