Prevent hotspotting on chromebooks in school

[dgsmith]

It's become apparent to me recently that students are starting to increasingly use their chromebooks in school via hotspot in order to circumvent our filtering and prevent being visible when teachers monitor via netsupport tutor. Obviously we cannot restrict the wifi networks in general as some will legitimately need to use a hotspot network when at home, and I suspect some of these instances will be when they have already connected at home and it's remembered. Although our policy is set to auto connect to the school wifi when in range, it doesn't prevent students from simply switching to their store hotspot ssid afterwards.

 

Is there any way we can avoid or handle this, even if there is a policy to prevent switching networks to anything other than school wifi if that is in range?

[ThatBoringBloke]

Not sure if I'm correct on this, but If you delpoy the SSID via the Google Admin console I'm sure that it will always try to default to that network when it is in range.

I might just be making that up though.

 

Alternatively look at filtering on the device itself, depending on who provides your firewall they may have the ability to apply their filtering regardless of the network its attached to. We have Smoothwall and our Cloud Filter does this (can't remember its actualy name).

[localzuk]

I don't think you can lock it to a specific network like that, without blocking other networks entirely.

 

I think @ThatBoringBloke is right - you need to look at a different filtering and monitoring system. We use Classroom Cloud for monitoring, which allows viewing screens regardless of the connection they're on, and Smoothwall Cloud Hybrid which filters via the cloud when off network, or via the appliance when on-network.

[rogerdnixon]

You can restrict to managed wifi if in range - its in the wifi settings in the admin console. We use it and its kills the use of hotspots. You can also just restrict to managed networks if the device lives entirely onsite.

 

If you use the first settings, be mindful of anyone who lives right next the the school and takes their device home.

[PotNoodleTech]

You can restrict to managed wifi if in range - its in the wifi settings in the admin console. We use it and its kills the use of hotspots. You can also just restrict to managed networks if the device lives entirely onsite.

 

If you use the first settings, be mindful of anyone who lives right next the the school and takes their device home.

 

Interesting I think we'll try this!

[tom_newton]

Have you considered using an agent on the chromebook to do the filtering? If you're a smoothwall customer that's a free add on, this may be the case with some other filters

Then you have filtering wherever the chromebook is on whatever network

[dgsmith]

You can restrict to managed wifi if in range - its in the wifi settings in the admin console. We use it and its kills the use of hotspots. You can also just restrict to managed networks if the device lives entirely onsite.

 

If you use the first settings, be mindful of anyone who lives right next the the school and takes their device home.

 

Where about in gsuite is this specifically managed? I can't see a relevant policy setting within the networks config.

 

Have you considered using an agent on the chromebook to do the filtering? If you're a smoothwall customer that's a free add on, this may be the case with some other filters

Then you have filtering wherever the chromebook is on whatever network

 

We don't use sophos, though even if we found a way to push filtering through our site anywhere, it may cause issues at home when parents are responsible for their activity. It also wouldn't deal with the lack of internal visibility on classroom monitor.

[TronXP]

Where about in gsuite is this specifically managed? I can't see a relevant policy setting within the networks config.

 

Goto Devices >> Networks >> General Settings (Chromebook Only) and there is an option for "Wi-Fi Networks" This is probably set at unrestricted.

[PotNoodleTech]

Have you considered using an agent on the chromebook to do the filtering? If you're a smoothwall customer that's a free add on, this may be the case with some other filters

Then you have filtering wherever the chromebook is on whatever network

 

Hi tom we have smoothwall through our LEA and they say they can't filter chromebooks.

 

I'd love to get the agent on my chromebook and ipad fleet - Mind if I shoot you a PM?

 

Thanks

[tom_newton]

Email is probs better - [email protected]

[dgsmith]

Goto Devices >> Networks >> General Settings (Chromebook Only) and there is an option for "Wi-Fi Networks" This is probably set at unrestricted.

 

Found this now and it looks like it could sort most of our issues! I think we'd make a sub-OU with the unrestricted policy in place for anyone who lives on the doorstep of the school, but it does indeed seem to force a managed wireless network when in range and disable the ability to change it. Thanks for the heads up (and to rogerdnixon)!