Moving away from non-domain teaching laptops

[icemonkey]

Many years ago (before my time), our school moved to laptops for teaching staff. They were all non-domain machines with teachers having local admin accounts.

Fast forward a number of years, I started and began changing everyone to standard user accounts... but we're still on standalone laptops.

 

Now I'm running the show, I want to explore the different options of managing these laptops as they are quite literally unmanageable. We're a CC4 school so I first thought about using their smart client but I can't say whether we'll remain a CC4 school or not.

We've tried and failed to move to desktops in classrooms and now the current closure is an argument (in their eyes) to keep laptops. Some staff still fail to grasp the idea that "a work laptop is for work use only".

 

 

My questions are:

• Has anyone else done a move like this recently (or ever)?
  
• What are people using to manage mobile devices like this?
  
• Any "If I knew than what I know now" advice?
  

 

We're talking around 100 laptops and where possible, the change to cause minimal disruption to staff. Many of them currently store their entire teaching life on their work laptop.

 

Thanks in advance!

[3s-gtech]

A solution like Always On VPN or Intune sounds like the way to go - giving you management of the devices but letting them roam successfully.

No idea how that integrates with CC4 though!

[mavhc]

Make being a domain laptop better, make sure anyone who has a replacement/new laptop/is a new staff member gets the standard image, in a year that might be 30%. They get all the updated/new software automatically, backups, priority support. Then whenever anyone needs support suggest they should switch to the new system, Mr X switched, he really likes it, etc. Once you're at 60% you've proven it's better and then it should be easy to force everyone else to switch.

 

Main reason they shouldn't have admin is ransomware, backups, security, gdpr etc etc. That's your argument to SLT. Along with time saving for IT support, ie cost saving.

[DalekSec]

No issues with them having laptops if they are setup correctly;

 

On Domain and managed (Intune is a must if it's going to be off the network for prolonged periods of time), Everything in their user area saved to OneDrive (Can redirect the folders)

 

and most importantly NO ADMIN RIGHTS AND BITLOCKERED!!!

 

I've not worked in a school that has desktops instead of laptops, i can see a few plus points to Desktops but Laptops for me will always be better for teaching staff (If setup correctly obviously!)

[djm968]

Join them to the domain, you can set up a new OU for them in AD and block GPOs to keep them away from the claws of RM! and as previously said BitLocker and no admin access. Just quote GDPR compliance if you get any resistance about doing this.

[MatthewL]

Domain joined, AOVPN setup, no reason not to have any issues.

 

We use DirectAccess and its seamless pretty much for users although have found some limitations with DA since lockdown but overcome, be ok on a single site, when were connecting to various routed networks across the area it flags the issues.

[chaplic]

I did this (albeit five years ago) very small school, 5 teachers, 30 laptops all standalone. All devices local admin. Previous incumbents were happy to move a CD from machine to machine to install software!

 

changed config so you have to work very hard to save something on the laptop (c drive hidden) files sync to server. Bitlocker. No local admin rights. Pupil laptops a bit more locked down. Spiceworks doing auditing of machines alongside WSUS for patching and so on

 

what sweetened the pill was we swapped out hard drives for SSDs so everyone got a huge performance boost. Only one TA had grumbles, everyone else seemed quite receptive I think because it was so crap. Also when they saw they could come up with an idea or a request and see it happen across the estate in minutes not months or never.

 

Now I'm moving to non domain machines, well non-AD domain machines but fully part of Azure AD and intune.

 

Heres a link discussing it

https://docs.microsoft.com/en-gb/archive/blogs/uktechnet/modernising-infrastructure-at-a-village-primary-school

Edited April 24, 2020 by chaplic

[mavhc]

SSD at the same time is a great idea. "Can I reconfigure your computer to make it faster?", swap ssd, keep hdd, if they complain, put hdd back in., that'll learn 'em

[notsogenius]

Went through this with a partnering primary school we inherited from a company. All staff had non domain joined devices. Was painful re-configuring them for new users etc.

 

Personally we went the process of replacing their old cronky non-domain joined with a new laptop that was on the network. There have been teething issues - always were going to be but I believe the laptops pretty much meet the need now.

 

What I would check is make sure your wireless network supports radius for authentication, get SLT approval and begin recalling them in small batches. As a previous poster suggested, an upgrade to an SSD would be a perfect excuse. Bitlocker them at this point as a must. Small batches helps as you can check that software that's required is available, ensures any bugs can be ironed out, driver issues can be resolved etc.

 

As for the staff thinking it's their own laptop, ensure there's an SLT backed (if its not SLT backed its worthless) AUP signed when the laptop is reissued.

 

Localadmin or not localadmin is always debatable and i'm not going into that - can of worms!

 

Referencing CC4 we've been able to get pretty much anything to CC4, there's normally some jiggery pockery to get all the drivers imported and tested they're working. Should be a case of adding the network driver in and away you go. RM Support (if you have it) should be able to help you there, or i'm sure someone here can help. It'll make the imaging job pretty easy. Make sure to import all your packages and bobs your uncle.

 

To note, one of the ways we sold this to our staff was quite simply we had a laptop fail with as you've described all a teachers work on there. All stored locally, no backups or anything. Disk had failed. Data recovery quotes weren't cheap either! List all the ways that a domain joined laptop will make their lives better. It was a real hassle at times, but the end result is worth it.