Provide restricted access home use laptops

[Sheridan]

This seems to crop up for me every so often, but this time it looks like I will actually have to get a solution working!

 

We have a Windows network with Smoothwall and a vpn for staff to access at home (using domain joined laptops) - so laptops used at home work the same as in school

 

Now we have to provide several laptops for students - which have to be locked down and also content filtered.

 

Apart from using the vpn there isn't an easy way around this, and we don't want to use limited vpn licenses on students devices so I'm thinking a 3rd party filtering tool (like Cisco Umbrella, although I believe that's being EOL'l as well)

 

Any recommendations? Its probably for less than 10 students in total

[tom_newton]

Put our filter agent on the laptops? Free and easy!

[Sheridan]

Put our filter agent on the laptops? Free and easy!

 

How does that work though, isn’t it just a chrome based plugin that can be removed? I’m trying to provide a laptop that is locked down (perhaps through intune is an option) but also has full categorised filtering

 

I did look at the smoothwall agent but it didn’t seem to be much more than a chrome only thing?

 

If you’ve any updated info I’d be interested in using our smoothwall

[DavR]

If they're student devices, I would go Chromebook, unless you've got any specific reasons to stick with Windows? Then you're running a locked down ecosystem, the device can be locked down to school accounts only, and you can also enforce an extension-based web filtering / monitoring solution.

 

You'll need to agree with management how much filtering and monitoring goes on, as it's going to be outside of school and in the child's home.

[Joeloman]

Of course, you must have an MDM solution, so that students cannot access the activity manager, etc.

The client currently works in both Edge and Chrome.

 

Very good instructions how to distribute the client via Intune.

https://kb.smoothwall.com/hc/en-us/sections/14416649318300-Windows

 

Smoothwall is developing a new client that will also handle web traffic that does not come from a browser.

As many apps today sometimes have their own built-in software.

However, that filter will only be a DNS filter, so of course you should not approve all programs to be installed on the students' computers.

 

Here you will find more information on how to set up the students' PCs using the School PCs app and Intune.

https://learn.microsoft.com/en-us/education/windows/suspcs/

 

https://learn.microsoft.com/en-us/mem/intune/configuration/device-restrictions-windows-10

Edited December 6, 2024 by Joeloman

[itskdog]

During lockdown when we had to give out laptops to PPG families, I had to quickly put something together with what we had, and found that there's a web filter in Sophos (as we're an LGfL school so get that included in our broadband subscription), so just used local group policy to lock down the machine, and Sophos Web Control to prevent access to any non-educational websites.

 

If you can afford a proper school-designed web filter to install on the device (e.g. LGfL HomeProtect - perhaps your existing filter provider has a similar product), then that's going to be better though with all the reporting capabilities.

[PotNoodleTech]

Save yourself a giant amount of hassle and just deploy 1:1 chromebooks instead. Easily manageable from the google admin console, super configurable/lockdownable and smoothwall agent avaialble to do all the at home filtering.

 

The days of windows devices to take home are long gone IMHO windows is and always has been just total unmanageable garbage as a 1:1 O/S.

[Sheridan]

Save yourself a giant amount of hassle and just deploy 1:1 chromebooks instead. Easily manageable from the google admin console, super configurable/lockdownable and smoothwall agent avaialble to do all the at home filtering.

 

The days of windows devices to take home are long gone IMHO windows is and always has been just total unmanageable garbage as a 1:1 O/S.

 

That's an option I'd quite like, but we'd have to get 365 federation working as well. I've managed exclusively Google domains before but here is all 365 currently!

[Joeloman]

Sweden has had many computers in schools for a long time.

That is, you are very used to handling Windows computers both for students and administrative staff.

Today, it is not strange to lock down a Windows computer so that it works well in a school environment as well as at home as we have 1:1 and it is common for all students from around grades 3-5 to take the computer home.

 

Chromebooks are cheap and also easy to handle.

Chromebooks for the younger ages are often used with a touch screen so that you can use it as a tablet.

 

You link accounts from your Microsoft environment to Google.

 

From around grade 7, you often have access to Office 365 regardless of whether you use Chromebooks or PCs, this is so that the students can properly learn how to handle World and Excel, etc. as most companies use these programs.

 

As for the higher grades, it is almost exclusively PC, this because you often need different software in the education where there are no web applications.

 

It is very common that after three years you take these PCs and convert them into Chromebooks, which works very well.

A good solution for all computers that cannot handle Windows 11, but no problem with Chrome OS.

Edited December 6, 2024 by Joeloman

[jmak]

That's an option I'd quite like, but we'd have to get 365 federation working as well. I've managed exclusively Google domains before but here is all 365 currently!

I ran Chromebooks in a Microsoft school and it worked seamlessly. It was about eight years ago, but from what I read, it's still a similar setup.

 

https://learn.microsoft.com/en-us/entra/identity/saas-apps/google-apps-tutorial

 

Set up as per the link, users will be provisioned with Google accounts with SSO. You can configure the default domain in the Google admin console, so users have the same login credentials for Windows and Chrome OS devices.

 

SSO to O365 Web apps as well and for an added bonus, you get control over YouTube profiles and other Google services so that you could enable some for some users and offer different permissions.

[Sheridan]

So the way I understand it (as I've only ever been in 100% Google or 100% MS schools) is that the federation works by signing in 365 accounts to a Google domain. So all we need is a free Fundamentals domain and some Chromebooks (and the device licenses which are about 40 quid each?)

 

That's definitely my path of choice - even better if Smoothwall can be added to them as well!

[Joeloman]

You can use the same domain you have today for 365.

You just need to verify that you own that domain.

 

Then you create a sync from Entra to Google..

Don't know if this is the right article

https://cloud.google.com/architecture/identity/federating-gcp-with-azure-ad-configuring-provisioning-and-single-sign-on

 

You can turn PCs into Chromebooks.

https://chromeenterprise.google/intl/en_gb/os/chromeosflex/

In Google admin, add the Smoothwall extension according to this KB (Smoothwall Cloud Filter is free)

https://kb.smoothwall.com/hc/en-us/articles/360008478500-Installing-the-Smoothwall-Cloud-Filter-on-Chromebooks-using-Google-Admin

Edited December 10, 2024 by Joeloman

[DavR]

You can use the same domain you have today for 365.

You just need to verify that you own that domain.

 

Sorry to contradict, but everything I've ever heard is that you need to use a separate domain for Google Workspace vs O365.

 

We got round this quite simply by using a subdomain of our main domain for Google Workspace.

 

https://learn.microsoft.com/en-us/answers/questions/1195152/can-i-share-the-same-domain-in-google-sites-and-of

[DavR]

So the way I understand it (as I've only ever been in 100% Google or 100% MS schools) is that the federation works by signing in 365 accounts to a Google domain. So all we need is a free Fundamentals domain and some Chromebooks (and the device licenses which are about 40 quid each?)

 

That's definitely my path of choice - even better if Smoothwall can be added to them as well!

 

Can't comment on the logins, I've not done that with ours yet. But all the rest - yep, sounds right. FYI Chrome device licenses shouldn't set you back more than £30 a piece before VAT.

[Joeloman]

You can have Google and 365 with the same domain, you can also have the emails in both.

https://learn.microsoft.com/en-us/answers/questions/1630335/how-to-use-google-workspace-for-email-and-keep-mic

[tom_newton]

Sorry for late reply - I have been travelling the country talking about online safety. Again. (as we all know, transpennine express is rubbish... just incase anyone had forgotten)

 

If you need help getting off the ground with our on-device filter, give your CSM a shout (if you don't know who that is, drop me an email - [email protected])