Monitoring Chromebook Usage Out of School

[talksr]

Hi there,

It looks like we may need to loan out quite a few of our Chromebooks to pupils (5 to 6 years old) as thanks to Covid, although the school is open, we are looking at the prospect of closing entire classes due to staff shortages.

 

We have never loaned out Chromebooks, but if the government DfE Windows based ones ones are anything to go by, a neighbouring school had I am quite concerned...one dropped in a fish tank, several with no power adapters returned, smashed screens, totally dead ones which just won't turn on, one with the asset label removed and serial number sticker picked off, several clearly set up for the parents to use for work as well as many set up for older siblings to use who do not even go to the school.

I know these things go on but I am staggered at how these devices are treated outside of school.

 

We currently have one Chromebook per child for our children to use in class and are looking at having to dish these out so they can get on with their work from home.

 

Does anyone know if there are any ways for me to be able to check that the devices are being used for what they should be?

I can see from Google Workspace Admin I can locate a device by its serial number and I can see who last logged in. Is there any further info I can find?

I am just really worried that the devices are not going to be used for their purpose and will come back (if I am even that lucky) with damage, missing cables etc.

 

Any advice would be greatly appreciated.

[tmoon-mint]

I was tasked with exactly this just before Christmas and went for Senso. Would highly recommend it was super straight forward to setup and their support was fantastic. They even gave me a trial key and we will probably be purchasing once this runs out.

 

- - - Updated - - -

 

Senso.cloud | Cloud-Based Remote IT Monitoring and Management

[dhicks]

I am just really worried that the devices are not going to be used for their purpose and will come back (if I am even that lucky) with damage, missing cables etc.

 

Most of the issues you list aren't really things you can control - devices out in the world are going to get damaged sometimes, and you can understand parents / siblings in some households making use of devices if they're available. From experience, some things you can do:

 

- Make it clear to children / parents that devices include power supplies, which you also expect back. We took to photographing each device, complete with power supply and cables (and mice, as some parents requested), just before we handed it to the parent / child in a bag so we had a record of what was supplied. Make sure you have a supply of carrier / tote bags handy, it makes it easier to hand a device over as a complete unit. Most Chromebooks seem to have standardised on 45W USB-C for charging, so maybe find a price for replacements (probably around £20) so you have the figure to hand should you need to tell someone how much a new one will be.

 

- Get senior management to either enforce payment for breakages or assign a budget (maybe 20% of total purchase price?) for repairs. Accidents do happen, it's maybe a bit much to expect every device back in perfect condition, best to have a plan to cover accidents and repairs.

 

- Senso.cloud or similar (we use Securly, I think Smoothwall now have a similar product available too) will allow you to block / filter access to sites at the client-side. As a default, pupils shouldn't be able to get to any adult content, and you can block all social media /games sites easily enough. You could add to your block list any remote-access sites that parents might be using to access their work. It is easy enough to limit managed ChromeOS devices to only allow logins from your own Google domain (it's just a per-OU setting in the Google Admin Console), so people wouldn't be able to log in with other Google accounts. Check with your senior management if they want to do that - it's maybe a little heavy-handed, but you are providing the hardware for a specific child to use.

[paulkerton]

Do you have Chrome Management Licenses for the devices?

[talksr]

Do you have Chrome Management Licenses for the devices?

 

 

Yes, I do. We have 180 of them and all 180 have licences.

[talksr]

Most of the issues you list aren't really things you can control - devices out in the world are going to get damaged sometimes, and you can understand parents / siblings in some households making use of devices if they're available. From experience, some things you can do:

 

- Make it clear to children / parents that devices include power supplies, which you also expect back. We took to photographing each device, complete with power supply and cables (and mice, as some parents requested), just before we handed it to the parent / child in a bag so we had a record of what was supplied. Make sure you have a supply of carrier / tote bags handy, it makes it easier to hand a device over as a complete unit. Most Chromebooks seem to have standardised on 45W USB-C for charging, so maybe find a price for replacements (probably around £20) so you have the figure to hand should you need to tell someone how much a new one will be.

 

- Get senior management to either enforce payment for breakages or assign a budget (maybe 20% of total purchase price?) for repairs. Accidents do happen, it's maybe a bit much to expect every device back in perfect condition, best to have a plan to cover accidents and repairs.

 

- Senso.cloud or similar (we use Securly, I think Smoothwall now have a similar product available too) will allow you to block / filter access to sites at the client-side. As a default, pupils shouldn't be able to get to any adult content, and you can block all social media /games sites easily enough. You could add to your block list any remote-access sites that parents might be using to access their work. It is easy enough to limit managed ChromeOS devices to only allow logins from your own Google domain (it's just a per-OU setting in the Google Admin Console), so people wouldn't be able to log in with other Google accounts. Check with your senior management if they want to do that - it's maybe a little heavy-handed, but you are providing the hardware for a specific child to use.

 

David,

Thanks.

 

Thankfully, I have already done most of what is on your list.

I don't think the office have any tote bags left but I was going to chase this up to day with SMT.

Good suggestion re 20% of total price being assigned in budget to cover against accidents.

 

I totally agree, accidents do happen, however, last year at around this time when there was a lockdown, I was off sick due to an operation. The head ordered a large number of Amazon Fire Tablets for the pupils to use from home.

I think it was around 60 and only ever got 25 or so back, most missing charging leads etc. No agreements were drawn up or signed as that is something I take care of, so many parents just kept them. I was horrified to hear that so many had gone missing in my absence.

 

It took a lot of work and convincing to get these 180 Chromebooks and I just really don't want large numbers to come back trashed or go missing.

The site filtering is something I have looked into, but that won't be implemented in time judging by our current staffing level situation however I built that into the agreement the parents sign which says they must supervise the child the device is assigned to - not another child in the household, as internet filtering will not happen outside of the school.

 

With regards limiting the devices to only allow logins from our Google domain, do you know specifically where that is under Devices>Chrome? I think that would be well worth setting up. I have it set up so that at the moment, it automatically puts in the part after the @ for the username to save the children having to type our long school domain name in which forms part of their username.

[paulkerton]

Yes, I do. We have 180 of them and all 180 have licences.

 

In that case, whatever OU they're in you should be able to limit the domain of the machines to your school ones, so people aren't using it outside of your school accounts (with another school or using their personal Gmail accounts for example)

[mikes]

As others have said, you need to join them to your domain using your management licenses. This will allow you to turn off guest use and people will need an account from your organisation to log in with. They will not be able to sign in with their personal g-mail account.

You can also use this functionality to block certain websites and apps although it is basic. If you already have it set up where the @DomAin part is filled in you are almost there, just have to disable guest mode access.

 

Originally we loaned out 100's of devices with guest mode enabled (as a secondary school). It was found that guest account mode would get around our crude filtering and allow access to the main porno sites that I blocked, so I had to disable it. I had almost 10 complaints from parents/siblings of the pupils because they had been using the device for their own uses too!

 

Again as far as accidents, we actually haven't had that many but we are a comp, a primary school I would imagine would have many more accidents. We had one smashed screen, two or three displaying garbled graphics on the screen (either spilt drink or just bad motherboard, 3 bad units in 500 can be expected), a few missing letters, a few missing chargers but it hasn't really been that bad considering we loaned out 100's of the things.

 

Infact the chromebooks in trolleys to be used solely in classrooms, managed by teachers, have come off a lot worse!!!

 

One other thing, you need special paid software to monitor and block inappropriate content well. We couldn't afford it and so our chromebook users can go on whatever adult site their home broadband allows, apart from the ones I specifically blocked in the Chrome settings in google admin. But the 20 or so porn sites I blocked... I am sure there are many many more. We made this clear in our loan agreement the parents bear responsibility for any content the users visit. We didn't even have a good way to check Internet history other than logging in as that user and checking it that way..]

But times have changed and every comp pupil knows that school devices are monitored, so I've seen very few problems with them. They all use their own smartphones for stuff they know they shouldn't be doing...

[talksr]

As others have said, you need to join them to your domain using your management licenses. This will allow you to turn off guest use and people will need an account from your organisation to log in with. They will not be able to sign in with their personal g-mail account.

You can also use this functionality to block certain websites and apps although it is basic. If you already have it set up where the @DomAin part is filled in you are almost there, just have to disable guest mode access.

 

Originally we loaned out 100's of devices with guest mode enabled (as a secondary school). It was found that guest account mode would get around our crude filtering and allow access to the main porno sites that I blocked, so I had to disable it. I had almost 10 complaints from parents/siblings of the pupils because they had been using the device for their own uses too!

 

Again as far as accidents, we actually haven't had that many but we are a comp, a primary school I would imagine would have many more accidents. We had one smashed screen, two or three displaying garbled graphics on the screen (either spilt drink or just bad motherboard, 3 bad units in 500 can be expected), a few missing letters, a few missing chargers but it hasn't really been that bad considering we loaned out 100's of the things.

 

Infact the chromebooks in trolleys to be used solely in classrooms, managed by teachers, have come off a lot worse!!!

 

One other thing, you need special paid software to monitor and block inappropriate content well. We couldn't afford it and so our chromebook users can go on whatever adult site their home broadband allows, apart from the ones I specifically blocked in the Chrome settings in google admin. But the 20 or so porn sites I blocked... I am sure there are many many more. We made this clear in our loan agreement the parents bear responsibility for any content the users visit. We didn't even have a good way to check Internet history other than logging in as that user and checking it that way..]

But times have changed and every comp pupil knows that school devices are monitored, so I've seen very few problems with them. They all use their own smartphones for stuff they know they shouldn't be doing...

 

Thanks for your useful post.

I had not realised, but I must have already restricted them to no guest accounts as the chromebooks will only allow you to put the part before the @ on our domain name so you have to be a user of our domain to access them.

 

Thanks for the info on the blocking of sites. That is a good idea.

I have already added to our loan agreement about parents ensuring they supervise usage at home due to us not having internet filtering once the devices leave the school.

 

Thanks again for your help on this.