ANOTHER DfE Laptops "How Do You Do ...It?" Thread (Pain/Sadness)

[JRA]

Morning all, story time.

 

So, I would count myself among the least imaginative in my solutions to this previously, but the DfE laptops we were given last year we just left "vanilla" and shipped them out as they came. Our own domestic school-owned laptops though, which we gave out at the start of the pandemic, we put Ubuntu on - figured at the very least the lack of familiarity with it would fox the kids and less exposure to malware might be a good 'un.

 

Lockdown ends last term, we get these laptops back, image every type of them with our own Windows image, wahoo lots of free laptops for our school etc.

 

Now we have ANOTHER lockdown, so I send the tech downstairs to image all our laptops with Ubuntu again. All types, even the DfE ones now have Ubuntu on them and we're due to give them out Monday.

 

Friday night (yesterday) I'm just heading out the door and I test one. There's no drivers for the onboard wireless NIC. Cold panic...

 

I have now bought myself a LONG weekend of *something* whereby I've got to set up these laptops *somehow*

 

Ok so to the point of my thread now that's out of the way:

 

What's the least complicated that folks have sent out to kids in this day and age in terms of laptop?

 

Has anyone literally just done local admin account, Sophos, Office, AUP signed, there you go kiddy?

 

I'm probably going to try and stuff that driver in it in the mean time, but twelve years fiddling with Ubuntu has taught me shoe-horning drivers into it that it doesn't want might work for a week or two, until Ubuntu decides it doesn't work anymore, then I've got 50 kids I'm obstructing the learning of and I'm then obviously an inept, lazy criminal in that piece, but as soon as a couple folks (if there is much of an EduGeek weekend shift ofc!) come along and say there's a precedent for just going super basic and simple as above then I'm leaping on it like I'll leap on the Chinese takeaway that's inevitably coming later...

 

I will appreciate massively any reply, even if it's just a virtual hug.

Edited January 9, 2021 by JRA

[ryanplym]

Hi

 

Sounds like you might be over complicating the process and causing yourself alot more work. In theory, it's a really good setup but don't forget - you also need to consider Web filtering as we are still responsible for this.

 

This is how I have done it:

 

1. Unboxed a brand new vanilla dfe laptop. Removed all the bloatware including the app store. Installed office and setup a local group policy for non admin users (removing access to settings etc) done a bit of housekeeping such as setting up our school logo for the background.

 

2. Created a setup folder on the C drive and dumped sophos av and meraki. Created a batch script which sets the machine name to the serial number of the device and added a few extra lines to install av/meraki and created a shortcut to the batch on the admin desktop

 

3. Created a new non admin user and called it localuser with no password and also prevented them from changing It

 

4. Created a master image using macrium reflect free edition

 

5. Grabbed another dfe laptop, imaged it using the master image (takes around 10-12 mins) then login as admin, double click on the admin batch file and let it run. Once completed, give it a reboot and login as local user, shutdown so when the student powers the device on, it auto logs in

 

I use Sophos central for our Web filtering as it's pretty good at blocking unwanted applications from running/USBs and stop students from playing Web games accessing unwanted content etc.

 

I also use Meraki free edition (not sure if you can still sign up for free) to manage the devices remotely for any tech issues. Sometimes it's easier to remote in rather than talk a student though over the phone although I haven't needed to yet.

 

I hope this helps. It works for us. With a few USB sticks I can usually get though about 10 per hour - 18 with my Technician.

[ryanplym]

Also..virtual hug [emoji847]

Enjoy your Chinese you deserve it!!

[JRA]

Hi

 

Sounds like you might be over complicating the process and causing yourself alot more work. In theory, it's a really good setup but don't forget - you also need to consider Web filtering as we are still responsible for this.

 

This is how I have done it:

 

1. Unboxed a brand new vanilla dfe laptop. Removed all the bloatware including the app store. Installed office and setup a local group policy for non admin users (removing access to settings etc) done a bit of housekeeping such as setting up our school logo for the background.

 

- Got it.

 

2. Created a setup folder on the C drive and dumped sophos av and meraki. Created a batch script which sets the machine name to the serial number of the device and added a few extra lines to install av/meraki and created a shortcut to the batch on the admin desktop

 

- Ok yes I follow that also. Why Meraki? Are you able to somehow manage them when they're offsite with this?

 

3. Created a new non admin user and called it localuser with no password and also prevented them from changing It

- Local policies for that part I'm guessing. That right?

 

4. Created a master image using macrium reflect free edition

 

- Googleing Macrium currently lol!

5. Grabbed another dfe laptop, imaged it using the master image (takes around 10-12 mins) then login as admin, double click on the admin batch file and let it run. Once completed, give it a reboot and login as local user, shutdown so when the student powers the device on, it auto logs in

 

I use Sophos central for our Web filtering as it's pretty good at blocking unwanted applications from running/USBs and stop students from playing Web games accessing unwanted content etc.

 

- Do they have good documentation anywhere on the wizardry above?

I also use Meraki free edition (not sure if you can still sign up for free) to manage the devices remotely for any tech issues. Sometimes it's easier to remote in rather than talk a student though over the phone although I haven't needed to yet.

- I have heard the word "Meraki" but I've never heard of this capability. Was the setup server-side easy enough also? I'll get reading...

 

I hope this helps. It works for us. With a few USB sticks I can usually get though about 10 per hour - 18 with my Technician.

 

Thanks so much. This has spiralled so horribly. Saturday afternoon and I'm just lost at sea still. Monday AM this (whatever "this" will even turn out to be) has to be working adn I have to be able to support it.

[Steve21]

Has anyone literally just done local admin account, Sophos, Office, AUP signed, there you go kiddy?

 

Yep. Especially if they're DfE devices rather than your own.

 

Local account, Teams/365/Chrome/OneDrive etc pre-installed. Set a restore point, more for our laziness of fixing if required

 

Seems to work well for them (at least in terms of the specs for the Geobooks etc) as home devices. As all data is auto sync'd to OneDrive (KFM setup as above), any "i've broken it" just needs a restore and you're done

 

Steve

[JRA]

Yep. Especially if they're DfE devices rather than your own.

 

Local account, Teams/365/Chrome/OneDrive etc pre-installed. Set a restore point, more for our laziness of fixing if required

 

Seems to work well for them (at least in terms of the specs for the Geobooks etc) as home devices. As all data is auto sync'd to OneDrive (KFM setup as above), any "i've broken it" just needs a restore and you're done

 

Steve

 

Thanks for this Steve. Ok, this is good to know. A lot of weight is given here amongst SMT to precedent, so if another school's done %it% then %it% is usually considered ok for us.

 

If it gets then into the small hours of Monday morning and I've just got nothing then that's what I shall do. Image with out image, software on it, over to you kids.

 

I'd imagine it needs to come back in for the sake of KMS or are people MAK-ing these? People who don't have some whizzy VPN situation that I certainly don't I mean...

 

But thank you all so much. Tough times for us all I'm sure.

Edited January 9, 2021 by JRA

[Steve21]

Neither for the DfE devices as they're already registered. We don't wipe them from fresh. If it's our own ones we're given out we've MAK'd them.

 

Steve

[ryanplym]

Sorry for the delay in replying.

 

How are you doing?

 

I did group policy though the admin account (type mmc in run command, add snap in, group policy and you will see two tabs, connect to local computer and users, select users and choose non administrative users.i am doing this from the top of my head so apologies if the wording is a little different.

 

Then go through the policies and ammend as necessary.

 

Yeah I use meraki for remote off site support although I'm not 100% sure it's still free. Although it's optional but handy. Netsupport dna is also good for remote support but isn't free.

 

Sophos Central is really easy. You setup policies based on devices and users (in this case localusers)

 

I will be more than happy to give you a ring if you want me to talk you though it/give you a hand just drop me a PM with your number.

[ryanplym]

For sophis Web filtering the below is a link to the basics - should be a good starting point

 

https://docs.sophos.com/central/Customer/help/en-us/central/Customer/concepts/ConfigureWebControl.html

 

Here's a link to system manager sign up page for meraki. Just went though my old emails. Even if you get a 30 day free trial, it should take you though until the end of the Feb lockdown. Not essential but handy for remote desktop support

https://meraki.cisco.com/form/systems-manager-signup

[MatthewL]

Never knew you could do that for local GPO and targeting users @ryanplym, thanks for that.

[DrCheese]

Ours are all on Intune - We install a vanilla .wim with the drivers installed (HP for the bulk of ours) & run the autopilot registration at OOBE. They then reboot and join our Azure AD, install office/teams/onedrive & volia, the student then just logs into the laptop with their usual school details. Esafety is provided by smoothwall cloud filter.

 

The beauty of it is that we maintain control of the device, so I can push out apps/policies etc without needing a VPN. Plus it means when the users account is locked out when they leave, the laptop needs to be returned to us to be of any use.

[caffrey]

Just throwing in Neverware and securly maybe ?

[JRA]

Thank you all so much.

 

It got late but I go the Ubuntu setup to work in the end.

 

I will come back to this and try to get the Windows side of things more sustainable.

 

Thank you all SO much. That was a horrible weekend.

[ryanplym]

Glad you got it working

 

Hopefully this week won't be too stressful for you.

 

Happy Sunday [emoji2]

[Boredguy]

This time round we ordered unrestricted Windows laptops and just added the Geobooks straight to our domain so they are configured the same as our normal workstations. We have an Always On VPN setup (did that in the summer) so using a Forced Tunnel, all the students connect straight back into to school and get our filtering, Impero can still be used etc. Once we get out of the current lockdown we will recall the original laptops that still have the DfE restricted settings and do the same to them.

[Twearden]

Hi all, new to this job and this website - this thread is great, I'm just working through 60+ laptops that arrived yesterday! Thanks so much, I may post some questions if I get stuck.

 

T

[ryanplym]

Hi all, new to this job and this website - this thread is great, I'm just working through 60+ laptops that arrived yesterday! Thanks so much, I may post some questions if I get stuck.

 

T

Excellent happy to help. Just did another 10 this morning, the pile is slowly decreasing. Good luck [emoji3]