Students Personal Laptops

[Cmd.exe]

Hi all

 

My school wants to see every student with a laptop in lessons.

They wanted to start a scheme where the parents pay for this, as the school has no money.

The parents have politely declined this, stating (mostly) that their son/daughter already has a laptop at home.

 

SLT’s response to this was to ask me why we can’t allow students to bring their own devices in to school and access the internet (and VLE) through the wireless.

I have explained that it is a terrible idea, etc, etc, but I can only come up with a few technical issues with the concept: I know that I can secure the wireless pretty tight, but my concern is the myriad of empty wall sockets across the school allowing access to my un-VLAN’d flat network.

 

MY question is...

Does anyone here allow students to use their own personal laptops in school?

If so, are there any modifications you make to the laptop or your network?

If you don’t currently do this, but were asked, what would you say?

[jamesreedersmith]

Virus's, hacking attempts, unsuitable content, unlicensed/illegal applications the list goes on for reasons not to allow them.

 

As for locking down the flat network look at the various threads that already exsist about limiting access.

[Dom_]

Do you have ruckus? Sounds like a good arguement to get it, if the guest internet browsing works as advertised (not actually used it here) this would be perfect for what you're after!

 

The kids won't actually be connected to your network, so you don't have to worry about viruses and the like, but they'll be able to use your internet with no interaction from you :-D

 

If I were asked this I'd probably support it. It might also be worth arguing that there will undoubtably be an increased workload from student laptops (virus' etc) so an extra pair of hands or two would be required (or something in writing to say you won't have to fix them!)

[DMcCoy]

Hi all

 

My school wants to see every student with a laptop in lessons.

They wanted to start a scheme where the parents pay for this, as the school has no money.

The parents have politely declined this, stating (mostly) that their son/daughter already has a laptop at home.

 

SLT’s response to this was to ask me why we can’t allow students to bring their own devices in to school and access the internet (and VLE) through the wireless.

I have explained that it is a terrible idea, etc, etc, but I can only come up with a few technical issues with the concept: I know that I can secure the wireless pretty tight, but my concern is the myriad of empty wall sockets across the school allowing access to my un-VLAN’d flat network.

 

MY question is...

Does anyone here allow students to use their own personal laptops in school?

If so, are there any modifications you make to the laptop or your network?

If you don’t currently do this, but were asked, what would you say?

 

6th form can use their own laptops. They have no access to the network sockets (in use or locked out with 802.1x). They are allowed access to a wireless network that has access to an authenticating proxy and nothing else. As the VLE is external they can then access that. Not other network access is provided at the moment. One good thing is that just VLE an internet is the most secure access you could supply reasonably.

 

If your VLE is hosted locally on or using any Windows authentication then additional license costs may be involved if you have licensed products per machine. This can be external connector or CAL licenses for students for any DCs and file servers that may be accessed. If there is no windows interaction then could be no additional costs.

 

Security/AV would also be a major concern. I didn't even consider such access until we had implemented vlans and port authentication. Students must have their laptop power supplies PAT tested first.

[Ric_]

I'm going to assume that you have a Windows-based network...

 

Every time a user authenticates against your servers you need a CAL. You will no doubt have CALs for all your desktops and (under Schools Agreement) this also gives your staff the right to use their personal machines and authenticate against your systems.

 

I doubt that you buy per user CALs for Server, Exchange, etc. so you will need to purchase ECLs (per server) or student CALs which are additive to your Schools Agreement and you are probably going to be talking about £5 per student.

 

The reason I know all this, is because we are about to allow our Sixth Form to do the same. Even basic Internet access for us requires authentication (as does access to the Bluesocket wireless) and that is done against AD - CALs!

[dalsoth]

It's bad enough with staff claiming that their school laptop does not connect to the home wireless because of the technician without students doing the same. Oh and what happens when they say the tech buggered up thier expensive laptop and want a refund? Or you see they have oodles of porn that you can not delete because it is not your machine. Or they have loads hack tools they want to test your new wireless security against etc etc..

 

I support school equipment but not home equipment. I will stretch the rule to help out guests and visitors and a few part time teachers we set up on the guest wireless network but no way for students with thier own laptops. Thats like being pimped out by your own school.

 

Oh i forgot to say also. Staff love coming in with home scanners and home printers. They demand we install them for school use. Then we end up repairing them and having them electrical tested and so on and the user then takes it home afterwards and enjoys a new repaired PAT tested bit of kit at the schools expense.... noooo way.

Edited November 30, 2009 by dalsoth

[Cmd.exe]

Thanks for your responses.

 

It is a windows network and we've got a nice centrally managed Cisco wireless, so i don't think that will be replaced any time soon.

I think a big fat AUP or even a contract will hopefully protect the school from claims by parents and I will look into further securing the unused wall sockets as suggested.

 

I can see the logic with a sixth form - there is that assumption that they are adults (ish) and may even have paid for their machine as opposed to parents. The aim for us would be years 7 to 11!

 

The licencing is interesting. i would hope to avoid interacting with windows servers and just use the VLE. Though internet access might require some thought - might end up needing CALs just to get out to the internet!

[Ric_]

The licencing is interesting. i would hope to avoid interacting with windows servers and just use the VLE. Though internet access might require some thought - might end up needing CALs just to get out to the internet!

 

You will also need some way of restricting wireless use to your students so some kind of authentication will need to be done. Since all your users have a Windows account, this is the obvious thing to authenticate against - hence CALs required - but to avoid CALs you would need some kind of additional directory service.

 

Also check whether your Cisco stuff would need additional licensing - Cisco gear is notorious for requiring licenses for this, that and the other!

[Face-Man]

I would look at getting something like symantec network access control to ensure you don't have an internal DOS or hacking tools brought in Secure Access Control Software | Symantec Network Access Control

 

Also I would check with your Broadband provider if this is allowed I know in London the LGFL doesn't permit user own equipment to be used across it infrastructure and they can connect to the network but not the internet.

 

Also XP home on a network ???

[CyberNerd]

The simple solution is to setup the network properly so that all laptops are segregated as if they were internet clients. You could do this by mac authentication on your switches and vlans. If all they have access to is the various web services then you negate the licensing and the security problems. It also means that the experience that students get from home is exactly the same as they would get in school, web based is the way forward.

[maniac]

Check out BWireless, Wi-Fi hotspot solution, managing a system of hotspots, ideal for schools, colleges and universities, wireless internet access

 

It looks like it does everything you need to allow 'guest' laptops onto your network. The only requiremet is that you can setup Vlans on your wireless network. It provides a simple web based authentication screen which can link to AD as far as I know, and keeps track of whetever users are doing while they're connected.

 

I've spoken to Christian at ITS on many ocassions about this product, but haven't quite persuaded senior management to part with the cash yet!

 

Mike.

[mac_shinobi]

vlan the wifi access points like at star bucks ?

 

but as above ruckus would do what you need and also maybe packet fence and or un tangle ?

 

PacketFence: Home

 

not sure if untangle is what you are after

 

Open Source Network Gateway | Untangle

 

Short of that maybe smooth wall - Tom and Co. can help with this as well.

[Sylv3r]

We allow our students / staff access to our wireless network which is on a seperate VLAN to the rest of the network via a Smoothwall UTM.

 

This way the network is segregated away from the wireless network but also all internet activity is logged per user.

[imiddleton25]

We allow our students / staff access to our wireless network which is on a seperate VLAN to the rest of the network via a Netpilot UTM with strong blacklists and time restrictions ( we are a boarding school).

 

 

all sockets are secured and therefore not useable for student laptops, all internet activity is logged per user/ laptop.

[Face-Man]

I would just present the head with the following possibilities and ask them to think about whether it is a good idea.

 

1) Kid brings in inappropriate material from home into school they view this at back on class.

2) This material is distributed across the network to the other computer with the room.

3) Some smart kid takes a picture with their build in webcam of their "favourite" teacher and uses photo shop adapt the photo

4) The student uses school internet connection anonymously send this to a local newspaper/governor...

 

This is without the issues around playing games, cyberbullying the poor kid with the Apple Mac, compatibility, licensing, virus, hacking etc.

 

Surely the solution is if the parents have already purchased laptops for the students they will need to replace them in two years or so. Get in contact with the e-learning foundation and draw up a plan to be a replacement service for laptops that can be purchased over the next two years at a reduced price. Every kid has the same device, same software and same security. Though make sure they remember to employ somebody to support them.

[gaz350]

I would just present the head with the following possibilities and ask them to think about whether it is a good idea.

 

1) Kid brings in inappropriate material from home into school they view this at back on class.

2) This material is distributed across the network to the other computer with the room.

3) Some smart kid takes a picture with their build in webcam of their "favourite" teacher and uses photo shop adapt the photo

4) The student uses school internet connection anonymously send this to a local newspaper/governor..

 

This sounds like somebody scared of change would say to me, this is something i would expect from teachers! or perhaps this is just down to the wide range of students we all have in our schools some schools need locks on everything others like ours have an open door policy.

 

I wonder if the same discussions were going on when schools gave pencils and paper to students?

 

"oh no little freddy can now draw in greater detail instead of that crappy chalk board!!!

what can we do to stop him from drawing high detailed pictures of his favorite teacher and sending them to the local press." "oh no freddy can pass notes around the classroom about bobbies funny looking teeth"

 

The world is changing, We're a One School Pathfinder due to open next October and the network will be designed in a way to facilitate the use of personal devices. We believe that students should be allowed to use their own equipment(ie provide their own paper), if they can afford it, those that cant will be able to book a netbook on loan from our library. Luckily the majority of our students are in a position to have their own equipment.

 

if a student went round posting up posters of freddies favorite teacher or caught sharing drugs/illegal software in the car park or tripping up a student in the corridor every action that is seen as inappropriate if caught/reported should get the appropriate punishment. Its only teaching the kids how to use these tools will allow them to grow up and hopefully use the technology properly in the future.

[cookie_monster]

This sounds like somebody scared of change would say to me, this is something i would expect from teachers! or perhaps this is just down to the wide range of students we all have in our schools some schools need locks on everything others like ours have an open door policy.

 

I wonder if the same discussions were going on when schools gave pencils and paper to students?

 

"oh no little freddy can now draw in greater detail instead of that crappy chalk board!!!

what can we do to stop him from drawing high detailed pictures of his favorite teacher and sending them to the local press." "oh no freddy can pass notes around the classroom about bobbies funny looking teeth"

 

The world is changing, We're a One School Pathfinder due to open next October and the network will be designed in a way to facilitate the use of personal devices. We believe that students should be allowed to use their own equipment(ie provide their own paper), if they can afford it, those that cant will be able to book a netbook on loan from our library. Luckily the majority of our students are in a position to have their own equipment.

 

if a student went round posting up posters of freddies favorite teacher or caught sharing drugs/illegal software in the car park or tripping up a student in the corridor every action that is seen as inappropriate if caught/reported should get the appropriate punishment. Its only teaching the kids how to use these tools will allow them to grow up and hopefully use the technology properly in the future.

 

 

 

I'd have similar reservations and I'm not resistant to change it just sounds like more of a management headache to me. All of the issue above are valid points in my opinion.

 

Who supports these devices to get them on the system, let me guess suddenly you have to support Mac, Linux, Windows, iphones you name it with NO additional training. What happens if school staff damage an expensive laptop?

 

Software, will you tell every student/parent that they need Office or Works or whatever then staff need to be able to open all of these document formats. This is fair enough if you're going Open Office if you do let me know i'm still looking for a secondary school that exclusively uses OO.

 

Remember just because the world is changing doesn't mean it's for the better.

[maniac]

I would just present the head with the following possibilities and ask them to think about whether it is a good idea.

 

1) Kid brings in inappropriate material from home into school they view this at back on class.

2) This material is distributed across the network to the other computer with the room.

3) Some smart kid takes a picture with their build in webcam of their "favourite" teacher and uses photo shop adapt the photo

4) The student uses school internet connection anonymously send this to a local newspaper/governor...

 

This is without the issues around playing games, cyberbullying the poor kid with the Apple Mac, compatibility, licensing, virus, hacking etc.

 

Surely the solution is if the parents have already purchased laptops for the students they will need to replace them in two years or so. Get in contact with the e-learning foundation and draw up a plan to be a replacement service for laptops that can be purchased over the next two years at a reduced price. Every kid has the same device, same software and same security. Though make sure they remember to employ somebody to support them.

 

I can see your point, but some of these can be addressed.

 

1) This is no different to what students can do with mobile phones now

2) Any guest network will not allow device-to-device communication, only device to internet/firewall etc.

3) Kids have mobile phones with cameras on, and already take photos and videos when they shouldn't Just search youtube for your school name, I bet there's something on there somewhere.

4) If the system is properly setup, anonymous surfing is not going to happen, but what's to stop them doing that sort of thing from home anyway?

 

Playing games, simelar problems to what we have now. Cyberbullying, same issues as we have now. Compatibility, well whatever resources you allow access to will probably be web based anyway which is crossplatform and thus it's a non-issue; it's likely that 90% of devices students bring in would be windows based anyway. Licensing is the responsibility of the end user for the device, and any services offered to it would be licensed appropreately for the userbase, no differently to now. Viruses wouldn't be a big issue, as the devices would only be able to talk to the internet and secured servers, and wouldn't connect in such as way as to be able to transmit viruses easily, i.e no direct file shares etc. Hacking, again secured network no device to device communication, hacking becomes a non issue.

 

The big issues for most schools with students bringing in their own devices will be non-technical ones such as insurance, theft and security, and what to do about students walking to and from school with a potentially expensive laptop on them. There would have to be good guidelines as to what devices were acceptable to be brought in, and procedures written and put in place for how students own devices would be stored and physically managed within the school.

 

While I can see the logic in the school supplying devices, getting enough parents to buy into this sort of scheme to make it worthwhile is difficult in my experience.

 

As for the support questions, the end device remains the responsibility of the end user. If it doesn't work, then they get a school machines to use - plain and simple. The school could offer a technicians service to the parents which could be a chargeable service at a reasonable rate, but I don't see why there's any obligation on the schools part to provide a technicians service to end users devices if they are owned by the individual and not the school.

 

Mike.

Edited November 30, 2009 by maniac

[cookie_monster]

A point that has been bought up here in similar discussions is that we're an inclusive education establishment not exclusive, allot of parents can't afford the uniform (maybe 15%) never mind a laptop, you just can't exclude all of those students and create a two tier school and if we're going down that route why not just bring back grammar schools then we can have laptops there and good tools for a practical education at secondaries. In the current climate I think it will meet allot of resistance also we pay taxes to fund school I wouldn't want to find that I've suddenly got to find hundreds of pounds out to ensure that my child can participate in lessons when they arrive.

[maniac]

A point that has been bought up here in similar discussions is that we're an inclusive education establishment not exclusive, allot of parents can't afford the uniform (maybe 15%) never mind a laptop, you just can't exclude all of those students and create a two tier school and if we're going down that route why not just bring back grammar schools then we can have laptops there and good tools for a practical education at secondaries. In the current climate I think it will meet allot of resistance also we pay taxes to fund school I wouldn't want to find that I've suddenly got to find hundreds of pounds out to ensure that my child can participate in lessons when they arrive.

 

The problem schools will face in the next few years is the current model for ICT resourcing in a lot of schools is not sustainable in anyway, and with school funding potentially taking a hit budgets are going to be tighter than ever. How else can you ensure all your students have got a device to use in school unless you allow them to bring in their own? Most schools just won't be able to fund (long term) a big enough device pool to allow students the sort of access to ICT that the curriculum is likely to demand in the future, so somethings got to give and that something is going to be to allow students, where possible, to bring in and use their own devices. Yes it's a minefield of new problems, but none that can't be overcome, just another chapter in the evolution of ICT in schools.

 

Mike.

[cookie_monster]

The problem schools will face in the next few years is the current model for ICT resourcing in a lot of schools is not sustainable in anyway, and with school funding potentially taking a hit budgets are going to be tighter than ever. How else can you ensure all your students have got a device to use in school unless you allow them to bring in their own? Most schools just won't be able to fund (long term) a big enough device pool to allow students the sort of access to ICT that the curriculum is likely to demand in the future, so somethings got to give and that something is going to be to allow students, where possible, to bring in and use their own devices. Yes it's a minefield of new problems, but none that can't be overcome, just another chapter in the evolution of ICT in schools.

 

Mike.

 

 

There will more likely be an adjustment to the curriculum if it's unsustainable, allot of IT use here is just typing up, equipment will have to be used more effectively.

I don't think the utopian idea of every student having a laptop or other suitable device will materialise in state schools. I'm not even convinced that most subjects require it. I'm ok with it being optional for a student to bring in a laptop (if they can afford it) for taking lesson notes rather than books and pens but it shouldn't be a requirement.

As you just stated these ideas aren't affordable, if the government wants to go down this route then it should be funded by tax increases, that way we can bulk buy on a massive scale to get a better deal, get a better warranty, provide better support and ALL students will be included in the plan.

[tmcd35]

I think the idea of pupils using their own laptops is in essance a good one. That said uptill now my response has been 'over my dead body' whenever the subject has come up. The reason for it is, as others have said, it seems like a management nightmare and at the moment I don't believe I have all the right answers to make it work.

 

I can see how managed access points like Rukus combined with multiple-SSID's and VLANs can give students web access. But what do we do when they need access to their work or printers? As others have pointed out they'd likely be running home editions of Windows. And even if they were not adding them to the domain seems full of potential problems.

 

Do we say that all work must be saved to the VLE? We have no in school local hard drive space for students?

 

I think I saw papercut allows printer over a webpage. But does it require AD athentication for that to work?

 

IF I saw sensible answers to work/printer access AND enough pupils were willing/able to bring in their own device to use THEN it may be worthwhile forgoing a suite upgrade one year and spend the money on managed wireless and new switches instead.

 

EDIT: there is also the question of monitoring what they are doing - playing games, etc. Can't exactly install AB-Tutor on a kids lappy!

[maniac]

I can see how managed access points like Rukus combined with multiple-SSID's and VLANs can give students web access. But what do we do when they need access to their work or printers? As others have pointed out they'd likely be running home editions of Windows. And even if they were not adding them to the domain seems full of potential problems.

 

Do we say that all work must be saved to the VLE? We have no in school local hard drive space for students?

 

I think I saw papercut allows printer over a webpage. But does it require AD athentication for that to work?

 

IF I saw sensible answers to work/printer access AND enough pupils were willing/able to bring in their own device to use THEN it may be worthwhile forgoing a suite upgrade one year and spend the money on managed wireless and new switches instead.

 

EDIT: there is also the question of monitoring what they are doing - playing games, etc. Can't exactly install AB-Tutor on a kids lappy!

 

The answer to that is two fold. Firstly a Terminal services/Citrix type system to allow students to use the schools selection of software using remote desktops or simelar technologies, that way the student device merely becomes a terminal. There is also the option of using services like WebDav to provide access to home folders via a secure interface, and also to allow printing to remote printers via HTTP (it is possible) These are the sorts of services remote office users have been using for years, but there's no reason they can't be used in a LAN environment to provide as much seperation between the servers and end devices as possible.

 

Student monitoring is an issue, but if the school is that worried, they could restrict it so the only interface the student machines could access is a terminal server, so to actually use ICT recources the student has to log into a terminal session which can be monitored.

 

Mike.

[cookie_monster]

This sounds like somebody scared of change would say to me, this is something i would expect from teachers! or perhaps this is just down to the wide range of students we all have in our schools some schools need locks on everything others like ours have an open door policy.

 

I wonder if the same discussions were going on when schools gave pencils and paper to students?

 

"oh no little freddy can now draw in greater detail instead of that crappy chalk board!!!

what can we do to stop him from drawing high detailed pictures of his favorite teacher and sending them to the local press." "oh no freddy can pass notes around the classroom about bobbies funny looking teeth"

 

The world is changing, We're a One School Pathfinder due to open next October and the network will be designed in a way to facilitate the use of personal devices. We believe that students should be allowed to use their own equipment(ie provide their own paper), if they can afford it, those that cant will be able to book a netbook on loan from our library. Luckily the majority of our students are in a position to have their own equipment.

 

if a student went round posting up posters of freddies favorite teacher or caught sharing drugs/illegal software in the car park or tripping up a student in the corridor every action that is seen as inappropriate if caught/reported should get the appropriate punishment. Its only teaching the kids how to use these tools will allow them to grow up and hopefully use the technology properly in the future.

 

 

 

Can I ask how you (or the school) plan on filtering and policing internet access when you have no control over the devices. Until recently we had issues with students bringing in portable TOR programs on USB that would bypass our filters, we have banned these programs now using software restriction policy.

 

We have an ISP Netsweeper filtering service and we run a Smoothwall on site and they we're both completely bypassed by TOR. I tried it and could get anything.

 

Will you just use an acceptable use policy and if they're all bypassing your filters punish them if you catch them or just turn a blind eye if not.

The reason I ask is we had issues with some parents when they discovered that their students could access pornography in school which is why we investigated and found this.

[gaz350]

 

Will you just use an acceptable use policy and if they're all bypassing your filters punish them if you catch them or just turn a blind eye if not.

The reason I ask is we had issues with some parents when they discovered that their students could access pornography in school which is why we investigated and found this.

 

Sorry but whats stopping students bringing in porno mags, cds and memory sticks full of videos, pictures etc? This is where some of my points about each school is different, some schools need locks everywhere. Our kids are generally good and alot of our college beliefs rely on equal value and trust. So why should the 98% of students be punished and their chances of being successful in life being reduced for those 2% of students who are bad?

 

tackling students using college resources to do bad things, is not just an IT problem. we are lucky and are getting a fresh start (we're not BSF). The building is being designed to reduce the opportunities for bullying. knock on effect of this is freddy and billy cant go and find a hiding spot to look at their porno mag. If billy bullies freddy there are polocies in place to punish billy. Bullying only becomes a big problem for the college if they cant prove they have procedures in place and that these procedures haven't been followed (or you have a weak head that cant face up to parent pressure).

 

IMO In the case of porn on the internet on a personal laptop.... same applies it only really becomes a problem for the college (or you if you have a week head) if they cant show they/you have put systems in place that reduce risk to students at an acceptable level.

 

If a student is actively trying to bypass systems put in place this becomes discipline issue and i am pretty sure if they are accessing the content while at school they are accessing the same content at home.

 

Who supports these devices to get them on the system, let me guess suddenly you have to support Mac, Linux, Windows, iphones you name it with NO additional training. What happens if school staff damage an expensive laptop?

 

Software, will you tell every student/parent that they need Office or Works or whatever then staff need to be able to open all of these document formats. This is fair enough if you're going Open Office if you do let me know i'm still looking for a secondary school that exclusively uses OO.

 

Remember just because the world is changing doesn't mean it's for the better.

 

I'll invite you along when we open next year. we already support Mac OS X, XP, Vista and netbooks running Linux, we also support staff iphones. Use of Service level agreements will layout how far we are willing to support personal devices.

 

As for Office formats, all our machines currently have all compat packs and Openoffice. its no different from today and it will be no different tomorrow. You'll always be in a situation where people have different software.