FN-GM Posted January 17, 2020 Posted January 17, 2020 Hello, I am doing some research into how schools handle their BYOD for pupils. If you do BYOD I was wondering if you could describe your approach and how well it works please? Thanks
timbo343 Posted January 17, 2020 Posted January 17, 2020 Ours works OK but the only issue is the certificate that needs to be installed by / for the user. Sone really don't understand how to install it. If it wasn't for the cert, it would be seamless. We aren't using 802.1x either, fortunately our ruckus 1200 still looks at AD groups unlike it's new models. We use Smoothwall for the VLANs and the filtering. 1
BKGarry Posted January 17, 2020 Posted January 17, 2020 Good Morning, Our BYOD Network is restricted to just staff and sixth form, Sixth form get a new AUP to reflect this when they start. We have a SSID that is BYOD that is then restricted through RADIUS to only authenticate for those groups in AD, the other groups are basically told no. We then pass the RADIUS accounting details (through our access point configuration) to our web filtering system. This then automatically signs them in for their Internet access at the correct filtering level. The SSID for BYOD connects to it's own VLAN which can access our printer VLANs but not server VLANs, they can access school resources through Remote App/Remote Desktop if they need them, but we have done a big push to Google Classroom, which has solved most of those issues. We have also recently got in PaperCut, which we have installed the Mobility Print part, and they can download the client to print to the Pull Print queues in order to print. 1
caffrey Posted January 17, 2020 Posted January 17, 2020 Pretty much the same as BKGarry I find the certificate situation the worst part, especially when students bring all kinds of odd devices - android being the worst. I think BYOD is becoming untenable and I'm actively attempting to move the school to 1:1 Chromebooks 1
FN-GM Posted January 17, 2020 Author Posted January 17, 2020 (edited) Do you guys have supported devices are students allowed to use anything? How do students submit work? Can staff monitor their screens? What do you do about printing and applications please? Do you do any other “neat tricks” that could enhance T&L please? Edited January 17, 2020 by FN-GM
BKGarry Posted January 17, 2020 Posted January 17, 2020 Application wise, they can download Office through 365 and Adobe CC apps (Adobe is dependent on subject areas taken). Certificate, I have to admit I don't bother with at the moment but I am looking into a way for that later on. Most apps are told to go to the Remote Desktop server. Printing is through PaperCut Mobility print which, after you setup the DNS settings, seems to just work 1
timbo343 Posted January 17, 2020 Posted January 17, 2020 (edited) Do you guys have supported devices are students allowed to use anything? - No specific supported devices. Most use mobiles (the general stuff), we have had mac users which work fine, but mainly are windows users. We do find some of the older android devices don't accept the certificate. How do students submit work? - We don't really use it for this purpose though students can email staff. I would have thought things such as Classroom or MS Notebook via teams would help with this? Can staff monitor their screens? - Nope, unfortunately not. The devices are student / staff owned meaning we cannot monitor their screens. What do you do about printing and applications please? - Printing, we have a BYOD / Web Print system which is part of Papercut that users can upload documents to. It processes them and they can collect at any MFD device. - Applications, users can download Office as part of the School Subscription. - Other apps can be downloaded for free. Do you do any other “neat tricks” that could enhance T&L please? - Not really, it's mainly just for access. Edited January 17, 2020 by timbo343
CHiLL Posted January 17, 2020 Posted January 17, 2020 (edited) Do you guys have supported devices are students allowed to use anything? No, our BYOD is an open network with a captive portal (using RADIUS for AD credentials) and no HTTPS inspection. How do students submit work? They just log on to a school computer to do that, or it's on OneDrive, they can share/email it from their phone. Can staff monitor their screens? No, we don't have control over personal devices. What do you do about printing and applications please? We don't offer any printing support over BYOD. Do you do any other “neat tricks” that could enhance T&L please? No tricks. However you need to be aware that students can install VPN apps on their own devices and completely bypass your school filtering. It's an issue we've been facing for years now. If a student joins the BYOD network, they can just initiate their VPN and have unrestricted access to the Internet (much like if they used their data). VPN apps seem to be able to go through our Smoothwall, bypassing the captive portal and all filtering. Edited January 17, 2020 by CHiLL 1
caffrey Posted January 17, 2020 Posted January 17, 2020 How do students submit work? Google Apps, Drive / Classroom etc. Can staff monitor their screens? No What do you do about printing and applications please? Papercut mobility print failing that they can just log onto a desktop in the LRC, apps are up to the user \ teacher Do you do any other “neat tricks” that could enhance T&L please? None, purely for access. One thing to be mindful of is VPN usage and hotspots to bypass any filtering 1
keyboards Posted January 17, 2020 Posted January 17, 2020 Do you guys have supported devices are students allowed to use anything? Allowed to use anything, but jailbroken devices don't work nor 99% of VPN's How do students submit work? N/A, they can email, google classroom, drive, show my homework etc, the usual stuff Can staff monitor their screens? Nope, defintley wouldn't feel comfortable doing this What do you do about printing and applications please? Papercut moblity print Do you do any other “neat tricks” that could enhance T&L please? Students authenticate first via a password and then via their school g-suite username and password, so every device has a user tied to di 1
thimon Posted January 17, 2020 Posted January 17, 2020 @FN-GM Do you guys have supported devices are students allowed to use anything?Students can bring any device they wish. Support all OS's How do students submit work? Firefly VLE, OneDrive, direct email to staff Can staff monitor their screens? No What do you do about printing and applications please? PaperCut Web Print. Unfortunately Mobility Print doesn't work on our BYOD WiFi Do you do any other “neat tricks” that could enhance T&L please?Please see our student BYOD portal for advice and video help guides - https://sites.google.com/rhsb.gdst.net/rhs-byod-portal/ 1
FN-GM Posted January 20, 2020 Author Posted January 20, 2020 Thanks to all those who replied. Anymore replies will be welcome. Thanks again.
3s-gtech Posted January 20, 2020 Posted January 20, 2020 We use NPS with 802.1x. All students can access it when they accept a web AUP which adds them to a ‘byod allowed’ AD Group (this also shows the instructions for their device). Some faff on Android to connect, very easy on iOS and Windows. Any caught messing, get booted into the byod_banned group! We don’t have any remote monitoring though - they’re on a separate range without any rules between - managed by the LEA. I can still manage their devices at firewall level though, and see dodgy traffic that way.
Primus Posted January 20, 2020 Posted January 20, 2020 Do you guys have supported devices are students allowed to use anything? Allowed to use anything, but jailbroken devices don't work nor 99% of VPN's How do students submit work? N/A, they can email, google classroom, drive, show my homework etc, the usual stuff Can staff monitor their screens? Nope, defintley wouldn't feel comfortable doing this What do you do about printing and applications please? Papercut moblity print Do you do any other “neat tricks” that could enhance T&L please? Students authenticate first via a password and then via their school g-suite username and password, so every device has a user tied to di Out of interest why don't jailbroken devices work - is this something you've made a decision to block and if so how/why? Thanks!
willemgroenewald Posted January 21, 2020 Posted January 21, 2020 @FN-GM Do you guys have supported devices are students allowed to use anything?Students can bring any device they wish. Support all OS's How do students submit work? Firefly VLE, OneDrive, direct email to staff Can staff monitor their screens? No What do you do about printing and applications please? PaperCut Web Print. Unfortunately Mobility Print doesn't work on our BYOD WiFi Do you do any other “neat tricks” that could enhance T&L please?Please see our student BYOD portal for advice and video help guides - https://sites.google.com/rhsb.gdst.net/rhs-byod-portal/ Hey Thimon, Willem here from PaperCut. If DNS or mDNS was an issue on your BYOD WiFi, then you could try the "Known Host" option which doesn't require DNS at all. https://www.papercut.com/support/res...nown-host.html. This option essentially tells the client where the Mobility Print server is at the time of setup. If your BYOD WiFi is completely separated from your network and you don't want to expose any servers to it, then I have good news for you. We are working on bringing cloud printing to Mobility Print, which will be available in a couple of months. There will be no additional cost for it, and you will not have to open inbound network traffic to your Mobility Print server. If you want to get a notification when this is available, you can sign up on the "got notified" form on this page: https://www.papercut.com/products/fr...obility-print/ 1
thimon Posted January 22, 2020 Posted January 22, 2020 @willemgroenewald That's amazing news! I did try Known Host, which unfortunately didn't work, our BYOD network is very locked down, which is good I suppose I have signed up to be notified on your website. Thank you for letting me know.
chris11256 Posted January 22, 2020 Posted January 22, 2020 (edited) Do you guys have supported devices are students allowed to use anything? Any device which supports WPA2-Enterprise can connect. Chromebooks always seem to error the first time, then connect normally. Android devices need some settings, but all other platforms it's just a simple username/password. How do students submit work? All teachers must set homework via Firefly, so students can submit work via that or use OneDrive for their own files. No remote access to their H Drive Can staff monitor their screens? No. Only our domain devices can be monitored via Impero. What do you do about printing and applications please? Papercut Mobility print. BYOD has a seperate DNS server which has mobility print enabled. Do you do any other “neat tricks” that could enhance T&L please? Not really. At my old school we had Air Squirrels reflector, so any device could then be mirrorred on the classroom projector. As a whole the BYOD vlan is islolated. Only has access to the serves that do the authentication, printserver on the specific port for mobility print and the guest DNS server. All other internal traffic is blocked. If anyone needs their BYOD access blocking, I just add them to an AD group which has it's own block all traffic rule on the firewall. Edited January 22, 2020 by chris11256
sonofsanta Posted January 23, 2020 Posted January 23, 2020 We have a separate VLAN set up that's connected to its own port on the Smoothwall. Sixth Form and Staff authenticate through RADIUS (Unifi APs, bouncing to the Smoothwall) using AD credentials. Do you guys have supported devices are students allowed to use anything? Whatever they like. How do students submit work? Email, OneDrive, Teams, HAP+--basically anything they could use to do it from home. Can staff monitor their screens? No, but it's only sixth form, and they only really use devices in frees--as far as I'm aware no teaching staff rely on students having BYOD devices to replace using an IT suite. What do you do about printing and applications please? They can get Office 365 through the EES, other stuff we sometimes recommend they get a trial but no software license I've seen allows for installation on BYOD. We don't allow for printing from BYOD as PCounter doesn't have the capability; we tell them to email it/upload it to their own account then print from a domain machine. Not ideal, but it comes up surprisingly rarely tbh.
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now