VSCODE

[dhicks]

Now hes trying to run coding on some raspberry picodes which wants to launch in a powershell window which is blocked.

 

Do you mean you have VS Code installed on a Windows machine and you want the user to be able to hit a button and have their code compile / deploy to a connected / associated Raspberry Pi? If so, I imagine that's what the Powershell part of things is doing - getting compiled code from the user's workstation to the Raspberry Pi. In which case, as suggested, if you don't want to allow Powershell for users in general you should be able to allow just that specific (signed) script. Sorry, I don't have any details of how to go about that, but it shoudl at least give you something to start Googling for.

 

If the children are using Raspberry Pis, they could also use VS Code directly on the Pi itself.

[hyb80]

Annnnnnnd were back.

 

Yes it does seem that is the point which we fall over. I have relayed the suggestion he tries to compile using Python and see if that gets him any further and will also suggest this workaround.

 

Just for reference its obviously a topic which creates much discussion. I guess it is down to each and every institution on what they see as being appropriate given the ability of their users weighed up against what you want to them to achieve and the inherent security risks.

[mavhc]

With GDPR, the increased risks of ransomware, etc...? I'd say there's far more reason to lock a PC down now than ever before.

 

Lock down the computer, or the data?

 

Anyway, the point of any multiuser OS, NT/OSX/Linux is normal users don't have root. They're supposed to be learning how computers work to live in the modern world. You want to encourage the 1% of students who want to mess about with the command line so they can get rich and fund your pension.

 

Just remind them you're always watching, and anything they do is branded with their username, so it's easy to know who did what.

 

Better a student finds a flaw than to wait until the ransomware people do.

[localzuk]

Lock down the computer, or the data?

 

Same thing. Lock down the data, which you access via computer.

[KK20]

I assume your pupils dont like to run random tasks from the command shell then? Such as triggering updates, scans, anything that will make the PC appear to be malfunctioning so they dont have to do work? "Its not me Miss, its the computer" - especially when 15 of them start to do the same thing half way through a spanish IT lesson.... Ours also found out that you dont need elevated permissions to start compression etc That was fun on the network drives. All of it gets locked down for us.

 

We lock down the data AND the computer. There are exceptions in the ICT labs, those have competent teachers that know more, plus can monitor them closely. These have VSCode, python IDLE etc.

Edited April 30, 2021 by KK20

[localzuk]

I assume your pupils dont like to run random tasks from the command shell then? Such as triggering updates, scans, anything that will make the PC appear to be malfunctioning so they dont have to do work? "Its not me Miss, its the computer" - especially when 15 of them start to do the same thing half way through a spanish IT lesson.... Ours also found out that you dont need elevated permissions to start compression etc That was fun on the network drives. All of it gets locked down for us.

We lock down the data AND the computer. There are exceptions in the ICT labs, those have competent teachers that know more, plus can monitor them closely. These have VSCode, python IDLE etc.

Don't need a command prompt to do any of that tbh. Can run those same commands straight in the windows start menu, or via a Macro in Excel, or via the Run dialog, or via a file shortcut etc...

[KK20]

Don't need a command prompt to do any of that tbh. Can run those same commands straight in the windows start menu, or via a Macro in Excel, or via the Run dialog, or via a file shortcut etc...

 

Not if they are applockered you cant. Macros are meaningless if the core is disabled, VBS, VS or powershell calls dont work if the subsystem is disabled - at least one redeeming feature of windows! Word macros were another source of initial pain, pupils would make their own file browsers in word etc and it was fairly trivial to go browsing and double clicking. Shortcuts are a non starter if you cannot run the destination. It has taken years of cat and mouse unfortunately but we need to lock down the computer and the data. As I said though, there are labs in the school that have different GPOs that allow more leeway, the general booking ICT suites are locked down heavily. 6th Formers have their own assigned laptops, these have a much lighter touch on them but also are individually assigned.

Edited April 30, 2021 by KK20

[mavhc]

I assume your pupils dont like to run random tasks from the command shell then? Such as triggering updates, scans, anything that will make the PC appear to be malfunctioning so they dont have to do work? "Its not me Miss, its the computer" - especially when 15 of them start to do the same thing half way through a spanish IT lesson.... Ours also found out that you dont need elevated permissions to start compression etc That was fun on the network drives. All of it gets locked down for us.

 

We lock down the data AND the computer. There are exceptions in the ICT labs, those have competent teachers that know more, plus can monitor them closely. These have VSCode, python IDLE etc.

 

Disable compression on the server if it slows down the server.

 

Never found updates/scans to slow down the computers though, don't they run at lower priority? Either way the teacher would email you, you'd look into it, explain, and then those pupils would be on the Cry Wolf list and ignored. "Oh your computer is slow? That's ok, just stay in at lunch time to finish your work"

[KK20]

All the things you mention I have done, Im not new to teaching nor admin. It was simply a comment without all the details regarding not leaving powershell and command prompt open and accessible. We dont because of our school dynamics and particular challenges. Lunch "stay behind" would require staff to be on duty to cover such infractions - these are not available and the pupils know it. The labs would also be booked for break/lunch clubs. Taking the pupils out and sending them to disciplinary would work if it was one pupil, however once a trick is learnt then the teacher who is not quite as IT literate as the others will not pick up on "10 PCs running slow when little jimmy tells everyone of a new way to get out of doing the lesson". Low hanging fruit is simply to get IT to fix it. Of course the fundamental issue is education and getting the pupils to sit down, behave and get on with doing what they should be doing.

 

There are always ways around it, such as a software suite that can track all inputs, then look at the logs, find the cuplrits and make examples of them. Or you can have monitoring software with suitable trained IT literate people looking at what the classes are doing in realtime. These are just non exhaustive examples but they all cost money, and money we dont have. We still have two IT suites of 2011 core2duo's running on the network (SSD and 4Gb RAM, but they run office 365 therefore are usable, even these oldies have a 45 second logon time which is good enough). Suitable £3k software per annum is great, but that to me is 20 refurbished i5 PCs.

 

Ideal worlds are a dream for us i'm afraid and we work with what we have.