Microbits and encrypted drive policy

[Sheridan]

We have a set of microbits that seemed to get dragged out once every 18 months. So since the last time they were used we've enforced a read only policy on unencrypted usb drives, which is a machine policy

 

Of course, that now makes the microbits read only - I don't really want to switch off the encryption policy but I can't see another way around this.

 

How have you managed to allow microbits without giving full access to USB for students, or maintain your encryption policy?

[chazzy2501]

nope, I think they can also use Bluetooth. I was going to look in that direction.

[RLR]

We have a set of microbits that seemed to get dragged out once every 18 months. So since the last time they were used we've enforced a read only policy on unencrypted usb drives, which is a machine policy

 

Of course, that now makes the microbits read only - I don't really want to switch off the encryption policy but I can't see another way around this.

 

How have you managed to allow microbits without giving full access to USB for students, or maintain your encryption policy?

 

We have 2 bitlocker GPOs. One for teaching machines and one for Admin machines. Admin machines can only use encrypted devices. Teaching machines can only use devices we allow on the allowed list under: Computer Config > Polices > Administrative Templates > System/Device Installation/Device Installation Restrictions > Allow Installation of devices that match any of these device IDs.

 

Add the Microbit Device IDs to this list to allow them. Get the device ID from Device Manager.

[Sheridan]

Isn't the Device ID of a Microbit just a generic usb storage device? I think I've looked at this before.

[RLR]

Isn't the Device ID of a Microbit just a generic usb storage device? I think I've looked at this before.

 

Hmm maybe, not looked into it too much. Don't have one to hand to check either.

[Sheridan]

It looks like these microbits we have don't work with Windows 10 anyway - I've tried 4 on an admin PC (with admin rights and no bitlocker/usb policies) and copying the file over results in Windows Explorer closing and nothing else happens

 

That's on W10 1803 and 1809, maybe these microbits are too old (they've been in a cupboard for about 4-5 years!)

[Boredguy]

For our Microbits, we had to change the USB restrictions in the relevant rooms to be controlled via Impero instead of windows, so the teachers can turn the USB drive access on.

 

Not the best method, but as they only put them into the scheme of work last year we had to find a suitable way to keep them in use.

[Sheridan]

To be honest, the ones I've got here will not work with an unrestricted PC, with an admin user. You can copy and paste the hex file over, then the windows explorer window closes. Thats it, nothing else happens

 

I've tried 5 microbits and its the same on the unrestricted PC as the configured classroom ones, I can't connect using the IOS app and bluethooth either as it won't got past the pattern screen when pairing.

[Katy]

We changed to using the AV for USB Device Control. We use ESET and have a rule that sets all USB media to read only except where the vendor is "MBED" where it's read/write. Doesn't enforce encryption but we've banned USB drives completely so read only is good enough.

[FragglePete]

We too have an enforced USB Encryption policy. To get round this, the Microbits need to be updated to that latest firmware which then enables you to use WebUSB extension within Chrome. The device is then paired within the Block Editor which enables you to write directly to the Microbit plugged in the USB Port.

 

Pete

[mavhc]

Also works with usb serial with Mu https://codewith.mu/en/tutorials/1.0/microbit