Staff Laptops at home and onsite

[GraySkull]

Our Head wants to move away from Desktops in each classroom/office and go with laptops staff can use at home and in school.

He is adamant this is happening so no point fighting it, just want to give him the best solution I can.

 

How does anyone else manage this?

What do you do for file access?

 

Would anyone be willing to have a call and discuss in ore detail etc

 

I am assuming Intune is the way forward, However, I have never used this before.

[DalekSec]

Been in IT 10 years and only ever had 1-2-1 Laptops for teachers.

 

Modern way of doing it is using Intune / OneDrive / SharePoint to make everything easily accessible at home and on site. Obviously includes additional costs but Microsoft licensing is heavily discounted for Schools

[3s-gtech]

If you're going into this fresh, now, offsite infrastructure via Intune is probably the correct answer. Not something that I've done, but probably the end goal.

 

I did it in 2021 as an evolution rather than revolution. I set up Always On VPN, changed our proxy settings to wpad, and went from there. I was pretty chuffed with the project. It meant having a dedicated AoVPN host, using our existing NPS, and going through a couple of the excellent guides online to make it work.

 

I think your Head is on the right track, personally - it can be a real boost to productivity (with the caveat of working from home being optional still!) Be prepared to help users with their home firewalls (many ISPs like Sky have DNS settings which block VPNs).

[ColonelPanic]

I believe teaching staff having their own laptop is much the norm now, particularly in larger academy trusts.Our school opened 4 years ago with one-to-one staff devices, so at least we didn't have on persuade them.

As for how we do it,

 

• The laptops are hybrid joined to Config Manager and Intune, they pick most of the config up through Group Policy still, and the odd setting in Intune.
  
• The credentials for the laptop are cached (I think for 3 months) or until the device can see our domain controller again.
  
• Each staff member is licensed for M365, we install OneDrive and Office (using shared device licensing) to the laptops.
  
• Any shared drives we put in Microsoft Teams (or Sharepoint)
  

 

The last school I was in (before our trust put me in the new school) used/uses desktop devices in each classroom, and they have the same argument every year with the new starters, about how they are expected to prepare lessons at home without a suitable device. They provide communal PCs for the staff to use in department offices and the staff room, and they're expected to complete all work during school hours.

The only thing stopping us from rolling out staff laptops at this school is the lack of HDMI connectivity in every classroom (the transition from 4:3 VGA projectors and Smart boards to 75" promethean screens hasn't quite been completed yet).

 

If you've any burning questions, feel free to drop a DM, I can also be available to talk on the phone.

[ITGuyNW]

If are still on prem with no intune, you can have a proxy switcher program so it recognises when you're in school and when you're at home and switch between the two.

[CHiLL]

We have very recently transitioned to 1-1 laptops for teaching/classroom staff. We have had quite a lot of push-back and some issues to resolve, but it's mostly working well.

 

For the hardware, we have always been a HP house here. We specifically bought HP ProBook 450 G9 laptops, as they have USB C that supports power delivery and Display Port Alt Mode. We have also bought HP USB-C Essential Dock G5 for every classroom, so one sits on every teacher desk. All the cabling, such as network, projector/TV display, USB for board/TV touch, sound, etc are plugged in the dock, which allows staff just to plug their laptop into the dock by the dock's built-in USB-C cable and it all switches over. We had tried other docks, such as a flat Belkin model, specifically because it had built-in VGA for our projectors, but we had issues with it not allowing the projectors to work at 1080p (despite they very much can and have been over VGA).

 

The most common issues we've experienced with this are:

• Windows sound output set to the wrong device - needs to be set to the USB-C dock
  
• Teams sound output set to the wrong device - As above, sometimes Teams needs to be told specifically to use the dock
  
• Projector resolution issues when using converters to convert the projector cabling from VGA to HDMI/Display Port (Windows will show it as 1024x768 as default (Recommended), but allow it to be manually set to 1920x1080) - This could be resolved by slowly changing the cabling over from VGA to HDMI, though that's a big job and we might just wait for the projector or interactive board to die first, then replace them and the cabling with an interactive TV.
  
• Temporary/One off network dropout as the laptop switches from Wi-Fi to Ethernet via the dock and vice-versa (This could be avoided with a good enough Wi-Fi solution that you no-longer need Ethernet for these devices)
  
• Issues with broadcasting Impero to the student PC's - we currently have an open case with Impero for this
  

 

For the software/management of the laptops remotely, we use SCCM to image and manage devices and deploy an IPsec VPN from our Sophos firewall. When the laptop is connected remotely through the VPN, SCCM works as normal (albeit slower) and we can still deploy apps/updates, etc. We allow cached logons and make the user log on in school first, then the VPN can be configured, so when they get home, they join their Wi-Fi, log in with their cached credentials and the VPN auto-connects when it detects they're not connected to our network.

[EssentialRug]

If are still on prem with no intune, you can have a proxy switcher program so it recognises when you're in school and when you're at home and switch between the two.

 

This sounds interesting...I remember trying to find this solution a good few years ago but to no avail. How do you do this?

[ITGuyNW]

This sounds interesting...I remember trying to find this solution a good few years ago but to no avail. How do you do this?

 

Here you go

 

onyxbox.co.uk/software/downloads/ps.htm

 

Once installed, we have it set to auto and it detects whether you have a proxy available or not and switches between the two.

[LeMarchand]

This sounds interesting...I remember trying to find this solution a good few years ago but to no avail. How do you do this?

 

When we used a proxy we never seemed to need to switch. The laptops seemed to default to "direct" if the proxy wasn't found.

[3s-gtech]

If you use wpad.dat and auto detect proxy settings you don't need anything other than a web hosted file that can be accessed onsite, but can't be accessed offsite.

[SamanthaD]

Though I'm no expert if your file management is all done via SharePoint and One Drive - do you require a VPN?

 

We have a VPN that we use only when we need to access On Prem stuff, but otherwise if we're off site just internet access is sufficient.

[EssentialRug]

Though I'm no expert if your file management is all done via SharePoint and One Drive - do you require a VPN?

 

We have a VPN that we use only when we need to access On Prem stuff, but otherwise if we're off site just internet access is sufficient.

 

I guess there is a case to be made for using a VPN in this scenario about privacy/security. For instance if your users decide to join public WiFi networks (against policy) in the holidays/evenings/weekends...

[msi_school]

The above answers look very useful, personally I would look at getting your data in the cloud and at least removing local storage.

 

On a less technical angle, do you have a plan for, supply teachers, staff forgetting their Laptop, forgetting their charger and new staff wanting a device before the old staff leave? I would also be aware that if any desktops are left in classrooms, this will throw any staff who use the room with a laptop.

[3s-gtech]

If you're going into this fresh, now, offsite infrastructure via Intune is probably the correct answer. Not something that I've done, but probably the end goal.

 

I did it in 2021 as an evolution rather than revolution. I set up Always On VPN, changed our proxy settings to wpad, and went from there. I was pretty chuffed with the project. It meant having a dedicated AoVPN host, using our existing NPS, and going through a couple of the excellent guides online to make it work.

 

I think your Head is on the right track, personally - it can be a real boost to productivity (with the caveat of working from home being optional still!) Be prepared to help users with their home firewalls (many ISPs like Sky have DNS settings which block VPNs).

 

I will add a bit more detail, which I have mentioned in the past.

 

We had staff laptops bought and paid for by our LA. Some schools kicked up a fuss, we embraced it - it meant a major change in workflow but it also meant we got modern machines over our ancient desktops.

 

We put Lenovo hybrid docking stations in every classroom, so any staff could connect with one lead.

 

We bought a few extras for cover teachers to check out/back in.

 

We also maintained our older remote access solution for staff not issued with laptops/as a backup.

[BJG]

We just introduced Entra Private Access to replace the VPN in our organisation and it's looking good so far. Licenced via 365 Business Premium IIRC.

[DrCheese]

I deployed Always On VPN for our staff laptops - Means whist we're tied to SIMS they can still access it from home as if they are inside school without needing remote access.

[MatthewL]

AoVPN setup and use them at home like you do in school, simplest option. Everything is available at home like it is at school over the VPN.

[mullet_man]

Make sure you have OneDrive policies setup, auto folder backup so laptops backup the documents folder, desktop automatically. Makes swapping out the laptop easy as all the files are stored in OneDrive.

 

The one thing with laptops for teachers/staff you'll need to ensure you have a bank of spares for the those who

 

Forget, drop, lose, get stolen, break the laptops.

 

We use USB C docks in all the classrooms, my advice on these is to try and see if you can get ones with replaceable usb cables or use usb c extenders as we over the years have had to replace quite a few broken docks. The ports on the laptops have been fairly solid over the years only had a few go.

[KK20]

We used to use built in SSTP VPN on our regular domain laptops, it was a bit flaky but worked well enough for staff. This was a traditional redirected documents to a server share plus onsite shared drives. We then transitioned to sharepoint libraries for our onsite shared drive folders. Onsite documents transitioned to onedrive. finally, the onsite domain controlled PCs moved to autopilot plus intune (endpoint) with no GPO or onsite AD presence. The last part involved much pain and suffering to set up as it was all done with zero consultation budget (therefore just me), however it now works. This took 3 years from start to finish, each step took one year.

 

We are now looking at moving away from onsite AD completely.

[jthompson]

Mainly using Google for cloud accounts and storage here, so Chrome sync and Google Drive for Desktop FTW.

 

One thing I would add is that if you have on-prem intranet resources, make use of Azure Application Proxy so as to make those available remotely as well (secured behind M365 auth). We have an on-prem intranet site with local DNS set to resolve intranet.schoolname.org to it. Our external DNS then points intranet.schoolname.org to Azure Application Proxy, so that the same URL can be used by staff regardless of where they are. That's handy for a browser home/start page.

[DrBeaker]

Make sure you have OneDrive policies setup, auto folder backup so laptops backup the documents folder, desktop automatically. Makes swapping out the laptop easy as all the files are stored in OneDrive.

 

The one thing with laptops for teachers/staff you'll need to ensure you have a bank of spares for the those who

 

Forget, drop, lose, get stolen, break the laptops.

 

We use USB C docks in all the classrooms, my advice on these is to try and see if you can get ones with replaceable usb cables or use usb c extenders as we over the years have had to replace quite a few broken docks. The ports on the laptops have been fairly solid over the years only had a few go.

 

 

Not to be a hard-ass here. ... but if this decision has been made - why should IT have the responsibility of spares just in case the teacher forgets their laptop at home etc?

 

Spares for failures of a dock, laptop etc are a totally different issue.

 

 

Teachers are professionals, paid a fair amount/decent salary to do that job.

 

What do they do if a student forgets their PE kit, pencil case etc? They get a line / written up / demerits - whatever your school calls it.

 

Why should teachers expect to be treated differently? Otherwise it's setting a bad example for the students.

 

In all the years I've yet to forget my fob, keys, laptop etc, as if I did - I'd be made to go home and get it ... in order to do my job. It's my responsibility to bring them to the workplace, to do my job.

 

Sometimes you just need to draw the line and stop enabling people ... Just my 2 cents

[3s-gtech]

Not to be a hard-ass here. ... but if this decision has been made - why should IT have the responsibility of spares just in case the teacher forgets their laptop at home etc?

 

Spares for failures of a dock, laptop etc are a totally different issue.

 

 

Teachers are professionals, paid a fair amount/decent salary to do that job.

 

What do they do if a student forgets their PE kit, pencil case etc? They get a line / written up / demerits - whatever your school calls it.

 

Why should teachers expect to be treated differently? Otherwise it's setting a bad example for the students.

 

In all the years I've yet to forget my fob, keys, laptop etc, as if I did - I'd be made to go home and get it ... in order to do my job. It's my responsibility to bring them to the workplace, to do my job.

 

Sometimes you just need to draw the line and stop enabling people ... Just my 2 cents

 

I had a teacher leave their laptop at home.

 

Outside, on a wheelie bin, in the rain.

 

For two days.

 

Professionals…yes?

[MatthewL]

Nursing staff are just the same if not worse! The amount of damages we get from clinical staff is unreal really, most of our estate is laptops now rather than desktops.

[jthompson]

Spare laptops FTW. To cover technical issues, yes, but also for stuff getting left at home. Teachers are busy people, so offering judgement-free spares when they need them is an easy win imho.

[LeMarchand]

Why should teachers expect to be treated differently? Otherwise it's setting a bad example for the students.

 

Diplomatic Educator Immunity.