Can you Help me create a process of steps for setting up pupils to access G Suite :0)

[TwistedHelixis]

Long time user of G suite in the school but only for the staff, who are using 80% of it's features. Most Staff are still using MS Office and saving through File Stream.

 

I am trying to think through the process I will need to complete in order to migrate all the pupils over to G Suite, but need some advice / help.

I have done this thought process a few times in the past but always end up giving up :-(

 

Hopefully by the end of this tread I will have a list of steps I can follow :0)

 

BTW this is for a primary school.

 

So my first few questions are.....

 

Would you recommend moving all pupils (KS1 & KS2) over to G suite or just KS2?

 

Currently the pupils all logon to laptops as the year group. Will they need to be setup with individual laptop logins or can they still use G Suite? Would setting G Suite to always log off between sessions help in the case?

[djm968]

DfE are providing £2000 funding to help you get this set up. Have a chat a few ICT solution providers, they will be able to complete the whole process for you.

 

https://www.stonegroup.co.uk/dfe-scheme-to-provide-free-digital-education-platforms-for-remote-teaching-and-learning/?gclid=CjwKCAjwxLH3BRApEiwAqX9arYnLJSL5ND7P4Y8LR2aSsJ1zUkn-x7FkG0NPmv9j8fUuqTFb0ve_1BoCh6wQAvD_BwE.

[dhicks]

Would you recommend moving all pupils (KS1 & KS2) over to G suite or just KS2?

 

During the current lockdown, we've had all yeargroups (in our case, Nursery up to Year 8) using GSuite from home. Parents, of course, will be doing most of the switching on / logging in bits for KS1, but by the time you get to Year 3 or so some children have got the hang of usernames and passwords. We set individual default passwords for each user at account creation time, similar to those generated by http://www.dinopass.com ("HotStoat43", "BraveIguana37", etc). Pupils (or their parents) can set their own passwords from Year 3, and for lower yeargroups we can give teachers and TAs a printed list of usernames / passwords for those children on site.

 

The above works okay for our school - I know some schools use login barcode cards for younger pupils. Wonde support them, I think, and they seem like a really good idea.

 

If you're doing any sort of bulk operations in GSuite, make sure you have GAM set up and ready to go. We have it set up on a server that we can remote into so we're not limited to running commands from just one workstation. It does take a little bit of setting up as there's several steps to go through to get everything set up and authorised, but it's worth taking the time (set aside a couple of hours) to go through the setup and make sure everything is working properly before you do much else.

 

If you want to use GSuite logins to log in to Windows laptops, you now can, as of a few weeks ago - Google have relased a Windows login component that integrates GSuite logins with Windows. Again, worth setting some time aside to get a test machine set up. I had no problems getting it working on a freshly-images Windows 10 machine, you might want to avoid using a laptop you aren't willing to re-image if needed. Looking at how the component works, it basically creates a local Windows profile for each unique GSuite user that logs in. I suspect, although I haven't tried it yet, you might be able to have it auto-login a Google user if you wanted, which you can't do on a Chromebook - best to try and get people into the habit of using their own unique logins, though, rather than a shared account.

 

You can, of course, reimage laptops with CloudReady - bascially, ChromeOS but installable on older laptops. There's a cost involved if you want to make those domain-managed devices, but it's not hige and the home-use version is free for testing.

[TwistedHelixis]

If you want to use GSuite logins to log in to Windows laptops, you now can, as of a few weeks ago - Google have relased a Windows login component that integrates GSuite logins with Windows.

What what, that sounds great. I'll do some research on this :0)

 

Just need to absorb everything you have typed :0)

 

DfE are providing £2000 funding to help you get this set up

Already applied and had a chat, but they are really constrained in what they can offer. Originally they said they would set Wonde up for us, but I can probably do that myself as its a third party system. I have asked about GAM (nothing back yet) but i am worried they will just go in and do it, and I will still be no wiser, if that makes sense. I might be wrong but think it makes sense for me to do it all the way through so I can fix things later.

[djm968]

I might be wrong but think it makes sense for me to do it all the way through so I can fix things later.

 

No you are not wrong, that makes perfect sense, I just thought I would mention it in case you wasn't aware.

[DGardiner]

What what, that sounds great. I'll do some research on this :0)

 

Just need to absorb everything you have typed :0)

 

 

Already applied and had a chat, but they are really constrained in what they can offer. Originally they said they would set Wonde up for us, but I can probably do that myself as its a third party system. I have asked about GAM (nothing back yet) but i am worried they will just go in and do it, and I will still be no wiser, if that makes sense. I might be wrong but think it makes sense for me to do it all the way through so I can fix things later.

 

careful with wonde... they sold us the world, claimed their SSO thing would work fine for our needs and after payment it came to setup and all the gotchas came out.

 

 

 

the SSO had to be system wide so will affect staff, had trouble using multiple email domains/subdomains

If its just primary i would just get an export from the MIS and use gam/google bulk import to create the accounts as needed then use gam to script the OU's you have laid out into google groups as needed.

[TwistedHelixis]

careful with wonde... they sold us the world, claimed their SSO thing would work fine for our needs and after payment it came to setup and all the gotchas came out.

 

the SSO had to be system wide so will affect staff, had trouble using multiple email domains/subdomains

If its just primary i would just get an export from the MIS and use gam/google bulk import to create the accounts as needed then use gam to script the OU's you have laid out into google groups as needed.

 

I am so glad you have said this. Its what I was thinking, but never having used these its all a bit of a guessing game.

[DGardiner]

I am so glad you have said this. Its what I was thinking, but never having used these its all a bit of a guessing game.

 

GAM is easy to setup, pretty much does itself these days just follow the steps on the wiki.

 

the google bulk import is just a csv, half hour of excelfu and create some OU's in google as you need and press import and examine the report for errors after.

 

we have our kids on a subdomain - the bulk import will Update any matching exsisting accounts so you need to be careful with how you generate the kids email addresses/doesnt match existing accounts.

 

i dont mind sharing my scripts/excel sheets if it helps, its all basic and probably could be done better like but gives you somewhere to start/play from

[TwistedHelixis]

dont mind sharing my scripts/excel sheets if it helps

 

That would be really helpful. I will PM you my email address at the school.

[jmak]

A couple of thoughts (questions rather than answers, but intended to help...)

 

Do you have synchronisation of AD and GSuite accounts for staff. If not, why not? (Not a statement that it's wrong, just might influence other decisions you make.)

 

Have you decided yet whether to issue individual accounts for all or some of the pupils? My view is that you may as well create individual accounts for all of the pupils. Firstly, if you don't do it now, you'll need to at some point as they progress through the school and as you're importing from a spreadsheet, it's a trivial amount of extra work. Secondly, having the accounts doesn't mean they have to be issued to the pupils or used - you could still have year group or class logins if you want. And third, even in reception it's useful for them to have individual accounts for saving work. The workflow for saving stuff so that the teacher can identify who is responsible for which file (navigate to suitable folder, give file a specific name identifying the child) is at least as complicated as logging in. As you know, in GSuite, as soon as they create a document, it's saved and even if they over write or delete work, the teacher use version history to find what was done on any particular day. Fourth, having individual accounts allows parents to be involved and view or complete work at home.

 

The final thing I'd say is that the choice on whether to use individual accounts is a teaching and learning issue, not a technical one. I suggest you present the arguments (and feel free to sell the option you prefer) and make the teachers own it. There will be complaints from at least some that it causes difficulties and you need to try to avoid being blamed when that happens.

 

Apologies for the ridiculously long post!

[TwistedHelixis]

Do you have synchronisation of AD and GSuite accounts for staff. If not, why not?

 

Most of the primary school in our area were setup by the LA like this (loggin in as a year) and still are. A few years ago I took over a few schools but haven't had the need to change that yet. On a side note, almost everything else was needed to be re built but that's another story. admittedly I haven't pushed this as there were far more serious issues on the networks I took over and since then its been a case of everything is now working, breath.

 

One of the questions I was planning to ask at some point was around setting up the pupils in AD, and syncing from another source. But that might be a moot point now, as one of the posts above mentions a new tool from Google for logging into Windows - https://support.google.com/a/answer/9541368?hl=en&ref_topic=9539498

 

I am just setting up a test laptop so I can test this new tool. If it works as expected I will not even need the pupils in active directory, which could be a massive game changer as far as i'm concerned.

 

EDITED

Edited June 19, 2020 by TwistedHelixis

[DGardiner]

back to the original question - KS2 have their own accounts for sure, under that we use managed users on the chromebooks which login without a password - this gives basic access with a list of favourites/etc to the internet but no access to google apps.

[djm968]

What MIS are you using? It might be possible to do a direct link to G suite.

[TwistedHelixis]

What MIS are you using?

SIMS :0)

[djm968]

SIMS :0)

 

Perhaps not then.

[jthompson]

A quick tip on setting up GAM. You can have it installed on more than one machine easily enough by reusing the credentials files that get created in the installation folder, rather than going through the whole setup procedure from scratch for each installation.

[TwistedHelixis]

In case I do need to setup individual pupil accounts in AD, is there an easy way of pulling the pupil data from SIMS, or will I need to do this manually typing in each pupils name?

[jmak]

I used solarwinds free products. Link in this post and powershell scripts that others have used in the same thread:

 

https://www.edugeek.net/showthread.php?p=1699360

 

I took a report from SIMS and manipulated in Excel to create the user names.

[TwistedHelixis]

I used solarwinds free

 

Just setting up a test server to try this out. Cheers :0)

[TwistedHelixis]

Any advice in setting up the pupils OUs, Groups and names in G suite for a part split / mixed class system. This school has only 4 classes and the years are mixed in each class. Each year the pupils are moved to a class based on the past years ability, except for year 6, where everyone in that class (class 4) are the same age.

 

I am not going to setup KS1 in G Suite at this time.

 

I am thinking one of these options

 

OU = Pupils > all pupils in this OU, save me having to move them around next year.

Pupils names = DOB or Year started + firstname+lastname

 

Or

OU = Pupils > Class >

 

Or

OU = Pupils > Year Started > again I don't need to move them each year.

 

Also, If I used GAM would this move the pupils automatically each year based from SIMS?

 

EDITED a few items above

Edited June 23, 2020 by TwistedHelixis

[localzuk]

It all depends on whether you're intending to apply different settings to different classes?

 

For us, we haven't seen any reason to use different rules for different age groups yet, so each school in our Trust is in their own OU, but that's it. No years.

 

However, if we do decide we need to apply settings granularly, we will do the last option - put children in an OU based on their intake year.

[DGardiner]

We use intake year, purely from a cleanup when they leave standpoint - the actual settings applied come from the pupils OU (Whitelist only external mail/etc)

[TwistedHelixis]

@localzuk how have you gone about the pupils naming convention?

[localzuk]

Our pupils are named as Firstname First initial of surname + 3 random digits. Eg. JohnS472.

[jthompson]

I don't know if this helps. You can organise your users in G Suite using OUs and turn on on certain G Suite services using groups.

 

For instance, you could have Google Meet disabled for all of your pupil OUs, but have it enabled for a particular Google Group and populate that group with all of the pupils that need Google Meet, regardless of which OU they're in. This might allow you to organise your pupils into OUs according to their age, for easier management for you, but retain some fine-grained control over which G Suite services are made available to them, without having to move them around between OUs.

 

N.B. you can use a Google Group to turn on an app which is otherwise disabled for a user at their OU, but you can't use a Google Group to turn off an app which is on for them at their OU. https://support.google.com/a/answer/9050643?hl=en