DfE laptops security measures

[Badaz52]

Hi everyone,

 

We are starting the long process of resetting all of our DfE laptops. I know these laptops use Microsoft Intune and Cisco Umbrella but I wondered what you guys are putting on the devices in place of these software packages and how much it is costing you to do it? we use Office 365 but it is only the A1 version so Intune is out of the question without an additional cost as is Cisco Umbrella.

 

It's just strange that the government has just told schools to reset them but hasn't offered any advice or solutions as to what to put on afterwards not to mention no care about how much it will cost schools to do it. We obtained around 150 laptops from the DfE so it isn't going to be cheap if we have to buy something.

 

Anything free out there?

[hardtailstar]

We are collecting them in and imaging them to be used in school.

[Badaz52]

We are collecting them in and imaging them to be used in school.

 

I was thinking of doing the same but the small storage capacity and the fact that some of them are absolute trash (Geobooks) limits their use somewhat.

[maxrebo]

Hi everyone,

 

We are starting the long process of resetting all of our DfE laptops. I know these laptops use Microsoft Intune and Cisco Umbrella but I wondered what you guys are putting on the devices in place of these software packages and how much it is costing you to do it? we use Office 365 but it is only the A1 version so Intune is out of the question without an additional cost as is Cisco Umbrella.

 

It's just strange that the government has just told schools to reset them but hasn't offered any advice or solutions as to what to put on afterwards not to mention no care about how much it will cost schools to do it. We obtained around 150 laptops from the DfE so it isn't going to be cheap if we have to buy something.

 

Anything free out there?

 

In the same boat!. We currently don`t have anything in place to support these that go home.

Do you know if schools are legally bound to protect these?

[Badaz52]

In the same boat!. We currently don`t have anything in place to support these that go home.

Do you know if schools are legally bound to protect these?

 

I would think they are legally bound, yes unless the parents sign something to say they will enable safeguarding content on their home broadband connections but based on how many we have we'd be looking at £5000 a year to carry on supporting them in this way. As my colleague pointed out to me they were intended to support disadvantaged families during successive lockdowns who might not have access to digital devices and to help them with remote learning. Schools being open and restrictions being lifted at some point during the summer means they have served this purpose. They weren't intended as a long-term thing and I'm inclined to agree.

Edited June 22, 2021 by Badaz52

[DrCheese]

In the same boat!. We currently don`t have anything in place to support these that go home.

Do you know if schools are legally bound to protect these?

 

Yes, you are. I think it's a little unfair of the DFE to drop this on schools in the way they are, eg by just turning off the filtering etc instead of locking out the devices.

 

I didn't go with the DFE option when I choose ours (As we have Intune/smoothwall cloud) & I had to sign off a waver every time I ordered them saying I was taking responsibility for them - The standard DFE schools did not...

[StevieM]

This document on gov.uk details what security measures must be in place if you are sending devices home with pupils. They require anti-virus, content filtering, account protection, app control and device security. While Inture/MDM enrollment is recommended, it isn't expected if you don't already have it in place.

 

Hope this helps.

Edited June 22, 2021 by StevieM
Clarification

[synaesthesia]

Surely that isn't right - none of that documentation is a rulebook and all of it only applies for the circumstances for which they were distributed in the first place?

[ITGuyNW]

This is all a bit of a headache. Our SLT want half to be used in School and half to be available to take home.

[DrCheese]

That's the standard device bit, not the "Restricted" one which OP is referring to

[Badaz52]

This document on gov.uk details what security measures must be in place if you are sending devices home with pupils. They require anti-virus, content filtering, account protection, app control and device security. While Inture/MDM enrollment is recommended, it isn't expected if you don't already have it in place.

 

Hope this helps.

 

Thanks, it is a little contradictory though with regards to MDM because of the cost yet content filtering measures would also cost.

[Badaz52]

That's the standard device bit, not the "Restricted" one which OP is referring to

 

This is true but I suppose the guidance could be carried over after a reset to restricted devices is done because it is a standalone then.

[StevieM]

Surely that isn't right - none of that documentation is a rulebook and all of it only applies for the circumstances for which they were distributed in the first place?

It may not be a rulebook, but it is guidance from the DfE. In lieu of any further guidance, I would expect it still to apply.

That's the standard device bit, not the "Restricted" one which OP is referring to

This guidance is written with reference to Standard Windows devices provided through the Get help with technology programme. It also applies to DfE Restricted laptops and tablets you have reset, and any new or refurbished devices a school or college has received through donations.

 

EDIT: My emphasis

Edited June 22, 2021 by StevieM

[atcoates]

We haven't got the resources or systems to do a perfect job with these. We've added our cloud AV to the laptops, created a standard account and used the inbuilt filtering from the AV to restrict as much as possible.

[ITGuyNW]

DFE have sent another email out asking for numbers. 0 DFE. 0.

[Sylv3r]

Does anybody know what will happen to these devices if we don't wipe them? Will they continue to work as previous and only the filtering will stop - asking for a friend

[StevieM]

At the moment, that's what we've been told. (I don't have a link to this information offhand; I'll post if I find one.)

 

However, the recent survey that the DfE asked us to complete asks what we would like to happen once the filtering is turned off. I voted for 'All access is removed until the device is returned'.

 

EDIT: Here it is - Guide to resetting Windows laptops and tablets

 

Why devices need to be reset

 

‘DfE Restricted’ Windows devices provided though the Get help with technology programme come with security software that expires on 30 September 2021.

When licenses expire, users will be able to freely access any online content. Devices will not be maintained with future updates including virus scans and software upgrades. It is your responsibility to safeguard the young people in your care.

 

Section 6 of the guide, 'Apply your own settings', directs users to the original guidance for 'Preparing Standard Microsoft Windows laptops and tablets', so my previous assertion is correct...for now!

Edited June 24, 2021 by StevieM

[Mujja]

The students and admins will still be able to logon with local accounts.

 

If DfE delete from their Intune and AAD tenant, I think any applied policies will remain, but users will now be able to modify them.

 

Just make sure you download the BIOS and localadmin passwords before the devices or access is removed from the DfE portal.

Edited June 28, 2021 by Mujja

[ITGuyNW]

Has anyone removed intune from these laptops without resetting them? I've removed the provisioning profile and the intune extension however I'm still getting a DFE content filtering popup when trying to test my Smoothwall one.

[Boredguy]

Has anyone removed intune from these laptops without resetting them? I've removed the provisioning profile and the intune extension however I'm still getting a DFE content filtering popup when trying to test my Smoothwall one.

Any reason for not doing the system restore as per the recommended guide from the DfE?

[ITGuyNW]

I was wanting to test out my filtering solution before sitting the laptop out for an hour while it resets but I've just done that instead now.

[Lightspeed_Liam]

Hi, if you're looking for safeguarding solutions we've worked with many schools who are transitioning from DfE devices that we can get you in touch with. Happy to send over any more information that you'd need or jump on a call so feel free to PM me for more details!

[StevieM]

Having spent some of my summer holidays in school resetting all the DfE laptops, as I knew that I wouldn't have time before the end of September otherwise, I've had an email this morning saying that management and filtering has now been extended to September 2022! The government has also added services that will disable Internet access and/or send a message to inform the pupil to return the device.

 

If I'd known this, I would have left at least some of them as they were. As it stands, we now have no devices to send home with pupils if they are needed.

[Fazza]

Having spent some of my summer holidays in school resetting all the DfE laptops, as I knew that I wouldn't have time before the end of September otherwise, I've had an email this morning saying that management and filtering has now been extended to September 2022! The government has also added services that will disable Internet access and/or send a message to inform the pupil to return the device.

 

If I'd known this, I would have left at least some of them as they were. As it stands, we now have no devices to send home with pupils if they are needed.

 

Same here!

 

We were told by the Government to wipe them as they will stop working, so that's what we have done, they've been wiped! Now they've spent who knows how much money on more licences for software they have previously told us to get rid of by wiping the laptops!!

[hallb15]

@StevieM and @Fazza where did the email come from informing you of the extension? I've not received it, yet.

That does change our plans for what to do with the devices. I've reset a trolley full of the better spec (HP) ones and added them to our domain. The cheaper DELL ones I might leave as they are if the filtering is extended so they can be quickly deployed to pupils as the need arises.