Work Laptops

[oododkodkdo]

Hello all,

 

 

At the moment, the Headteacher wants some staff to be assigned with laptops which they can take home and work from.

 

As they will be outside of the school network, they will still need to authenticate with our Domain Controllers as for some reason, they won’t be using RDS.

 

Is there any way before the OS loads, a screen shows up to connect to our VPN and they type their credentials in then Windows loads up and they will be able to talk to our Servers?

[PyROm]

Microsoft always on VPN machine tunnel, the machine authenticates itself using a certificate, no user interaction required and it does so before login as long as it has an internet connection. You really need windows 1809 or newer to get best results from it though. Alternatively you could allow logging in using cached profile, so they log into the domain once, then their profile is cached on the laptop, allowing them to log into it at home, if doing it this way you would then also need to allow some form of file access for shares (unless using a cloud provider for storage), eg. a vpn, offline files work folders etc. Whatever you do, I would ensure the laptop is encrypted (we use bitlocker) to keep data safe.

 

We currently are switching over to always on vpn machine tunnel, with cached profiles enabled while also using work folders, to allow access to the users home drive while they have no internet. If I did it from a fresh start I would just go for always on VPN though.

[jthompson]

How about setting the laptops to use cached credentials? Provided that staff member has logged in on the laptop successfully on the school network, the laptop will then accept those creds when the DCs aren't available.

[meakjoe]

+1 for Always on VPN with Machine Tunnel. Once set up it works really well and requires no input from the user.

 

Once the Laptop has an internet connection, it knows its not on the internal domain and connects the VPN, allowing them to sign on as if they've never left the site...