How do you handle student owned laptops?

[mctnguy]

Hi everyone! It's great to have found a place for IT guys and gals who work in an educational setting to discuss issues!

 

Here's mine: We allow students to bring their own laptops to the college. Previously we would install a wireless certificate, their printers AND all of their software that they needed, on all of their machines. This proved to be too time consuming and difficult to manage so we are hoping to put the media in their hands and allow them to install as much as they can themselves. I expect we will have to install wireless certs for them as giving them access to do this themselves seems risky.

 

I am wondering if anyone else is doing this at their school and how you handle these students when they arrive on day one?

 

How do they authenticate to the network?

 

How do they get the software they need?

 

How are printers managed?

 

Anything else worth mentioning?

 

Thanks for your input!

[Potato-Peeler]

Like a lot places i believe, if its not bought by the school we won't even look at it. Saves a lot of hassle

[mctnguy]

Yeah we are not so lucky to be able to go back to that model.

[OKCPS_Guru]

Seperate VLAN for all of the "off network" devices. They get internet access (filtered of course) and that is it. They can infect each other, but not our machines.

[DrCheese]

Seperate VLAN for all of the "off network" devices. They get internet access (filtered of course) and that is it. They can infect each other, but not our machines.

 

Yeah, we don't do student laptops here (yet) but if we did, I think this is how I'd do it. If students needed access to our system, they would access our remote access system just as if they were at home (System is SSL explorer that allows access to a terminal server which has all our software installed or ability to download work)

 

I would never allow them direct access to our curriculum network, unless their machines were members of our domain and therefor they would be locked down like any other student PC (would never happen)

 

I think a TS is the best route regarding your software issue, although remember to make sure your licensing covers that.

[soveryapt]

How do they get the software they need?

 

EIK!! Are you sure your licenses will cover you for that? That would be the first thing I'd check as obviously, even if you do have some use at home licenses, what is to stop them not deleting it when they are done at the school.

 

As others have said, I wouldn't allow any non-school devices onto the network unless it's via a separate internet only supply, that or stipulate (and enforce somehow) that they must have a fully working and up to date antivirus software on their machines.

 

In terms of getting the software, if they aren't on the network (as in authenticated to a DC) then you're limited in how you can push out the software and I'm guessing you don't really want to leave full install packages and the licenses just hanging around on a file share somewhere unless locked down to admin only access (i.e. I have one of those for the non-standard software in the school and for serving up the GPO installs, but it's hidden and locked from prying eyes).

 

My own thought would be surely if they're investing in the hardward for their course (i.e. the laptop in the first place) they would be expected to purchase the software too? I know when I did my college courses it was a case of "if you want to make use of the Music Tech Suite go ahead, if you want to make use of your own hardware to do your coursework, then you'll have to provide the software for it" and this was a good few years ago.

 

To sum up, letting them on the network, easy enough if you have the managed system and ability to set up the VLAN for all non college property, then you can just make the WiFi code something easy to remember and change it each term / year to keep a bit of security going, but software, you need to seriously check all your licenses will allow you to do what you're proposing, else it could end up costing.

 

[HarryMonkey]

Software licensing must be a nightmare to document. How do you guarantee they have removed the college's software when they leave?

[soveryapt]

Software licensing must be a nightmare to document. How do you guarantee they have removed the college's software when they leave?

 

I was once asked to do something similar for Student Teachers (which I've now after many discussing decided not to but to supply an old school laptop if they need it) but one way I thought was basically you get them to sign an legally binding contract which in, in legal jargon not my slang here, says:

 

"I have installed the software provided by my college for use only during my time at the college. When I leave I understand that to not remove the software could result in a law suit being brought against me by either the college and/or software vendor"

 

Then explain to them what this means if MS start to chase them and that's you covered?

 

Anyway .. home time for me .. lol ..

[mctnguy]

Software licensing must be a nightmare to document. How do you guarantee they have removed the college's software when they leave?

 

One piece of software is 14 month Student Eval version, MS Office is a one time install key that they can keep, some of it we got permission from the companies.

 

Previous to this year we were using VMWare ACE, which almost everyone hated dealing with.

[maniac]

How do they authenticate to the network?

 

How do they get the software they need?

 

How are printers managed?

 

Anything else worth mentioning?

 

Thanks for your input!

 

If you've got some money to spend on getting this done, get terminal server and a seperate wireless SSID setup which can only see the terminal server and not the rest of your network, they can then connect into this to work on the schools software from. Virtually any device will connect into a terminal server, it's platform independant and is by far the best way of doing it in my opinion, but does cost a bit to get setup properly.

 

Mike.

[featured_spectre]

we use the guest VLAN for any equipment bought in from home, be it ipods, laptops, netbooks, phones etc. guest VLAN is restricted to nursery level filtered internet and emails only.

[enjay]

Seperate VLAN for all of the "off network" devices. They get internet access (filtered of course) and that is it. They can infect each other, but not our machines.

 

Exactly what we offer our Sixth Formers here. They provide the laptop/netbook/iPhone and any software they want to use, all we offer is the service and best endeavours at getting them connected to it. An instruction booklet talks them through how to connect, set up the proxy and so on; after that, they're on their own.

 

Remember it isn't just viruses which we need to be aware of blocking, but all the other lovely hAcKiNg apps out there too.

[Ben_Stanton]

Basically we have two networks. The domain which is pretty much all hardwired cat5. We also have a seperate wireless network purely for dirty dirty laptops. Everything is physically seperate just before it hits the webfilter and ADSL load balancer (we have shocking connectivity as too far from exchange so have 4x 1mb[ish] connections). Even then it is VLANned to keep them seperate.

 

My rule is - if they bring in their laptop and use it, all they get is filtered internet access. No access to documents or school applications unless through school email or VLE (effectively going out then coming back in again securely).

 

They sign a disclaimer stating if they contract any virus/spyware whilst on the wireless 'dirty' network - it is their own fault (or words to that effect).

 

Ben

[enjay]

They sign a disclaimer stating if they contract any virus/spyware whilst on the wireless 'dirty' network - it is their own fault (or words to that effect).

 

The inclusion of that clause for using the "dirty" network but its omission from your main AUP suggests that you are accepting liability for damage caused by any viruses contracted from your main network. This is only suggested, and not outright said, but if someone wanted to push that one, you could find yourself in hot water...

[Ben_Stanton]

its in the AUP. Year 7's sign it on the way into the school. New students also get it in the welcome pack, existing students (already here before that update) get it as a pop up when they log in?

 

Still aproblem? I'll remove if so, what do you recommend?

 

Ben

[enjay]

Personally, I would want the disclaimer to cover all networks, not just the dirty one.

 

While our networks are virus-free 99.999% of the time, I wouldn't want any comeback for that 0.001% of the time when home computers become infected by something which came from school.

[sippo]

Our 6th Formers are allowed to use the wireless network to access filtered internet. Thats all, they can't access any other resources.

 

Am I being naive and letting them use it. Should I review the situation? Is it possible they could bring in a virus which could spread via network IP alone?

 

This thread has got me thinking...

[enjay]

Is it possible they could bring in a virus which could spread via network IP alone?

 

Yes. Nimda and the like which go hunting for vulnerable computers could come in via their computers. Also, they could be running packet sniffers which could pick up something juicy, if they got hold of your VNC password or a copy of AB Tutor or whatever, they could run those or those could launch a DoS attack.

 

I would get any uncontrolled laptops off your main network, personally. Even on our restricted WiFi, they only have the standard ports open, so they can't use P2P or such like and eat our bandwidth.

[sippo]

Whats the best way around securing it then? Do we ban them completely (Imagine the uproar!), or create a separate VLAN (which don't really want to do). If we go down the VLAN route, things start to get messy.

[enjay]

Whats the best way around securing it then? Do we ban them completely (Imagine the uproar!), or create a separate VLAN (which don't really want to do). If we go down the VLAN route, things start to get messy.

 

You could at least look at blocking non-standard ports on the APs. Not totally fool-proof, but a step in the right direction.