G Suite passwords (resets and changing)...

[Koldov]

Very, very new to G Suite (and cloud services in general), but trying to get some things set-up for the computing parts of the curriculum and the set of books purchased by the school suggests a lot of Google apps (Google Sites, Google Earth, Google Slides, Google Hangouts, Google Sheets, Google Forms, Google Docs, Google Hangouts and using storage like Google Drive)...

 

There are various software alternatives given, but I thought it might be best to kill a few birds with one stone!

 

I've purchased a new domain for the school and set up G Suite as far as I can (I am hoping to keep this as internal as possible - limiting email and shared folders in their drives to our domain only).

 

This will be the first time we've done anything like this, with an initial roll-out to over 350 primary students +teachers.

 

There will be more questions I'm sure, but it has struck me that passwords (resets and stopping users changing them) will be a bit of a nightmare.

 

How do you stop students changing their passwords?

 

How do you have any sort of visibility of the content of childrens emails (to prevent cyber bullying etc.)?

 

What control/visiblity do you have of their Google Drive contents, or block/allow only certain file types?

[Ditto]

That's quite a bit to cover. I'd strongly recommend following this Coursera course https://www.coursera.org/specializations/g-suite-administration.

 

Then, try to find one or two teachers willing to do some CPD to achieve Google Certified Educator - Level 1 https://teachercenter.withgoogle.com/certification_level1. You may want to do this yourself, but really this part should be for teachers as it's using the G Suite tools.

 

If you are secondary, there's even a certification for 13+ - https://teachercenter.withgoogle.com/certification_gsuite. If the Computing teachers can bring that in to their curriculum, I would expect quite a bit of expertise would build in-house quickly.

[fiza]

You have Google Vault to see content of emails/drive. https://ediscovery.google.com/

You can set up compliance rules to check for objectionable content in emails and in documents. You can block file types in Google Drive too. Get yourself familiar with the G Suite Admin Console. There is so much in there you can use to lockdown and control user accounts. https://admin.google.com/

Primary Pupils resetting their passwords shouldn't be an issue. You have to click quite a few buttons in "My Account" to get to the reset password option. You can easily change them using the Admin Console if they ever forget.

Edited November 18, 2019 by fiza

[Garacesh]

It's a third-party tool, but I find that it's considerably easier to search for, download and delete files via GAM than with Vault.

Blocking file types is all well and good, but often one man's malice is another's syllabus. Blocking .mp3's so kids can't stock their Drive full of pirated music, no-brainer, right? Wrong! Suddenly they can't store recordings of themselves during a Music lesson, or their spoken presentation in French, etc.

Vault is still the best tool I've found for e-mails though.

Edited November 18, 2019 by Garacesh

[keyboards]

We give certain staff at each school access to reset students passwords etc, so they can do it in two seconds on the fly in lessons, so they don't bother us too much

 

As said above getting a few teachers on board and trained up will be great for you and if they buy-in, even better

 

We stop students creating team drives

 

Like lots of things, introduce it to a sample group or class, get feedback, what's good and what's bad and go from there

 

Tbh if you have time, I would find a school nearby that is a Google school and try to visit it there, see it action, see the admins who have been there and done it

[Koldov]

Thanks all,

 

Seems a bit empty in the vault really.... in fact there's nothing there... not what I was expecting! I have sent a few test emails and added content to Drive...

 

Reports are a bit vague too, the 'Reports Highlights/Apps usage activity' is about 3 days behind (currently showing 16/11/2019)?

 

Can't see the contents of a student's drive, or the body of text in an email even when running an audit log?

 

Haven't found where to block file types on Drive either...

 

Do I need to upgrade to Enterprise Education for these options?

[Ditto]

Thanks all,

 

Seems a bit empty in the vault really.... in fact there's nothing there... not what I was expecting! I have sent a few test emails and added content to Drive...

 

Reports are a bit vague too, the 'Reports Highlights/Apps usage activity' is about 3 days behind (currently showing 16/11/2019)?

 

Can't see the contents of a student's drive, or the body of text in an email even when running an audit log?

 

Haven't found where to block file types on Drive either...

Th email audit log doesn't show contents- I think that's deliberate. Similarly with Drive audits.

Do I need to upgrade to Enterprise Education for these options?

Sounds like Vault is not turned on. In the admin console, search for 'Vault' and you should easily be able to turn it on.

*EDIT* to add a bit more detail

Vault - https://support.google.com/vault/answer/2584132?hl=en

3 days behind seems a lot - Google quote delay times for various tasks - see https://support.google.com/a/answer/7061566?hl=en, but invariably I found they updated much, much quicker

 

Vault will let you see more, but also you can reset a user password and login directly, but to do so would need a good reason plus you'd best speak to your DPO if it's for real. If you were investigating for legal purposes, best not to log in directly to avoid 'contamination'.

You are fine on Education edition, nothing here requires Enterprise.

Edited November 19, 2019 by Ditto

[Garacesh]

Can't see the contents of a student's drive

I genuinely can't recommend GAM enough.

 

gam all users show filelist query "title contains '.mp3' or title contains '.wav' or title contains '.mp4' or title contains '.wma'" todrive id title filesize shared

spits out a report of any file by any user that contains the requested strings, a unique file ID that can be used to download or delete it, the file size, and whether the file is shared or not.

 

gam user get drivefile id targetfolder

lets me download the file in question if I'm unsure whether it's legit or dodgy

 

gam user delete drivefile purge

lets me delete a file from their Drive and Bin so they can't recover it

 

It was a bit of faff to set up, but it's made my life soooo much easier.

 

 

 

or the body of text in an email even when running an audit log?

With Vault, you have create a new 'Matter', then from there go to 'Search'

There should be a drop-down menu for 'Mail'. Then you put in the email addresses, give it dates, and use no terms, and boom there's all the email between X and Y dates.

[keyboards]

I wouldn't worry about blocking file types, when we first had meetings years ago about GFE, that was my first thought, it was a great place to store films, music etc, every school we visited was fine, then including our own, then future schools, I think it was more just how my brain though like ah! They would be a great place to dump all your illegal videos and films on to your google drive but in the real world it doesn't really happen or I haven't encountered it.

[Koldov]

Sounds like Vault is not turned on. In the admin console, search for 'Vault' and you should easily be able to turn it on.

*EDIT* to add a bit more detail

Vault - https://support.google.com/vault/answer/2584132?hl=en

3 days behind seems a lot - Google quote delay times for various tasks - see https://support.google.com/a/answer/7061566?hl=en, but invariably I found they updated much, much quicker

 

I guess I'm still a little unsure about what I'm actually supposed to be seeing! I have it turned on the 'App Settings' for me but turned off for other users. Is that right?

 

I think it's just the 'monitoring/activity' part of the reports page that is lagging behind, any audits I run seem to be up to date so far.

 

 

Vault will let you see more, but also you can reset a user password and login directly, but to do so would need a good reason plus you'd best speak to your DPO if it's for real. If you were investigating for legal purposes, best not to log in directly to avoid 'contamination'.

 

I understand. Well, I am trying to keep all this as 'in-house' as possible... None of it is for 'general use', it will be sold as a tool for learning only, not for personal/private use. At the moment Gmail and Drive is set (I think) to only allow communication/sharing within the domain. I will be totally transparent with the staff and students (even going so far as to write an new AUP specifically for GSuite if I have to) telling them that everything will (or can be) seen by the Admin and SLT if requested. IMHO nothing they do in the name of the school should be thought of as 'private' but it's hard enough trying to get them to understand things like the laptop they use isn't their personal property to do what they like with!

 

I genuinely can't recommend GAM enough.

 

It was a bit of faff to set up, but it's made my life soooo much easier.

 

Maybe something for the future, once I understand what I need.

 

With Vault, you have create a new 'Matter', then from there go to 'Search'.

 

Well, that's intuitive.... Who writes these interfaces? Looks like it needs an overhaul! Reminds me of the old GMail... Really I have always stayed away from GMail and anything related... I guess I still have bad memories from back in the day, when GMail felt like it was a cess pit of virus/malware/spam/toolbars, no better than Yahoo...

 

I wouldn't worry about blocking file types, when we first had meetings years ago about GFE, that was my first thought, it was a great place to store films, music etc, every school we visited was fine, then including our own, then future schools, I think it was more just how my brain though like ah! They would be a great place to dump all your illegal videos and films on to your google drive but in the real world it doesn't really happen or I haven't encountered it.

 

Interesting, yes those are always my first thoughts when it comes to stuff like this. But hopefully, it isn't going to be used as an open/all access dump! For now, it will really only be used for app storage from the work they do in class with the GSuite apps....

Edited November 20, 2019 by Koldov

[Koldov]

Not sure if I should start a new thread, but I have a couple of other concerns as I think that this may have all been for nothing...

 

Firstly, as the Junior age range (Key Stage 2) is from age 7 to 11, I've noticed it appears that there are a few issues with signing up children under 13 to certain apps (can anyone point me to a definitive list from Google)?

 

Also what advice does anyone have for children this age in regards to secure (ish) but memorable passwords (I need 350)...

Edited November 20, 2019 by Koldov

[Ditto]

Not sure if I should start a new thread, but I have a couple of other concerns as I think that this may have all been for nothing...

Firstly, as the Junior age range (Key Stage 2) is from age 7 to 11, I've noticed it appears that there are a few issues with signing up children under 13 to certain apps (can anyone point me to a definitive list from Google)?

Also what advice does anyone have for children this age in regards to secure (ish) but memorable passwords (I need 350)...

A graduated approach to passwords for Primary is a good approach. For example a simple word for Year 1 / 2. Everyone having the same was regarded as acceptable as the data at risk is not sensitive, but as you move up the years you can be more demanding. For the really early years, there is a completely different alternative. See https://clever.com/products/badges. It used to work in UK/Europe, but it was dropped, but having spoken one of there co-founders, launching in the UK is something they are looking at, so get in touch and it might help by showing demand. Wonde have something similar.

With regards age restriction, it's important to remember the 13+ for Google accounts applies to the age for creating your own personal google account. A school created account is different. For additional guidance have a look at https://support.google.com/a/answer/6356509?hl=en. Are there any particular apps you have in mind that concern you?

[Garacesh]

Well, that's intuitive.... Who writes these interfaces? Looks like it needs an overhaul! Reminds me of the old GMail... Really I have always stayed away from GMail and anything related... I guess I still have bad memories from back in the day, when GMail felt like it was a cess pit of virus/malware/spam/toolbars, no better than Yahoo...

 

Matters make sense once you realise they're aimed at SMB+. You create a 'Matter' and give it a title, so it basically says "Everything to do with X issue is in here", such as if Joe Bloggs says he's been sent malicious emails, you'd name the Matter "Joe Bloggs Bullying" then pull his email records to see who sent them and what was sent, and that report/those search settings would be saved in the Matter for future reference.

 

Vault isn't really designed to be used 'just to have a quick peek' or for general administration. It's an auditing tool.