Best practices for setting up teacher laptops for home and school use

[Ditto]

I'm starting this thread with the idea of seeking best practices for configuring laptops that are used in school at at home. I guess ideally the laptops will work on the domain when in school exactly the same way as a fixed PC. For home use, I'd want it as secure as possible, but minimising any inconvenience. The scenario I am dealing with is as follows:

 

One school domain

Windows 7 or Windows 10 on PCs/Laptops

SQL Server 2008

We use active directory for authentication

In school, we use RM Broadband and RM Safety net and I believe RM Unify. I'm told we have user based filtering.

RM Integris is the MIS

We have a simple network with a number of shared directories

The school use Foldr to access shared directories off site.

[Griff]

I would recommend you make sure you Bitlocker the laptops if they are going offsite. I would also not allow them local admin so they cannot install any rubbish on it. The issue here might come if they want to use their own printer for this I will temporarily give them local admin then revoke it the next day when the install has been done. They will be able to use the same domain login even if they are offsite using cached credentials I think this setting is on by default.

[TwistedHelixis]

Just set them up for the domain, when they take the laptops home they will still be able to login with the domain acc as it is cached.

[Rochdale_Cowboy]

How would you ensure that work is synced to a mapped home drive on a file server in school?

[LeMarchand]

Ours are all domain joined. The staff have to log in for the first time in school and then they're good to go at home. Proxy set by LEA-hosted pac which they can't get to at home, so it defaults to direct. All laptops Bitlockered (needs ENT on 7 IIRC). They don't currently have access to school folders or MIS at home (though I believe this is doable) and don't use RM so not sure what those are.

[browolf]

How would you ensure that work is synced to a mapped home drive on a file server in school?

 

 

You can make network shares "available offline". It's an option when you right click on the mapped drive. windows handled the synchronization.

[Rochdale_Cowboy]

Many thanks for a speedy reply

[fredbayker]

Have you looked into always-on vpn or directaccess although that has been deprecated I think.

Other options are some other form of remote access or perhaps offline files (I wouldn’t recommend that though)

[TwistedHelixis]

How would you ensure that work is synced to a mapped home drive on a file server in school?

 

You could setup folder sync or Windows Sync Center, its built into Windows, or directaccess which is also built into windows, or install a remote access gateway, or use cloud storage like Google which is what all my primary schools now use.

Edited February 1, 2019 by TwistedHelixis

[Rob_D]

With us it's more the occasional "I have a conference and need a laptop" type thing where they're only out for short periods.

But we bitlocker the laptop and set up a .\localuser account from which they can access our Frog site or remote desktop.

[FishCustard]

Have you looked into always-on vpn or directaccess although that has been deprecated I think.

Other options are some other form of remote access or perhaps offline files (I wouldn’t recommend that though)

 

Always-On VPN is the current solution, DirectAccess has been deprecated. We use Always-On VPN and it's usually a "just works" solution. You get the odd bug but then that's to be expected.

 

The main issue is staff forgetting to connect to their Wi-Fi/plug an Ethernet cable in at home...

[jthompson]

Our network drives are not available to staff offsite, other than through RDS. A bit cumbersome. We've just started deploying Google Drive File Stream, which 'just works' without any proxy settings faff involved. As a result, I now envisage staff beginning to shift their file management from network drives over to Google Drive and Team Drives a lot more.

 

Another element of offsite domain machines that I'm looking to address is Windows updates. Our domain machines are configured to use onsite WSUS, so laptops don't get any updates when offsite. I think there's a way to make WSUS available via an external URL, so that staff machines can still get their updates during holidays, etc.

[LeMarchand]

We've just started deploying Google Drive File Stream, which 'just works' without any proxy settings faff involved. As a result, I now envisage staff beginning to shift their file management from network drives over to Google Drive and Team Drives a lot more.

 

We're trying this at one site, and it seems fine. Obviously one or two users claim it's not working, but short of following them around 24/7 I can't do much to check whether this is true or not. Clue: If I use my phone as a hotspot it works.

[FishCustard]

Clue: If I use my phone as a hotspot it works.

This is the issue I have with a couple of Always-On VPN users - they say "it doesn't work at home", but server logs show no connection attempts and it works first-time every time with my phone.

[jmak]

Our network drives are not available to staff offsite, other than through RDS. A bit cumbersome. We've just started deploying Google Drive File Stream, which 'just works' without any proxy settings faff involved. As a result, I now envisage staff beginning to shift their file management from network drives over to Google Drive and Team Drives a lot more.

 

Another element of offsite domain machines that I'm looking to address is Windows updates. Our domain machines are configured to use onsite WSUS, so laptops don't get any updates when offsite. I think there's a way to make WSUS available via an external URL, so that staff machines can still get their updates during holidays, etc.

The other option is OneDrive/SharePoint online with O365 ideally accessed through files on demand built into recent versions of Windows 10.

 

That's what we have - but FWIW I think Google's solution with team drives works better and integrated better with Windows...

[MD120]

Laptops bitlockered and domain joined with direct access presently. Gives staff the ability to just work anywhere

 

Even knowing DA had been deprecated, I recently introduced to 3 schools who were still using a workgroup / single account method and not usable in school with no connection to shared drives, etc. It's blown their minds! Idea being getting the systems very similar in operation and will look at options going forward, either AO VPN or similar.

 

Have seen some problems which had to overcome such as DA appeared to be setup but wasn't working so a re-build of the server and one user although it showed connected and fine, getting DNS issues so re-imaged the machine and resolved the problem. Have also offered some remote assistance for users through TeamViewer when not able to connect initially

[EddyAllen]

I would recommend you make sure you Bitlocker the laptops if they are going offsite. I would also not allow them local admin so they cannot install any rubbish on it. The issue here might come if they want to use their own printer for this I will temporarily give them local admin then revoke it the next day when the install has been done. They will be able to use the same domain login even if they are offsite using cached credentials I think this setting is on by default.

This GPO will allow users to install printers without local admin rights.

[MikeyPea]

I would recommend that you look at a medium-term strategy to move all software and services into the cloud and find alternatives where this is not possible. In previous guises I have transitioned schools to be entirely cloud-based. This has many, many advantages. No need for expensive on-prem servers, with the need for maintenance and backups. No need to rely upon VPN tech, or other half fangled alternative approaches. No restrictions on what Operating Systems are used, or even device type in many scenarios. If a device fails, or is lost, the data is not lost and at lesser risk and the user can carry on working using an alternative device. I could go on and on...

 

...Actually one more thing, not really any need for a local directory service to manage either.

[mavhc]

Still have to manage a directory somewhere.

 

Do you want your data being accessed on any random device though, on machines with no filtering, who knows what updates, av etc?

 

I'm looking at setting up VPN currently, but can't really find a good guide. Want something free, and device level.

[MikeyPea]

Still have to manage a directory somewhere.

I agree RE directory - but there are plenty of cloud-based options out there and some very nice Single Sign-on (SSo) solutions to compliment. Many will integrate neatly with modern cloud-based Management Information Systems (MIS) as well e.g. Pupil Asset. As for Internet content filtering, this has thankfully evolved to properly facilitate anytime, anywhere and any device CIPA compliant protection - so cloud-based.

[mavhc]

Other problem is every child's password is terrible, at least when it's internal there's only an attack surface of 1 building, not the whole world

 

Sorry Miss, Chinese hackers ate my homework