Install Zoom for all users?

[kennysarmy]

I've just had to rush to setup Zoom on a PC for a member of staff who is in.

 

They've ended up using it via the browser (Chrome) as I can't see how to allow non-admins the ability to install.

 

I've installed it when I'm logged in but it's put it in APPDATA (?)

 

Am I doing something wrong?

 

Is there an MSI I can deploy out to teacher PC's?

[Roberto]

We've deployed it via SCCM/MSI here. Have you seen https://support.zoom.us/hc/en-us/articles/201362163-Mass-Installation-and-Configuration-for-Windows

 

You can also do a lot to manage logins, etc. e.g. input your domains so that all accounts can be managed, integrate with Okta or Azure SSO/MFA, etc and then set policies as an admin for all users.

Edited May 19, 2020 by Roberto

[synaesthesia]

*facepalms*

After all that, and people are still using on mass in schools? Has there been clarity provided on security since the issues please?

[Roberto]

*facepalms*

After all that, and people are still using on mass in schools? Has there been clarity provided on security since the issues please?

 

I don't work in education any more but my current industry segment is *very* highly regulated and we're using it cautiously with a very limited scope and a lot of control of settings. Having had a long talk with Zoom and a look at the current product, I think its fair to say they were not taking security as seriously as they could, but are doing much better now.

 

There's a good resource provided by the Indian Govt. IT department referenced in the register article at https://www.theregister.co.uk/2020/04/17/india_government_zoom_ban/ which is aimed at individual users who have to use Zoom rather than at admins, but adapting the referenced settings and some others to a managed domain environment will greatly improve matters. For example, you can ensure that all meetings made by accounts in your domain are logged and visible in an admin dashboard; disable recording of meetings altogether or at least control who can record what; secure accounts via SSO (I already mentioned this) which should help with account sharing; lock down file sharing, chat, etc.

 

Sadly I can't just share my templates on how to adapt and extend them but it is doable. I may be able to blog about this in a month or two which I appreciate doesn't help much today, sorry.

[kennysarmy]

So are school's creating the Zoom accounts for their staff?

 

I'm uncomfortable letting staff use their own personal accounts for business Zoom meetings.

[Roberto]

So are school's creating the Zoom accounts for their staff?

 

I'm uncomfortable letting staff use their own personal accounts for business Zoom meetings.

 

Not my place any more to say what schools are doing obviously but I'd be very uncomfortable with that, when you consider that by default, Zoom allows you to save meetings recordings. I feel like that might be a slight safeguarding issue. Similar concerns in my industry are why we're managing accounts centrally and turning that setting off.

[kennysarmy]

Well after discussions with one of my SMT.

 

Zoom will now only be supported if the call is initiated by someone external to the organisation.

All internal video conference meetings will be done using TEAMS.

[synaesthesia]

This is pretty much where we are - having blocked the use of Zoom immediately after the issues came to light, we've had very little issue or backlash - we've made it clear that if it's for discussion of general things and not specific/PII then fine, on your own back as if it was a personal use but otherwise we have teams for that very purpose. Not saying Teams is absolutely safe, nothing is but because it's licensed/paid for by the school as part of the 365 service we do have some legal comeback if something did go wrong.

[paulkerton]

Well after discussions with one of my SMT.

Zoom will now only be supported if the call is initiated by someone external to the organisation.

 

This is what we do too.

If you have to join a Zoom call, then that's that, but we won't be initiating them ourselves.

[Rob_D]

As long as you sign your domain up as a school https://zoom.us/docs/en-us/school-verification.html and make sure all your staff use their work emails, the K12 Policy is pretty good (https://zoom.us/docs/en-us/childrens-privacy.html) and now the waiting room is on by default Zoom-bombing should be pretty much impossible. Which deals with most of the issues I heard about.

AFAIK, if you buy the Edu licencing then you get an admin console where you can provision users, but this isn't available for the free version and the best way is to get the staff to sign up but make sure they use their work emails and when asked select teaching/school account.

As for installing, we've got it running as a remote app from a network share without any issues.

 

Don't get me wrong, I would rather the school use the Teams that we spent all of Easter setting up. But the head started using Zoom with all the staff and announced to the parents we would be using it (or that we already were) so I didn't really have a choice and the above mitigates most of my concerns. It's just irritating that the IT department got end-run and all my concerns were met with "but all the other schools are using it".

[ITGuyNW]

You can deploy Zoom through PDQ now

 

https://www.pdq.com/blog/deploying-zoom-quick-easy-remote-communication/