Locking down PCs without AD

[rjf99]

I have a set of x10 PCs in an ICT Suite of a school that I am supporting as a favour. At present all staff and students have admin accounts. There is no server or domain and the PCs are running Windows 10 Home. It is the unsafe mess that you would predict.

 

I will be wiping them all and starting with a clean install of Windows 10. The first order of business will be to provide staff and students with no admin access.

 

Are there any other considerations that are practical without a domain / group policy?

 

Separately, but I think somewhat linked...

 

There is no network or shared storage at present. It might be the case that the school are happy for this to continue. The ideal thing for me would be Google Drive, with separate user accounts and Google accounts for all students. Without a domain / Windows Server, it feels like I'm barking up the wrong tree.

 

Is it feasible for them to use generic Google accounts and have access to a Google Shared Drive that allows for file creation but not deletion? I suppose it does run the risk of a user overwriting another user's work by say deleting their essay and saving it. Other than a backup solution, I can't see a way around that. (As I'm typing, I feel like I may avoid kicking the hornets nest here, as there is no perfect solution, and I may just be creating hassle for myself.)

[Ditto]

Do the PCs have internet access? My biggest concern wouldn't be technical, it would be safe-guarding. My advice would be read Keeping Children Safe in Education before you do anything. It's pretty shocking the school leaders/governors have allowed this setup in this day and age. Sorry if that appears unhelpful, but ultimately you will be protecting yourself, but more importantly the children. Safe-guarding children is the single most important thing a school can do.

[Aprice]

Totally agree with the above, this could end up being a sticky situation for all involved.

 

Individual google accounts are one way forward, definitely not 'personal' google accounts, these need to be managed in GSuite / Workspace.

 

Might be worth looking at Chrome OS Flex, turning those windows machines into basically Chromebooks, as you don't have local group policy available with win 10 home.

 

Having said all of this does the school have appropriate web filtering in place? if not the whole thing should just be a no go.

[ThatBoringBloke]

Does the school have any kind of management/O365/Workspace setup?

 

I'd personally look at the paid for Google Workspace (shouldn't cost too much) which would allow Google Authentication on the devices and Management of them.

(You can do authentication with the free Fundamentals version, but not device management)

[Rob_D]

From a wholly technical standpoint, you could get 1 PC set up with all the specific restrictions you want using MMC to edit the local group policies, and then use clonezilla on a USB (or whatever equivalent you like) to copy the image to all the other PCs.

[Frodo_Baggins]

Might be worth speaking to the school and seeing if they are a goole or Office 365 school and where they want to go, as someone else suggested Chrome OS Flex works but involves a small cost and then use the education tier google admin to manage the accounts and devices? (this works really well if they are a google school and gives you more scope for changes and easier to handover in the future)

 

If Office 365 Intune works well but would be a lot more involved and potentially costs, as much as it pains me to recomend if it is a small school then you might be able to setup a machine with restrictions and software and then clone the drive to the other PC's

 

First thing should definitly be filtering though, might be worth speaking to the ISP!

[StevieM]

There is no server or domain and the PCs are running Windows 10 Home.

What about admin computers? Surely there must be a server/domain somewhere in the school.

[MrEprise]

If its anything like some of the Primary schools I've worked in, one of the admin machines will be designated as the "server" and any others will be configured (in a workgroup) to connect to that first admin PC for its resources.

[chaplic]

even 10 machines is too much of a headache to manage manually - dont even contemplate it. And dont home brew something.

 

The school can buy intune and azure ad P1 licenses for peanuts and certainly much less than a professional IT supplier.

[TwistedHelixis]

I would be looking at either Azure or Google Workspace for Education as a way of managing the devices. I look after a few schools and have one that is a Chromebook school, wish the others were the same, as its very easy to manage the Chromebooks.

[rjf99]

Thanks for the great responses so far. To try and draw a few things together...

Completely agree with everything said about safeguarding, and perhaps this didn't come through strongly enough in my first post. I'm confident in my grasp of the legal / ethical requirements. It's with achieving a technical solution to fulfil these with the resources I have available that I'd really value support with.

There is effective filtering in place via the ISP, however an example of software that I found installed on a PC was a VPN.

 

They are a Google Workspace school, with a limited number of Chromebooks. The policies in place on those 95% of the way there, and I have agreed to resolve anything amiss there.

There is absolutely definitely no server, shared storage space, or workgroup. Admin team are 99% of data in cloud applications accessed through a browser. There is some data being stored locally on machines. Obviously there is an issue there, but does also have to come a limit to how much of my time I can offer as a gratuity around my full time employment.

ChromeOS Flex, was at the back of my mind. I have had great experience in the past with that product when it was NeverWear CloudReady, and is something I will investigate. However, the buy in wouldn't be there at the minute, or my availability to offer training. So that might be something to circle back to in the medium term.

 

In the short-term, the machines will almost certainly stay with Windows 10. I am trying to think of the priorities from a technical perspective to safeguard the students and have them running smoothly over time...

 

- Student accounts with no admin privileges

- Prevent Chrome extensions from being installed - I don't know how I can do this without AD?

 

What else can I realistically do? The idea of setting 1 PC up as I wish and then cloning is probably the most likely. If so, what MMC changes should I make?

Edited March 15, 2023 by rjf99

[KK20]

windows 10 home and lack of secpol is a barrier to entry. I would not recommend carrying the can for this. Convert to chromeOS flex or look at paying for kiosk licensing for those 10 machines - you wont need most of 365 as you are a google school - with a view to AAD/Intune policies.

[rjf99]

Thanks all. We are going to trial x5 Chrome Flex OS and x5 Windows 10 (it is actually Pro, rather than Home, I was confusing two different schools together.) The x5 with Windows will have JumpCloud as a trial, and we will go from there.

[jmak]

Will you be getting the management licences for the Flex OS devices as part of the trial?

 

They're well worth having.